splunk for stream and pfring

[albertohontoria]

Hello friends

I normally use pf_ring packet capture acceleration for analyzing wire data. Is it recommended or supported for use with streamfwd packet capture?

regards

[mdickey_splunk · Accepted solution]

It is not currently used / supported. Our testing indicates it's unnecessary for traffic volumes less than about 5 Gbps (per network interface). However, it's one of the items in the backlog that we hope to explore more in the future.