[Oisf-users] [TIL] pcap.buffer-size yaml setting unused with Myricom Sniffer10g

[Victor Julien]

Hi Zach,

On 05/15/2015 08:15 PM, Rasmor, Zachary R wrote:
> This will only be relevant to folks using Myricom cards, but I wanted to
> share something I learned today…
> 
>  
> 
> As I’m sure you know, Myricom provides a libpcap wrapper around its
> native SNF APIs. I had been unsure for a while how the pcap.buffer-size
> YAML setting was used within SNF. My testing yielded no noticeable
> difference in Suricata when adjusting this value, however I wanted to be
> sure. I tracked this value to a call to pcap_set_buffer_size (a libpcap
> API) within the Suricata source code. I then began an exchange with
> Myricom support regarding how SNF handles the pcap_set_buffer_size()
> API. Here was the response:
> 
>  
> 
> “The libpcap interface to Sniffer10G ignores the pcap_set_buffer_size()
> value.  The call to snf_open() uses zero as the dataring_size which
> informs the Sniffer library to use a default value or the value from the
> SNF_DATARING_SIZE environment variable.”
> 
>  
> 
> They also cited a pull request to add support for setting the
> SNF_DATARING_SIZE using the value from pcap_set_buffer_size().
> 
>  
> 
>                 “I've submitted this change to the libpcap maintainers
> at
> https://github.com/the-tcpdump-group/libpcap/compare/master...myri:master as
> pull request 435.”
> 
>  
> 
> In summary, the pcap.buffer-size YAML setting is currently ignored when
> using Myricom SNF, however a future release should provide support for
> using the pcap.buffer-size to set the SNF_DATARING_SIZE from within the
> YAML file instead of an environment variable.
> 
>  

Could you update this wiki page with this insight?
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Myricom

Thanks!

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------