Hi, My name is Chema González and I'm working on pcapd, a libpcap multiplexer daemon.
I'm a little puzzled by the fact that the implementation of libpcap over BPF hardcodes 32KB kernel buffers. pcap_open_live() currently sets the kernel (and user-level) buffers to 32KB (or 16KB, 8KB, 4KB, until something works), and just immediately avoids the user modifying it by BIOCSETIF'ing. So my question is whether there is any reason for not exporting the kernel buffer size to the libpcap user (apart from the fact that this may be a feature unsupported by other packet filters), or to not permitting him setting its own. As an potential solution, libpcap could read the default kernel BPF buffer size from the kernel state, and start setting the buffer size to that number instead of 32KB. In any case, is there any reason for 32KB? Seems kinda small to me. (While it's true that they still go with default 4KB buffers, modern FreeBSD OSs come with a maximum of 512KB.) Thanks in advance for your help. -Chema - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
