In message <Pine.NEB.4.58.0401211734030.18750@mail.netbsd.org>Darren Reed write
s
>On Tue, 20 Jan 2004, Perry E. Metzger wrote:
>
>> Jonathan Stone <jonathan@DSG.Stanford.EDU> writes:
>> > We could make bpf_bufsize sysctl'able; or raise the default to
>> > something that reduces bpf drop at high packet rate (somewhere between
>> > 128 and 512k); or both.
>> >
>> > Which of these would you support?
>>
>> Both. The default probably should be jacked up only on larger memory
>> machines though (which is an easy calculation during boot...)
>
>None of this really needs doing.

Well, sure, except _most_ applications don't use bpf directly; they
use libpcap. And (last I looked) libpcap doesnt have an API for
controlling the underlying capture-buffer size.

If we want to change that, I think we'd have to change our libpcap and
the tcpdump.org version, and wait for third-party apps to catch up.