I'm curious if people tend to run nfcapd with multiple sources specified under an single instantiation (i.e. with multiple -n switches) or if the preference is to run multiple process instances of nfcapd and listen on distinct ports or addresses for each export source (or source set).
It seems slightly cleaner to just run a single instance of nfcapd, but if there are multiple sources, perhaps there is some advantage for maintenance purposes, and maybe for them to each have their own socket buffer and possibly CPU? Interested in your experience and thoughts, John ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Nfdump-discuss mailing list Nfdump-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
