>We can change our bpf buffersize with sysctl?

Not in a stock 1.6ZF system, no; seems I never checked that in.
But see my subsequent message.

FreeBSD 4.x has debug.bpf_bufsize, which controls the default buffer
size; and debug.bpf_maxbufsize, which is the limit for BIOCSBLEN.
Other than nestling under `debug' those seem reasonable to me.

Also, libpcap's bpf backend (pcap-bpf.c) does a binary search to find
the effective maximum bpf buffer size. I've occasionally increased
libpcap's PCAP_BPF_MAX_BUFSIZ as high as 4 Mbytes.

Any comments, pro or con, on that?