Subject: Re: packet capturing
To: Jonathan Stone <jonathan@DSG.Stanford.EDU>
From: Steven M. Bellovin <firstname.lastname@example.org>
Date: 01/20/2004 18:22:42
In message <200401202308.PAA05520@Pescadero.DSG.Stanford.EDU>, Jonathan Stone w
>In message <email@example.com>"Perry E. Metzger" writes
>>Jonathan Stone <jonathan@DSG.Stanford.EDU> writes:
>>> We could make bpf_bufsize sysctl'able; or raise the default to
>>> something that reduces bpf drop at high packet rate (somewhere between
>>> 128 and 512k); or both.
>>> Which of these would you support?
>>Both. The default probably should be jacked up only on larger memory
>>machines though (which is an easy calculation during boot...)
>there's no hook to set it during boot, and "large" is possibly MD, and
>definitely a question of taste.
There are a lot of things that really need to be memory size-dependent
but don't seem to be, such as proper tuning of the vm sysctls.
--Steve Bellovin, http://www.research.att.com/~smb