> If I run tcpdump on an interface and then stop it and leave it there for
> an hour or two, will this have an adverse effect on mbufs ?

no.

bpf does its own buffering and copies data out of mbufs at tap time;
it doesn't queue mbufs for the bpf reader process.

If the reader falls behind, packets get dropped (and a drop counter,
readable through the BIOCGSTATS ioctl, gets incremented).

					- Bill