Subject: Re: packet capturing
To: Darren Reed <email@example.com>
From: Jonathan Stone <jonathan@DSG.Stanford.EDU>
Date: 01/21/2004 11:49:04
In message <Pine.NEB.firstname.lastname@example.org>Darren Reed write
>On Tue, 20 Jan 2004, Perry E. Metzger wrote:
>> Jonathan Stone <jonathan@DSG.Stanford.EDU> writes:
>> > We could make bpf_bufsize sysctl'able; or raise the default to
>> > something that reduces bpf drop at high packet rate (somewhere between
>> > 128 and 512k); or both.
>> > Which of these would you support?
>> Both. The default probably should be jacked up only on larger memory
>> machines though (which is an easy calculation during boot...)
>None of this really needs doing.
Well, sure, except _most_ applications don't use bpf directly; they
use libpcap. And (last I looked) libpcap doesnt have an API for
controlling the underlying capture-buffer size.
If we want to change that, I think we'd have to change our libpcap and
the tcpdump.org version, and wait for third-party apps to catch up.