From f6838f9085b10380196aa8500fb861e3aefec079 Mon Sep 17 00:00:00 2001 From: Phil Young Date: Mon, 17 Jul 2017 10:03:44 -0400 Subject: [PATCH] napatech: Added description of hba usage. --- doc/userguide/capture-hardware/napatech.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/userguide/capture-hardware/napatech.rst b/doc/userguide/capture-hardware/napatech.rst index 2ac4aa685f..3a548bb0dc 100644 --- a/doc/userguide/capture-hardware/napatech.rst +++ b/doc/userguide/capture-hardware/napatech.rst @@ -127,6 +127,12 @@ ntservice.ini:: # The streams to listen on streams: [0, 1, 2, 3, 4, 5, 6, 7] +Note: hba is useful only when a stream is shared with another application. When hba is enabled packets will be dropped +(i.e. not delivered to suricata) when the host-buffer utilization reaches the high-water mark indicated by the hba value. +This insures that, should suricata get behind in it's packet processing, the other application will still receive all +of the packets. If this is enabled without another application sharing the stream it will result in sub-optimal packet +buffering. + Basic Configuration -------------------