Yeah but I think it really should be fixed, because then what is the behavior of argus if I restart a different app? Does argus then take on the default bucket length of 1600 bytes? I think the per app bucket length is a great feature, as some apps only need to see headers, where some need to see the full packet.
Regards, Will On 7/28/08, Diogo Sato <[EMAIL PROTECTED]> wrote: > > Will, > I recently had this same trouble with pf_ring snaplen. > The API function does not work properly if you didn't set the correct > "bucket_len" arg when you load the ring module . > The default BUCKET_LEN value is set to 96 or 128 bytes , probably for capture > optimization > > so, to correct this strange issue, try it: > > rmmod ring > insmod path_to_ring/ring.ko bucket_len=1600 > > and restart your apps , it will be OK > > regards, > Diogo Sato > > www.predialnet.com.br > PredialNet Wireless ISP > > > > ----- Mensagem Original ----- > De: Will Metcalf <[EMAIL PROTECTED]> > Para: ntop-dev@unipi.it > Data: Monday, 28 De July De 2008 18:18 > Assunto: [Ntop-dev] strange issue with latest pf_ring > > > I'm having a weird issue with the latest pf_ring that allows user > > specified snaplen/caplen to tell pf_ring what the bucket length should > > be. Everything works fine until I restart one of the apps argus which > > has a smaller snaplen than snort and daemonlogger both with a snaplen > > of 1515. Once I do this both deamonlogger and snort start to only > > capture 96 bytes of traffic that is specified as the argus snaplen. > > If I change the argus snaplen to to 1515 everything is fine, but I > > don't want to do that as the boxes are overtaxed as it is, and I need > > to roll the argus files via cron daily.... > > > > Regards, > > > > Will > > _______________________________________________ > > Ntop-dev mailing list > > Ntop-dev@unipi.it > > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > > > > _______________________________________________ > Ntop-dev mailing list > Ntop-dev@unipi.it > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > _______________________________________________ Ntop-dev mailing list Ntop-dev@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop-dev
