Re: snort + freebsd tuning

[Nigel Houghton <nigel () sourcefire com>]

Around Yesterday John said:
J: I was just wondering if someone could tell me what this is for.
J: sysctl debug.bpf_bufsize (default it 4k)
J: does snort override this value, and if not should i be increasing it?

This is the buffer size for bpf. 4k is pretty small, you could increase it
to a value you might be more comfortable with, say 512 K or 1 Meg if you
have the resources.

 sysctl debug.bpf_bufsize=<insert your value here>

You could also pu debug.bpf_bufsize=<value> in /etc/sysctl.conf so you
keep it whenever you reboot.

No, I don't believe Snort increases debug.bpf_bufsize.

-------------------------------------------------------------
Nigel Houghton   Security Research Engineer   Sourcefire Inc.
                 Vulnerability Research Team

"Mankind hasn't even got the technology to create a toupee
that doesn't get big laughs." -- Lister


-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users