[Oisf-users] File Extraction Woes

[Cooper F. Nelson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've successfully used file extraction in a similar configuration, but
with AF_PACKET + mmap mode.

Are you stuck with PF_RING for some reason?

- -Coop

On 5/30/2014 9:31 AM, Jason Batchelor wrote:
> Hello,
> 
> I am having some issues with file extraction in Suricata, and after
> attempting to do many optimizations and review of others experiences I
> am still finding myself out of luck. Below is some verbose output of my
> current configuration and some sample data after ~12 hours of running. I
> have also included a smaller time frame with a few subtle changes for
> consideration.
> 

- -- 
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
cnelson at ucsd.edu x41042
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJTiL3wAAoJEKIFRYQsa8FWBlkIAKt4ftkN1b3mVJRu4wBkSHIB
et+ZK+VcUuXFFdhiu9bx+TAqWwpQfyNTh7kTCJCQfhZm60h49jds5xEktE2KsdQb
JD22ytL1zT6ktv+gA/O7lkZGQwN0AIBgrigcUkfyISsikRGrNweMXVxyPW75Jn0K
fapg0wc415dbvDH/0XXmfqQspWRHbuPt74WZzCXpMN45/Pziy9yqA+6nVnMyGwbB
67QTHcTnb2c+evx2AC5olCalHpSnkqxqrVUC//FZoNDB8KEpY3sdUx3AAFdbtp74
YK2/S4VD1xkxcEl/yBC80TzMD3pRYkNyv3VMtfruEvCAbDdgxEsMw9GsfkW1KzY=
=zZun
-----END PGP SIGNATURE-----