One of the best features I like in trisul is the ability to capture raw packets of the flows. The current box we have trisul running on has plenty of space to hold pcaps but current it seems to hold only the past 5-15 mins worth of flows (I have all default settings). Could you tell me how I could change this? Here is what I would like to do:

1) Change so that it keeps the past 1 hr worth of packets (up to the first 10 mb)

If that is not possible how about:

Capture all FTP traffic for the past 24 hrs (again just the first 10 mb)?

Thank you in advance! (Awesome product BTW)

Thanks for the kind words

Sorry you are having trouble posting a message with the Forum software. We use a 3rd party anti spam and it is being too aggressive.