Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enhancement: netsniff-ng: specify ring buffer size #376

Closed
GoogleCodeExporter opened this Issue Mar 24, 2015 · 11 comments

Comments

Projects
None yet
1 participant
@GoogleCodeExporter
Copy link

GoogleCodeExporter commented Mar 24, 2015

I have patches attached to allow the user, via sosetup, to specify the size of 
the RX_RING buffer allocated by netsniff-ng. I believe the default 64MiB value 
is probably too low for medium and high load networks so I also included a 
recommendation in the zenity text. The user's input is also validated. 

Patch created against fresh install of SO 12.04.2. 
Tested and working in my VM. 

Screenshots and patches attached.


Original issue reported on code.google.com by jonsch...@gmail.com on 15 Aug 2013 at 12:53

Attachments:

@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Hi Jon,

Thanks for the patches!

To maintain consistency with our existing pcap file size selection in Setup, I 
wonder if we should drop the MB/GB unit and just have the user enter the buffer 
size in MB (MiB)?

Thoughts?

Thanks!

Original comment by doug.bu...@gmail.com on 15 Aug 2013 at 10:55

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

I like having the different units but that's just my personal preference. As 
for as usability goes, I don't think many people, if any,  will allocate buffer 
sizes in KB. I see GB as saving some typing and maybe some basic arithmetic. 
Though, if you stick with allowing different units as in my patch, I can submit 
a patch for PCAP_SIZE to allow more sizes and even time intervals, sec, min, 
and hour.

Just let me know.

Original comment by jonsch...@gmail.com on 15 Aug 2013 at 2:52

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

I agree that most folks will NOT allocate buffer sizes in KB :)

Let's keep it simple and have the user enter the buffer size in MB (MiB) just 
like our existing pcap file size selection.

Thanks!

Original comment by doug.bu...@gmail.com on 16 Aug 2013 at 10:22

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Do you need me to modify the patch and resend?

Original comment by jonsch...@gmail.com on 16 Aug 2013 at 2:39

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

If you could, I would appreciate it!

Original comment by doug.bu...@gmail.com on 16 Aug 2013 at 2:41

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Fixes attached.

Original comment by jonsch...@gmail.com on 16 Aug 2013 at 5:58

  • Added labels: ****
  • Removed labels: ****

Attachments:

@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Thanks!

Original comment by doug.bu...@gmail.com on 16 Aug 2013 at 5:59

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Are you still planning to include this?

Original comment by jonsch...@gmail.com on 27 Aug 2013 at 5:37

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Yes, it's on the Roadmap:
https://code.google.com/p/security-onion/wiki/Roadmap

Little busy right now :)

Original comment by doug.bu...@gmail.com on 27 Aug 2013 at 5:38

  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Tested by JP Bourget and David Zawdie.

Published:
http://securityonion.blogspot.com/2013/10/new-nsmsetup-packages-now-available.ht
ml

Original comment by doug.bu...@gmail.com on 10 Oct 2013 at 12:04

  • Changed state: Verified
  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Copy link
Author

GoogleCodeExporter commented Mar 24, 2015

Awesome!

Original comment by jonsch...@gmail.com on 10 Oct 2013 at 4:01

  • Added labels: ****
  • Removed labels: ****
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.