jeffmurphy / daq Goto Github PK
View Code? Open in Web Editor NEWSnort DAQ (based on v0.5) with round-robin pcap plugin. On (some) Endace equipped machines, it's not possible to merge streams together using bonding, or across cards. This patch does it in DAQ by round-robining the pcap reads. E.g. start snort like this: /usr/sbin/snort --daq pcaprr -i dag0:4,dag1:4
License: Other