> In some email I received from ragge@ludd.luth.se, sie wrote:
> > > 
> > > Does anyone know why using bpf/pcap would drop packets when running
> > > netbsd as opposed to freebsd ?
> > > 
> > Be sure that you have increased bpf_bufsize to some reasonable value, 
> > instead of the default. I have no problem capturing data at 1Gbit
> > speed using an 1MB buffer.
> 
> Which card/driver is this with ?  And what sort of PC ?
> 
> We're using a 2.4GHz P4, 256MB RAM, RDRAM, etc.
> 
I use Intel PRO/1000 (wm driver) on a Dell 2650 /w 2GHz CPU,
512MB PC2100 ram :-)

> Are you storing to disk or just capturing to RAM buffers and then
> throwing away ?
> (We're also saving to disk.)
> 
I'm storing data.  I noticed that I may loose packets when saving
to disk (when it comes to higher speeds) so I started sending the
tcpdump output to another machine for storing; e.g.

# tcpdump -ni wm0 -w - | ttcp -t 10.2

> Oh, there is one other angle I should mention:
> 
> * the application is threaded, one thread uses select over all the
>   NICs so it knows when to read data from BPF, the other writes to
>   disk.
> 
I've only used tcpdump, but make sure that your application reads in 
everything that is in the buffer each time that thread is scheduled.

-- Ragge