]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
napatech: Added description of hba usage.
authorPhil Young <py@napatech.com>
Mon, 17 Jul 2017 14:03:44 +0000 (10:03 -0400)
committerVictor Julien <victor@inliniac.net>
Tue, 1 Aug 2017 08:13:54 +0000 (10:13 +0200)
doc/userguide/capture-hardware/napatech.rst

index 2ac4aa685f305dbe41275358159227ecd80f5dad..3a548bb0dc0d727cbb92e12848f32e80d71f895a 100644 (file)
@@ -127,6 +127,12 @@ ntservice.ini::
                # The streams to listen on
                streams: [0, 1, 2, 3, 4, 5, 6, 7]
 
+Note: hba is useful only when a stream is shared with another application.  When hba is enabled packets will be dropped
+(i.e. not delivered to suricata) when the host-buffer utilization reaches the high-water mark indicated by the hba value.
+This insures that, should suricata get behind in it's packet processing, the other application will still receive all
+of the packets.  If this is enabled without another application sharing the stream it will result in sub-optimal packet
+buffering.
+
 
 Basic Configuration
 -------------------