Subject: Re: packet capturing
To: Perry E. Metzger <firstname.lastname@example.org>
From: Jonathan Stone <jonathan@DSG.Stanford.EDU>
Date: 01/20/2004 11:28:10
>We can change our bpf buffersize with sysctl?
Not in a stock 1.6ZF system, no; seems I never checked that in.
But see my subsequent message.
FreeBSD 4.x has debug.bpf_bufsize, which controls the default buffer
size; and debug.bpf_maxbufsize, which is the limit for BIOCSBLEN.
Other than nestling under `debug' those seem reasonable to me.
Also, libpcap's bpf backend (pcap-bpf.c) does a binary search to find
the effective maximum bpf buffer size. I've occasionally increased
libpcap's PCAP_BPF_MAX_BUFSIZ as high as 4 Mbytes.
Any comments, pro or con, on that?