snort option [-n packet-count ]

[ratheesh kannoth <ratheesh.ksz () gmail com>]

Hi list,

I am working on a daq layer implementation. I have zero copy from
driver and will send packet to snort thru daq layer. i have two
questions.

1. what is the advantage of mentioning packet-count ? because  in
Daq_Acquire() function ,  daq layer has to call  the call back
function of snort  and  act on verdict. It is all serial ( one packet
at a time ). ?

2. In DAQ layer, i have to fill   DAQ_PktHdr. i could see that
hdr.egress_index  is filled as -1 in  some implementation (
       like in PF_RING DAQ ). what is its significance ?


-Ratheesh

------------------------------------------------------------------------------
"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
Instantly run your Selenium tests across 300+ browser/OS combos.
Get unparalleled scalability from the best Selenium testing platform available
Simple to use. Nothing to install. Get started now for free."
http://p.sf.net/sfu/SauceLabs
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!