>This sounds good, especially if sysctl'able.

This doesn't have sysctl knobs or dynamic sizing, but does have
everything else.  Maybe someone else can add those?

Index: bpf.c
===================================================================
RCS file: /cvsroot/src/sys/net/bpf.c,v
retrieving revision 1.86
diff -u -r1.86 bpf.c
--- bpf.c	2003/09/22 13:00:01	1.86
+++ bpf.c	2004/01/21 01:09:25
@@ -80,15 +80,22 @@
 #endif
 
 #ifndef BPF_BUFSIZE
-# define BPF_BUFSIZE 8192		/* 4096 too small for FDDI frames */
+/*
+ * 4096 is too small for FDDI frames. 8192 is too small for gigabit Ethernet
+ * jumbos (circa 9k), ATM, or Intel 1gig/10gig ethernet jumbos (16k).
+ */
+# define BPF_BUFSIZE 32768
 #endif
 
 #define PRINET  26			/* interruptible */
 
 /*
- * The default read buffer size is patchable.
+ * The default read buffer size, and limit for BIOCSBLEN, is patchable.
+ * XXX both should be made sysctl'able, and the defaults computed
+ * dynamically based on available memory size and available mbuf clusters.
  */
 int bpf_bufsize = BPF_BUFSIZE;
+int bpf_maxbufsize = (256 * 1024)	/* XXX should be set dynamically */
 
 /*
  *  bpf_iflist is the list of interfaces; each corresponds to an ifnet
@@ -662,8 +669,8 @@
 		else {
 			u_int size = *(u_int *)addr;
 
-			if (size > BPF_MAXBUFSIZE)
-				*(u_int *)addr = size = BPF_MAXBUFSIZE;
+			if (size > bpf_maxbufsize)
+				*(u_int *)addr = size = bpf_maxbufsize;
 			else if (size < BPF_MINBUFSIZE)
 				*(u_int *)addr = size = BPF_MINBUFSIZE;
 			d->bd_bufsize = size;