PF ring support in argus

[Carter Bullard]

Hey Peter,
Ok, I'll take a look to see what I need to do.  If we need to add a  
parameter,
would it be reasonable to put it just in the argus.conf, or will we  
need a
command line option?

Carter

On Oct 12, 2007, at 10:22 AM, Peter Van Epp wrote:

> On Fri, Oct 12, 2007 at 10:12:23AM -0400, Carter Bullard wrote:
>> Hey Russell,
>> I looked around, and I don't think there is anything that argus needs
>> to do
>> for you to have it use a pf_ring as a packet source.
>>
>> Peter's been using rings for a long time, and I don't think he has  
>> had
>> to make any argus changes?  You do need to make some kernel changes
>> but I don't think argus needs to know about that.
>>
>> Carter
>>
>
> 	Thats true with PF-ring from the ntop author, but Russell is using  
> the
> one from lbl which I haven't tried yet (its on the list but time is  
> lacking
> and PF-ring is working :-)). The ntop pf-ring replaces the libpcap  
> interface
> with one of its own and is transparent to applications, I'd expect  
> the lbl
> one to be similar but it may take a parameter for how big you want  
> the internal
> buffers (my PF-ring gets that from the kernel module load command).
>
> Peter Van Epp / Operations and Technical Support
> Simon Fraser University, Burnaby, B.C. Canada
>