Tapping into the ring buffer

[sekure <sekure () gmail com>]

Snorters,

I am running snort compiled against Phil Woods modified libpcap
library and I was thinking if it was possible to tap into the buffer
that it creates with other applications without having to recapture
the packets off the wire if i wanted to run some additional
statistical or gathering tools on them.  For example, if i run snort
and tcpdump side by side, on the same interface, are they both
grabbing packets, and is this introducing any sort of latency?  Could
I for example run snort and ntop and PADS (passive.sourceforge.net)
side by side on the same interface without introducing any more
slowdown (other than what is caused by processing within the
individual application).

Does anyone know how much impact, if any, is introduced by running
additional promiscious mode applications, specifically due to
sniffing, or if there is any interaction at all?

I am not 100% clear about what happens deep in the guts of the OS, so
i need someone to set me straight.

Thanks in advance.


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users