[Ntop-dev] strange issue with latest pf_ring
william.metcalf at gmail.com
Mon Jul 28 22:18:26 CEST 2008
I'm having a weird issue with the latest pf_ring that allows user
specified snaplen/caplen to tell pf_ring what the bucket length should
be. Everything works fine until I restart one of the apps argus which
has a smaller snaplen than snort and daemonlogger both with a snaplen
of 1515. Once I do this both deamonlogger and snort start to only
capture 96 bytes of traffic that is specified as the argus snaplen.
If I change the argus snaplen to to 1515 everything is fine, but I
don't want to do that as the boxes are overtaxed as it is, and I need
to roll the argus files via cron daily....
More information about the Ntop-dev