rupesh gautam wrote:
why changing buffer size is unimplementable on systems with bpf.
It's not *completely* unimplementable.
It can, however, not be done after the BPF device has been bound to a
network interface, which means that it cannot be done after
pcap_open_live().
I don't know why the
Guy Harris writes:
Unfortunately, given that, on systems with BPF, you cannot change the
buffer size after a BPF device has been bound to a network interface,
pcap_setbuff() is unimplementable on those systems, so it's not a
candidate for libpcap.
I didn't realize it was possible to set the
On Oct 18, 2004, at 3:04 PM, Alexander Dupuy wrote:
Guy Harris writes:
Unfortunately, given that, on systems with BPF, you cannot change the
buffer size after a BPF device has been bound to a network interface,
pcap_setbuff() is unimplementable on those systems, so it's not a
candidate for
On Mon, Oct 18, 2004 at 04:37:41PM -0700, Guy Harris wrote:
Including such an argument at the time the new API is introduced
obviously doesn't introduce compatibility issues for that API. :-)
(I'm actually thinking of an attribute/value list for various open
options in the API, so that
shouldn't we have upper/lower boundary checks for
such a buffer ?
i.e. minbuffer 1.5K
maxbuffer 128K
So would you propose just returning an error from pcap_open_live
if the obtained buffer size is less than minbuffer?
Something like
if PCAP_MAXBUFFER environment var is set and 0,
- Original Message -
From: Guy Harris [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, October 14, 2004 1:45 AM
Subject: Re: [tcpdump-workers] Buffer size question
Ed Maste wrote:
1) Add a new pcap API function pcap_set_bufsize that can be used
to set the size used
...like pcap_setbuff(), as implemented in WinPcap...
...and which I already know about.
...and also, which I mentioned in my original email:
Basically provide the same functionality as pcap_setbuff
from winpcap, but it has to be called before opening the bpf dev.
or an
(I just subscribed to the list so don't have the original
message to reply to.) I have some more comments on the recent
thread about the pcap buffer size code in pcap-bpf.c.
The code to try smaller and smaller buffer sizes until a valid size
is found has the following comment:
/*
