[Oisf-devel] [PATCH 0/2] lighten Packet structure v2

[Robert Kerr]

On Tue, 2010-11-16 at 23:00 +0100, Eric Leblond wrote:
> Hi,

> Here's a new version of the patchset which mainly does a renaming
> of the function and increase the maximum packet size to 1514.

I don't know if this is possible without adding to the complexity of
things a lot, but could this max packet size be configured at runtime?

It seems clear that the value should be either the same as or slightly
higher than the MTU of the link suricata is monitoring. The problem is
this may not be known at compile time - by fixing at 1514 you optimise
for ethernet, but there are various other possibilities. SONET has an
MTU around the 4000 mark, as does FDDI, and ethernet with jumbo frames
is vendor specific but often around the 9000 mark.

-- 
 Robert Kerr