> On 16 Dec 2014, at 12:12, Jesse Bowling <[email protected]> wrote: > > >> On Dec 16, 2014, at 04:00, Alfredo Cardigliano <[email protected]> wrote: >> >> If your snort instances are consuming too slowly, incoming packets are being >> discarded. Snort is able to read stats about discarded packets through the >> DAQ-ZC. > > So the model is for the app to check on packet loss through the ZC API?
Correct > I'm thinking of the multitude of apps that do not have a DAQ middle piece > (Argus, Bro, etc) but are simply being compile against libpcap; it seems the > above model is at best a break with the long standing tradition… Applications on top of libpcap will read stats through libpcap, no break. Alfredo > > Cheers, > > Jesse > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
