CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Improve pcap defaults

Browse Source
This commit is contained in:
Mike Reeves
2022-09-14 11:11:21 -04:00
parent 0a40bfcb88
commit be4c15877a
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
salt/pcap/soc_pcap.yaml
View File

@@ -8,5 +8,17 @@ pcap:
description: The disk space percent to always keep free for pcap description: The disk space percent to always keep free for pcap
blocks: blocks:
description: The number of 1MB packet blocks used by AF_PACKET to store packets in memory, per thread. You shouldn't need to change this. description: The number of 1MB packet blocks used by AF_PACKET to store packets in memory, per thread. You shouldn't need to change this.
advanced: True
preallocate_file_mb: preallocate_file_mb:
description: File size to pre-allocate for individual pcap files. You shouldn't need to change this. description: File size to pre-allocate for individual pcap files. You shouldn't need to change this.
advanced: True
aiops:
description: The max number of async writes to allow at once.
advanced: True
pin_to_cpu:
description: Enable CPU pinning for PCAP.
cpus_to_pin_to:
description: CPU to pin PCAP to. Currently only a single SPU is supported
disks:
description: List of disks to use for PCAP. This is currently not used.
advanced: True