Bucket length shows the same thing that was specified at startup for snaplen. The value in proc doesn't change after restarting the app but it only captures 96 bytes if that is the snaplen for argus.
Regards, Will [EMAIL PROTECTED] pf_ring]# cat 1826-eth0.25 Bound Device : eth0 Version : 9 Sampling Rate : 1 IP Defragment : No BPF Filtering : Enabled # Filt. Rules : 0 Cluster Id : 0 Tot Slots : 8194 Bucket Len : 1514 Slot Len : 1584 [bucket+header] Tot Memory : 12980224 Tot Packets : 73547620 Tot Pkt Lost : 0 Tot Insert : 73547620 Tot Read : 73547620 On 7/29/08, Luca Deri <[EMAIL PROTECTED]> wrote: > Will > in # cat /proc/net/pf_ring/ZZZ of argus/daemonlogger what bucket len > you see? > > Luca > > ---- > Luca Deri <[EMAIL PROTECTED]> > > You must be the change you want to see in the world > Mahatma Gandhi > > > > On Jul 29, 2008, at 2:07 PM, Will Metcalf wrote: > > > Yeah.... so for example I have daemonlogger running with a snaplen of > > 1515. I restart argus with a snaplen of 96. Without restarting > > daemonlogger all packets after the restart are a max length of 96 > > bytes. > > > > Regards, > > > > Will > > > > On Tue, Jul 29, 2008 at 2:27 AM, Luca Deri <[EMAIL PROTECTED]> wrote: > >> Will > >> you mean that with the code that's currently on SVN, one > >> application can > >> change the snaplen of another running application? > >> > >> Luca > >> > >> Will Metcalf wrote: > >>> I'm having a weird issue with the latest pf_ring that allows user > >>> specified snaplen/caplen to tell pf_ring what the bucket length > >>> should > >>> be. Everything works fine until I restart one of the apps argus > >>> which > >>> has a smaller snaplen than snort and daemonlogger both with a > >>> snaplen > >>> of 1515. Once I do this both deamonlogger and snort start to only > >>> capture 96 bytes of traffic that is specified as the argus snaplen. > >>> If I change the argus snaplen to to 1515 everything is fine, but I > >>> don't want to do that as the boxes are overtaxed as it is, and I > >>> need > >>> to roll the argus files via cron daily.... > >>> > >>> Regards, > >>> > >>> Will > >>> _______________________________________________ > >>> Ntop-dev mailing list > >>> [email protected] > >>> http://listgateway.unipi.it/mailman/listinfo/ntop-dev > >>> > >> > >> _______________________________________________ > >> Ntop-dev mailing list > >> [email protected] > >> http://listgateway.unipi.it/mailman/listinfo/ntop-dev > >> > > _______________________________________________ > > Ntop-dev mailing list > > [email protected] > > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
