Re: libpcap

[Petri Helenius]

Richard A Steenbergen wrote:

On Fri, Dec 13, 2002 at 12:25:42PM +0200, Petri Helenius wrote:

Suggestions what would it take to make libpcap included in the FreeBSD distribution
stop tweaking BPF buffer size by default?

tcpdump.org people have been nonresponsive about changing it there, so I would suggest
it should be patched in FreeBSD to allow applications to control buffer size.

Sure, fix the code starting at src/contrib/libpcap/pcap-bpf.c:236, which
even says (complete with outdated assumption that 32768 is big):

That's what we have done, the problem is that every time the source tree is brought
up to RELENG_4_7 or RELENG_4 the change needs to be reapplied, so
that's why the appeal to fix it at the source.

/*
* Try finding a good size for the buffer; 32768 may be too
* big, so keep cutting it in half until we find a size
* that works, or run out of sizes to try.
*
* XXX - there should be a user-accessible hook to set the
* initial buffer size.
*/

The problem is, you can't add it as a parameter to any of the existing
functions without royally breaking existing code. You could add another
function for setting it, but that would still produce freebsd specific
code. You could just remove that code completely, and let the sysctl
specified default take over, but where one libpcap application might have
use for a 1MB buffer another might be wasting it completely.

I think the libpcap code should not touch a parameter:
- which has a system settable default
- which is accessible to an application

Specifically since it cannot be set either before or after the pcap stuff initialized.

But changing stuff like this in FreeBSD pretty much defeats the purpose of
having a portable lib. I'd suggest either clubbing them over the head with
the need to fix it, modifying your local copy to suit your needs, or
better yet (since you obviously don't mind a fbsd specific hack) just use
bpf yourself (and you get bpf write functionality too :P).

If I do move somewhere, moving away from bpf (and libpcap) would only improve
performance. It's more work but eventually a must.

Pete

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message