Thanks for everybody's help, but after I install Phil's libpcap with mmap
functionality, I figure I do not have the libpcap.so.0.8.3.so file under
/usr/local/lib. There are broken links of the following:
libpcap.so -> libpcap-0.8.3.so
libpcap.so.0 -> libpcap-0.8.3.so
libpcap.so.0.7 -> libpcap-0.8.3.so
libpcap.so.0.8 -> libpcap-0.8.3.so
I have included /usr/local/lib under my ld.so.config file, and then when I run
ldconfig, missing links reduced to the following:
libpcap.so -> libpcap-0.8.3.so
what am I missing? Many thanks!
Hugo
Phil Wood <cpw@lanl.gov> wrote:
This is relevant to users running snort on linux:
I've made a change to the max calculation. Before, max was just the max
based on a 2.4.<25 kernel for a payload snaplen of 1500 (standard ethernet).
If you were running a tcpdump to just get the IP headers (-s68), then
the max was still the same. Now, the release labeled 20050129 will
calculate how many frames of a given size will fit on the ring. You
may need more RAM to use this feature. Basically, the max requires
that you have (over and above other requirements), 134217728 Mbytes
(and then some of course) of available memory. The ring itself uses
'size-131072' (see /proc/slabdata) for the ring of pointers.
Please try the current libpcap release which can be found at:
http://public.lanl.gov/cpw
Read the items dated Jan 29 and Jan 19, 2005.
On Fri, Jan 28, 2005 at 06:15:27PM +0000, Lawrence Reed wrote:
Hugo wrote:
It seems like I'm on a high traffic volume network and will probably need
tp upgrade my libpcap to mmap, unfortunately, I haven't got much success.
I don't understand how to get Snort to use the new libpcap. Any pointers
would be appreciated.
I wonder how the sourcefire products solve this problem?
Hugo
I assume you mean the libpcap from Phil Wood ( thanks Phil).
I build snort with the pcap libraries linked in statically as follows:
LDFLAGS=-static ./configure
--with-libpcap-libraries=/path/to/philwood/pcap
--with-libpcap-includes=/path/to/philwood/pcap
I also set the environment variable PCAP_FRAMES.
I use export PCAP_FRAMES=max in my snort startup script.
Using unified logging, a full ruleset, the above referenced pcap on a
dual 2.8Ghz Xeon I have < 0.005% drops with traffic in excess of 300Mbs.
Larry
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
Phil Wood (cpw_at-sign_lanl.gov)
__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register
Netscape. Just the Net You Need.
New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
