Subject: Re: packet capturing
To: Jonathan Stone <jonathan@DSG.Stanford.EDU>
From: Steven M. Bellovin <>
List: tech-kern
Date: 01/20/2004 18:22:42
In message <200401202308.PAA05520@Pescadero.DSG.Stanford.EDU>, Jonathan Stone w
>In message <>"Perry E. Metzger" writes
>>Jonathan Stone <jonathan@DSG.Stanford.EDU> writes:
>>> We could make bpf_bufsize sysctl'able; or raise the default to
>>> something that reduces bpf drop at high packet rate (somewhere between
>>> 128 and 512k); or both.
>>> Which of these would you support?
>>Both. The default probably should be jacked up only on larger memory
>>machines though (which is an easy calculation during boot...)
>there's no hook to set it during boot, and "large" is possibly MD, and
>definitely a question of taste.

There are a lot of things that really need to be memory size-dependent 
but don't seem to be, such as proper tuning of the vm sysctls.

		--Steve Bellovin,