[Oisf-users] running on an ARM Raspberry pi 4 with 4 gig

Andreas Herz aherz at oisf.net
Mon Oct 7 20:16:22 UTC 2019


On 04/10/19 at 16:42, Matthew Dunlop wrote:
> We have been testing suricata on the raspberry 4 with 4 gigs of ram and with the wazuh agent we are able to
> get alerts into our wazuh cluster. in other deployments we have chosen to use PCAP mode instead of AF-packet but we can't seem to get
> it on the PI to change. we are running on 2019-09-26-raspbian-buster-full?.

what bandwith can you handle with the Pi4 and what does your
configuration look like?

Why would you want to switch to PCAP mode?

Andreas Herz

More information about the Oisf-users mailing list