Subject: Re: packet capturing
To: Jonathan Stone <jonathan@DSG.Stanford.EDU>
From: Steven M. Bellovin <smb@research.att.com>
List: tech-kern
Date: 01/20/2004 18:22:42
In message <200401202308.PAA05520@Pescadero.DSG.Stanford.EDU>, Jonathan Stone w
rites:
>In message <87znciqm2r.fsf@snark.piermont.com>"Perry E. Metzger" writes
>>
>>Jonathan Stone <jonathan@DSG.Stanford.EDU> writes:
>>> We could make bpf_bufsize sysctl'able; or raise the default to
>>> something that reduces bpf drop at high packet rate (somewhere between
>>> 128 and 512k); or both.
>>>
>>> Which of these would you support?
>>
>>Both. The default probably should be jacked up only on larger memory
>>machines though (which is an easy calculation during boot...)
>
>there's no hook to set it during boot, and "large" is possibly MD, and
>definitely a question of taste.
There are a lot of things that really need to be memory size-dependent
but don't seem to be, such as proper tuning of the vm sysctls.
--Steve Bellovin, http://www.research.att.com/~smb