> On Dec 16, 2014, at 04:00, Alfredo Cardigliano <[email protected]> wrote: > > If your snort instances are consuming too slowly, incoming packets are being > discarded. Snort is able to read stats about discarded packets through the > DAQ-ZC.
So the model is for the app to check on packet loss through the ZC API? I'm thinking of the multitude of apps that do not have a DAQ middle piece (Argus, Bro, etc) but are simply being compile against libpcap; it seems the above model is at best a break with the long standing tradition... Cheers, Jesse _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
