Subject: Re: packet capturing
To: Steven M. Bellovin <firstname.lastname@example.org>
From: Jonathan Stone <jonathan@DSG.Stanford.EDU>
Date: 01/21/2004 15:44:01
For the record: I've commited changes to libpcap that will automatically
probe for, and use, bpf buffers up to 4 Mbytes without recompilation.
I've also increased the default limit for bpf BIOCSBLEN to 1 Mbyte,
and confirmed that libpcap uses a 1 Mbyte bpf buffer.
Luca Deri's paper doesn't explicitly say anything about BPF tuning,
from which I assume the numbers reported for FreeBSD (with or without
polling) are for the default 32k bpf buffersize. We all agrete that
repeated doubling of the bpf buffer size yields dramatic reductions in
loss rate, relative to the FreeBSD default buffersize of 32k.
If used with drivers (like Jason's wm driver) which do significant Rx
interrupt mitigiation, our bpf should now be strictly and *signficantly*
better than the data presented in Tables 4 and 6 Luca Deri's paper.