I committed changes to libpcap's pcap-bpf.c to probe for, and use,
much larger in-kernel buffer sizes.  Here's a trivial diff (trivial as
in, no dynamic sizing, no sysctl support) to sys/net/bpf.c.  The
default BPF_BUFSIZE of 8k is arguable; I suggest we make it at least
9k, to support ATM and Ethernet jumbo frames. (not included below).

I'm hoping Andrew Brown (or someone else conversant with new-sysctl)
will add the sysctl hooks, as I can barely even read the new sysctl API.

Do we really support machines where using 256k or 512k for bpf
capture will be fatal?

Index: bpf.c
===================================================================
RCS file: /cvsroot/src/sys/net/bpf.c,v
retrieving revision 1.86
diff -u -r1.86 bpf.c
--- bpf.c	2003/09/22 13:00:01	1.86
+++ bpf.c	2004/01/20 23:39:43
@@ -86,9 +86,12 @@
 #define PRINET  26			/* interruptible */
 
 /*
- * The default read buffer size is patchable.
+ * The default read buffer size, and limit for BIOCSBLEN, is patchable.
+ * XXX both should be made sysctl'able, and the defaults computed
+ * dynamically based on available memory size and available mbuf clusters.
  */
 int bpf_bufsize = BPF_BUFSIZE;
+int bpf_maxbufsize = 1024*1024;
 
 /*
  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
@@ -662,8 +665,8 @@
 		else {
 			u_int size = *(u_int *)addr;
 
-			if (size > BPF_MAXBUFSIZE)
-				*(u_int *)addr = size = BPF_MAXBUFSIZE;
+			if (size > bpf_maxbufsize)
+				*(u_int *)addr = size = bpf_maxbufsize;
 			else if (size < BPF_MINBUFSIZE)
 				*(u_int *)addr = size = BPF_MINBUFSIZE;
 			d->bd_bufsize = size;