> * libpcap-2004-something is being used with pcap_setbuff to set the BPF
>   buffer to 1MB

At least in the tcpdump.org libpcap, the only platform that has 
"pcap_setbuff()" is Win32; the problem with "pcap_setbuff()" and BPF is 
that BIOCSBLEN only works on a BPF device not bound to an interface, 
and once you've done "pcap_open_live()" the device is bound to an 
interface so you can't set the buffer size.

Do you mean you have a version of libpcap that sets the minimum initial 
buffer size to 1MB rather than 32K?