Re: 5.2.1 + snort, dropping packets

From: Sergey Lyubka <devnull_at_uptsoft.com>
Date: Thu, 27 May 2004 17:22:23 +0300
> This might be old information, but on stable branch, libpcap
> overrode the 'debug.bpf_bufsize' and always made it 4K. I made
> a local change and it fixed it for me. Not sure if that is
> corrected on current.
> 
> On the system you indicate you should be able to get ~300Kpps
> into user space via bpf, or at least, you can with stable.

thanks for the hint!
libpcap 0.8.3, which is already ported to -current,
fixes this problem.
Received on Thu May 27 2004 - 05:23:19 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:55 UTC