# Bro 2.5 appears to be ignoring redefs of Pcap::snaplen **URL:** \ **Category:** Zeek\ **Created:** [June 21, 2017, 3:29pm UTC](https://community.zeek.org/t/bro-2-5-appears-to-be-ignoring-redefs-of-pcap-snaplen/4913 "2017-06-21T15:29:18Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Kevin\_Branch](https://avatars.discourse-cdn.com/v4/letter/k/d26b3c/32.png) [@Kevin\_Branch](https://community.zeek.org/u/Kevin_Branch)\ **Post date:** [June 21, 2017, 3:29pm UTC](https://community.zeek.org/t/bro-2-5-appears-to-be-ignoring-redefs-of-pcap-snaplen/4913/1 "2017-06-21T15:29:18Z")
For a long time I have used “redef Pcap::snaplen = 1600;” in local.bro to make Bro drop its default snaplen from 8192 to 1600. This is helpful for conserving memory when using Bro in conjunction with PF\_RING and a high number of ring slots. Today I just noticed that while Bro does not complain about “redef Pcap::snaplen = 1600;” when I run a “broctl check”, that Bro appears to be ignoring the redef. All my Bro instances are actually using a snaplen of 8192. I use Bro on the latest Security Onion Ubuntu 14.04 platform, and have observed this problem with both PF\_RING 6.4.1 (SO stable) and PF\_RING 6.6.0 (SO test). The “Bucket Len” in the below PF\_RING status file corresponds to the snaplen of the app that allocated the ring. > [root@nsm.xyz.org](mailto:root@nsm.xyz.org):~# cat /proc/net/pf\_ring/15028-dmz.9 > Bound Device(s) : dmz > Active : 1 > Breed : Standard > Appl. Name : bro-dmz > Socket Mode : RX+TX > Capture Direction : RX+TX > Sampling Rate : 1 > IP Defragment : No > BPF Filtering : Enabled > Sw Filt Hash Rules : 0 > Sw Filt WC Rules : 0 > Hw Filt Rules : 0 > Sw Filt Hash Match : 0 > Sw Filt Hash Miss : 0 > Poll Pkt Watermark : 1 > Num Poll Calls : 345386919 > Channel Id Mask : 0xFFFFFFFFFFFFFFFF > Cluster Id : 21 > Slot Version : 16 [6.4.1] > Min Num Slots : 128000 > Bucket Len : 8192 > Slot Len : 8248 [bucket+header] > Tot Memory : 1055756288 > Tot Packets : 1966471960 > Tot Pkt Lost : 3 > Tot Insert : 1966471957 > Tot Read : 1966471957 > Insert Offset : 809944608 > Remove Offset : 809944608 > Num Free Slots : 128000 > TX: Send Ok : 0 > TX: Send Errors : 0 > Reflect: Fwd Ok : 0 > Reflect: Fwd Errors: 0 Please advise me about how to successfully change the snaplen used by Bro 2.5 at this time, Can anyone reproduce this problem? I don’t know if this issue applies across the board or only comes up with PF\_RING. Let me know if there is anything I can do to help test this issue. Thanks! Kevin ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [June 22, 2017, 7:47pm UTC](https://community.zeek.org/t/bro-2-5-appears-to-be-ignoring-redefs-of-pcap-snaplen/4913/2 "2017-06-22T19:47:54Z")
Are you using pf\_ring through libpcap, or are you using the pf-ring plugin? In case you are using it through libpcap - Bro just calls pcap\_set\_snaplen; if it does not work anymore it is probably that this is an issue with PF\_RING or the pfring libpcap. Johanna ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [June 23, 2017, 4:59am UTC](https://community.zeek.org/t/bro-2-5-appears-to-be-ignoring-redefs-of-pcap-snaplen/4913/3 "2017-06-23T04:59:52Z")
You might want to try setting this value in your etc/broctl.cfg file: pcapsnaplen=1600 ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/bro-2-5-appears-to-be-ignoring-redefs-of-pcap-snaplen/4913/4 "2022-05-06T15:45:04Z")