Darren Reed <darrenr@mail.netbsd.org> writes:
> There is an ioctl - BIOCSBLEN - that applications can use to set the
> buffer size used for BPF.
>
> What needs changing is BPF_MAXBUFSIZE (sys/net/bpf.h) from 32k to some
> larger value - quite possibily even as high as 1Mb.  If an application
> tries to set a 1MB buffer and fails (kernel says "too big") then it
> should try again with a smaller size...
>
> Maybe it should be this that is sysctl'able if you're really desperate
> to add an interfaace to the BPF buffer size in sysctl.

At the very least, I think it is reasonable to have the max
sysctlable. It isn't good to have hard limits that can't be adjusted
without recompilation.

Perry