Hi all, looking at PcapSource::OpenLive() in iosource/pcap/Source.cc I was wondering whether it would be better to use pcap_set_immediate instead of "setting the smallest time-out possible" with pcap_set_timeout.
Could it be that, especially in high-throughput environments, the introduced timeout in polling on the socket buffer may cause initial packet loss? best, Valerio _______________________________________________ bro-dev mailing list [email protected] http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
