snaplen is too small for jumbo frames
Description
topic/jazoff/fix-snaplen in broctl and bro change the default snaplen from 8192 to 9216
The default snaplen is too small to handle jumbo frames properly.
Also.. I'm not sure if the pcap variables in broctl should default to anything.. with the options defaulting to a value you can't override the snaplen with a redef in bro script since the broctl-config.bro file pushed out by broctl will override it.
Environment
Activity
I would propose that we just remove that broctl config option. I think it's more confusing
than helpful to be able to configure the same parameter in two totally different files (especially
considering that the two variables don't even share the same name!).
works for me I guess.. most likely if someone did change either of those options, it was to set snaplen to 9216 in the first place.
Can the broctl option be deprecated and a warning emitted that the option should be set in local.bro instead? Then we can remove it in version+2
Yes, that's trivial to do (and there's already an example of this in the broctl src code).
I merged the branch but didn't do the suggestion of deprecating the broctl option: I noticed there's other options for which broctl ends up adding an overriding redef, so it would make sense to consider auditing whether they actually make sense as broctl options and then deprecating them all at one time rather just for this one option.
Assignee
Reporter
Labels
External issue ID
Components
Fix versions
Affects versions
Priority
