Subject: Re: packet capturing
To: Darren Reed <email@example.com>
From: Perry E. Metzger <firstname.lastname@example.org>
Date: 01/21/2004 13:35:22
Darren Reed <email@example.com> writes:
> There is an ioctl - BIOCSBLEN - that applications can use to set the
> buffer size used for BPF.
> What needs changing is BPF_MAXBUFSIZE (sys/net/bpf.h) from 32k to some
> larger value - quite possibily even as high as 1Mb. If an application
> tries to set a 1MB buffer and fails (kernel says "too big") then it
> should try again with a smaller size...
> Maybe it should be this that is sysctl'able if you're really desperate
> to add an interfaace to the BPF buffer size in sysctl.
At the very least, I think it is reasonable to have the max
sysctlable. It isn't good to have hard limits that can't be adjusted