[Oisf-users] running on an ARM Raspberry pi 4 with 4 gig

[Andreas Herz]

Hi,

On 04/10/19 at 16:42, Matthew Dunlop wrote:
> We have been testing suricata on the raspberry 4 with 4 gigs of ram and with the wazuh agent we are able to
> 
> get alerts into our wazuh cluster. in other deployments we have chosen to use PCAP mode instead of AF-packet but we can't seem to get
> 
> it on the PI to change. we are running on 2019-09-26-raspbian-buster-full?.

what bandwith can you handle with the Pi4 and what does your
configuration look like?

Why would you want to switch to PCAP mode?

-- 
Andreas Herz