ubuntu 下关于PCAP_FRAMES设置的原文
2007-12-16 22:20
183 查看
4.1 MMAPed pcap
On Linux, a modified version of libpcap is available that implements a shared memory ring buffer. Phil Woods (cpw@lanl.gov) is the current maintainer of the libpcap implementation of the shared memory ring buffer. The shared memory ring buffer libpcap can be downloaded from his website at http://public.lanl.gov/cpw/.Instead of the normal mechanism of copying the packets from kernel memory into userland memory, by using a shared memory ring buffer, libpcap is able to queue packets into a shared buffer that Snort is able to read directly. This change speeds up Snort by limiting the number of times the packet is copied before Snort gets to perform its detection upon it.
Once Snort linked against the shared memory libpcap, enabling the ring buffer is done via setting the enviornment variable PCAP_FRAMES. PCAP_FRAMES is the size of the ring buffer. According to Phil, the maximum size is 32768, as this appears to be the maximum number of iovecs the kernel can handle. By using PCAP_FRAMES=max, libpcap will automatically use the most frames possible. On Ethernet, this ends up being 1530 bytes per frame, for a total of around 52 Mbytes of memory for the ring buffer alone.
那么在ubuntu下:
在启动脚本中加入export PCAP_FRAMES=32768
相关文章推荐
- 关于Ubuntu的ip设置
- 关于叙述Ubuntu 8.10常用软件,设置,配置(一)
- 关于ubuntu中利用crontab设置定时任务的问题
- ubuntu关于环境变量的设置
- 关于ubuntu卸载ibus后导致系统设置不能打开
- 关于ubuntu下apache虚拟目录的设置问题
- 关于Ubuntu下MySQL的设置问题
- 关于ubuntu设置启动到字符界面
- 关于叙述Ubuntu 8.10常用软件,设置,配置(二)
- 关于ubuntu下设置静态IP,而且也设置了DNS服务后,仍然无法上网的问题
- 关于Ubuntu的ip设置
- 关于Ubuntu 中设置samba 用户访问
- 关于Ubuntu的ip设置
- 关于Ubuntu中google chrome浏览器字体的设置
- 关于Ubuntu设置代理
- Ubuntu中关于hadoop环境变量的设置方法
- 关于Android手机MTP模式连接的一些设置(win7和ubuntu下,以红米1s为例)
- [转]Linux 配置双显示器 (原文名: Ubuntu 8.04/8.10 设置笔记本电脑双显示器)
- ubuntu12.04使用eclipse快捷键设置--关于alt+/无法使用,ubuntu删除alt快捷键
- 关于ubuntu设置ssh远程连接