Ring Buffer Memory

[Carter Bullard]

Hey John,
ARGUS_ENV is provided to support sub-systems that can use environment variables for configuration.  This is helpful for packet capture card device drivers, for the most part, but some of the ring buffer drivers can use environment variables, like the PCAP_PF_RING_DNA_RSS, PF_RING_ACTIVE_POLL, PCAP_PF_RING_USE_CLUSTER_PER_FLOW, etc…  What ring buffer driver are you using ???

With the -B option, standard tcpdump.org tcpdump is not modifying the environment, its calling pcap_set_buffer_size(), which is kinda new (2011?? 2012??).  

Would you like argus to be able to set the pcap_buffer_size ???
If we need to make a change, can we put it in the argus.conf file ???

Carter


> On Nov 17, 2014, at 8:29 PM, John T. Myers <myersj0 at gmail.com> wrote:
> 
> Hi,
> 
> When trying to increase the libpcap ring buffer capacity in argus.conf, it does not appear to change anything on an Ubuntu system running argus.
> 
> We tried doing the same 2GB size with tcpdump using the -B option and watched the memory usage climb dramatically as it should.
> 
> However, when trying to set using ARGUS_ENV="PCAP_MEMORY=2000000" there is no increase in memory usage by argus at all.
> 
> John
> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6837 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20141118/e8e41d8a/attachment.bin>