From: Phil Young Date: Mon, 17 Jul 2017 14:03:44 +0000 (-0400) Subject: napatech: Added description of hba usage. X-Git-Tag: suricata-4.0.1~44 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f6838f9085b10380196aa8500fb861e3aefec079;p=thirdparty%2Fsuricata.git napatech: Added description of hba usage. --- diff --git a/doc/userguide/capture-hardware/napatech.rst b/doc/userguide/capture-hardware/napatech.rst index 2ac4aa685f..3a548bb0dc 100644 --- a/doc/userguide/capture-hardware/napatech.rst +++ b/doc/userguide/capture-hardware/napatech.rst @@ -127,6 +127,12 @@ ntservice.ini:: # The streams to listen on streams: [0, 1, 2, 3, 4, 5, 6, 7] +Note: hba is useful only when a stream is shared with another application. When hba is enabled packets will be dropped +(i.e. not delivered to suricata) when the host-buffer utilization reaches the high-water mark indicated by the hba value. +This insures that, should suricata get behind in it's packet processing, the other application will still receive all +of the packets. If this is enabled without another application sharing the stream it will result in sub-optimal packet +buffering. + Basic Configuration -------------------