Will in # cat /proc/net/pf_ring/ZZZ of argus/daemonlogger what bucket len you see?
Luca ---- Luca Deri <[EMAIL PROTECTED]> You must be the change you want to see in the world Mahatma Gandhi On Jul 29, 2008, at 2:07 PM, Will Metcalf wrote: > Yeah.... so for example I have daemonlogger running with a snaplen of > 1515. I restart argus with a snaplen of 96. Without restarting > daemonlogger all packets after the restart are a max length of 96 > bytes. > > Regards, > > Will > > On Tue, Jul 29, 2008 at 2:27 AM, Luca Deri <[EMAIL PROTECTED]> wrote: >> Will >> you mean that with the code that's currently on SVN, one >> application can >> change the snaplen of another running application? >> >> Luca >> >> Will Metcalf wrote: >>> I'm having a weird issue with the latest pf_ring that allows user >>> specified snaplen/caplen to tell pf_ring what the bucket length >>> should >>> be. Everything works fine until I restart one of the apps argus >>> which >>> has a smaller snaplen than snort and daemonlogger both with a >>> snaplen >>> of 1515. Once I do this both deamonlogger and snort start to only >>> capture 96 bytes of traffic that is specified as the argus snaplen. >>> If I change the argus snaplen to to 1515 everything is fine, but I >>> don't want to do that as the boxes are overtaxed as it is, and I >>> need >>> to roll the argus files via cron daily.... >>> >>> Regards, >>> >>> Will >>> _______________________________________________ >>> Ntop-dev mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-dev >>> >> >> _______________________________________________ >> Ntop-dev mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-dev >> > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
