Subject: Re: Maximum buffer size in BPF
To: Bang Jun-Young <junyoung@netbsd.org>
From: Jonathan Stone <jonathan@DSG.Stanford.EDU>
List: tech-net
Date: 12/22/2002 14:52:59
I have used even larger values for research projects.  The biggest
caveat is: original bpf used to ping-pong its double buffers.  If you
never fill up a buffer, you'd never get data.

This tended to mean that (for long-running captures) you'd lose about
half of the effective buffersize, at the point when you quit.

I'd strongly suggest we pull in the larger buffer sizes after we pull
in fixes for this problem and other select()-related issues on bpf.