When I start Snort using your great pf_ring enhancement I see the
following message:
Acquiring network traffic from "eth4:eth5".
Reload thread starting...
Reload thread started, thread 0x7f3885b41710 (7081)
Checking PID path...
PID path stat checked out ok, PID path set to /var/run/
Writing PID "7081" to file "/var/run//snort_eth4:eth5_bpbr1_1.pid"
WARNING: normalizations disabled because DAQ can't replace packets. <==
I'm just worried about this last line. Does it mean the traffic is
not normalized?