Subject: Re: packet capturing
To: Darren Reed <>
From: Perry E. Metzger <>
List: tech-kern
Date: 01/21/2004 13:35:22
Darren Reed <> writes:
> There is an ioctl - BIOCSBLEN - that applications can use to set the
> buffer size used for BPF.
> What needs changing is BPF_MAXBUFSIZE (sys/net/bpf.h) from 32k to some
> larger value - quite possibily even as high as 1Mb.  If an application
> tries to set a 1MB buffer and fails (kernel says "too big") then it
> should try again with a smaller size...
> Maybe it should be this that is sysctl'able if you're really desperate
> to add an interfaace to the BPF buffer size in sysctl.

At the very least, I think it is reasonable to have the max
sysctlable. It isn't good to have hard limits that can't be adjusted
without recompilation.