anchor.diff:    snaplen: 2500
   ------------------------------------------------------------------------------
   
  -==== Type
  +===== type
   
   Packetbeat supports three sniffer types:
   
  - * **pcap** which uses the libpcap library and works on most platforms, but
  + * `pcap` which uses the libpcap library and works on most platforms, but
      it's not the fastest option.
  - * **af_paket** which uses memory mapped sniffing. It is faster than libpcap
  + * `af_paket` which uses memory mapped sniffing. It is faster than libpcap
      and doesn't require a kernel module, but it's Linux specific.
  - * **pf_ring** which makes use of an ntop.org
  + * `pf_ring` which makes use of an ntop.org
      http://www.ntop.org/products/pf_ring/[project]. This will get you the best
      sniffing speed but requires a kernel module and is Linux specific.
   
  -The default sniffer is `pcap`. To switch between the sniffer types, add a line
  -to the `interfaces` section:
  +The default sniffer is `pcap`. Here is an example configuration that switches
  +to the `af_packet` sniffing type:
   
   [source,yaml]
   ------------------------------------------------------------------------------
  
positive.code:  - Agent2: t1
   - Agent3: t2
  
  ==== Refresh topology freq
  
  The `refresh_topology_freq` settings controls the refreshing interval of the
  topology map in seconds. In other words, how often each agent publishes its IP
  addresses to the topology map. The default is 10 seconds.
  
  ==== Topology expire
  
  The `topology_expire` setting controls the expiration time for the topology in
  seconds. This is useful in case an agent stops publishing its IP addresses.
  The IP addresses are removed automatically from the topology map after
  expiration. The default is 15 seconds.
  
  
  [[configuration-interfaces]]
  === Interfaces
  
  ////
  TODO: add a sample configuration of the whole section.
  ////
  
  ==== Device
  
  Configures the network devices from which the traffic is
  captured. The configured device is set automatically in promiscuous mode,
  
negative.code: http://packetbeat.com/blog/sniffing-performance-and-ipv6.html[blog post]
  for some details.
  
  If you use the `af_packet` sniffer, you can tune its behaviour with the
  following options:
  
  ===== buffer_size_mb
  
  This option controls the maximum size of the shared memory buffer to use
  between the kernel and user space. A bigger buffer usually results in lower CPU
  usage, but consumes more memory. This setting is only available for the
  `af_packet` sniffer type. The default is 30 MB.
  