pcap-log: yaml comment update

diff --git a/suricata.yaml.in b/suricata.yaml.in
index fd985dc4af1e99e08a02f03a66c39da554962c36..7493d0e4484eac2cd2c6c9e3a15cebe309268c92 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -206,7 +206,7 @@ outputs:
       # If set to a value will enable ring buffer mode. Will keep Maximum of "max-files" of size "limit"
       max-files: 2000
 
-      mode: normal # normal or sguil.
+      mode: normal # normal, multi or sguil.
       #sguil-base-dir: /nsm_data/
       #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
       use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets