Thank You. I poked around and was looking for where this limitation could exist. These are in the global-defines.h as I didn't see a global-headers.h.
Would one of these be the culprit?
Thanks in advance for your assistance in this matter.
M
#define LEN_TIMEFORMAT_BUFFER 48
#define LEN_CMDLINE_BUFFER 4096
#define LEN_FGETS_BUFFER 512
#define LEN_HUGE_WORK_BUFFER 4096
#define LEN_GENERAL_WORK_BUFFER 1024
#define LEN_MEDIUM_WORK_BUFFER 128
#define LEN_SMALL_WORK_BUFFER 24 /* nnn.nnn.nnn.nnn\n */
#define LEN_ADDRESS_BUFFER
sizeof("FEDC:BA98:7654:3210:FEDC:BA98:7654:3210")+4
From: [email protected]
[mailto:[email protected]] On Behalf Of Burton Strauss III
Sent: Friday, September 14, 2012 7:26 AM
To: [email protected]
Subject: Re: [Ntop] BPF Character Limitation?
I'm sure there is some internal size limit - nTop is rather memory intensive,
so most buffers are limited to 'reasonable' (compromise) sizes, reused where
possible, etc.
But that's the beauty of open source - you can downbload the source, increase
the buffer size to whatever you need and recompile.
As to WHERE to find it, I don't remember, it's been over five years since I
really looked at the sources. Try global-headers.h.
[Description: Burton 0.75]
-----Burton
From: [email protected]
[mailto:[email protected]] On Behalf Of Cabeza de Baca, Matthew
Sent: Thursday, September 13, 2012 12:30 PM
To: '[email protected]'; '[email protected]'
Subject: [Ntop] BPF Character Limitation?
Hello all.
I have a rather complex BPF filter. We are installing a firewall and we are
using NTOP to categorize the traffic on link. As we identify traffic and
create firewall rules we want to mimic those in NTOP as excludes to whittle
down the data we have to wade through and get to the little stuff that is
transversing the link.
My current BPF filter is 1,151 characters with no spaces and 1037 characters
with spaces. If I add one more exclude, even changing : !(port 137) to !(port
137,53) the entire filter stops working.
Are there limitations to the BPF format? Currently I have the filter set in
ntop.conf using the -B switch.
Any thoughts would be appreciated.
Thank You.
M
________________________________
This e-mail message, including any attachments, is for the
sole use of the intended recipient(s) and may contain
confidential or privileged information. Any unauthorized
review, use, disclosure or distribution is prohibited. If
you are not the intended recipient, please contact the
sender by reply e-mail and destroy the message.
________________________________
Think Green! Please do not print this e-mail unless you need to. Thank you.
________________________________
This e-mail message, including any attachments, is for the
sole use of the intended recipient(s) and may contain
confidential or privileged information. Any unauthorized
review, use, disclosure or distribution is prohibited. If
you are not the intended recipient, please contact the
sender by reply e-mail and destroy the message.
<<inline: image001.jpg>>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
