On Dec 1, 2010, at 1:19 AM, Jon Zhou wrote: > The bigger PCAP_FRAMES or a smaller value will get a better performance? > > I.e. > > PCAP_FRAMES=max tcpdump -I eth0 -w /dev/null > > Or > > PCAP_FRAMES=4096 tcpdump .....
As distributed by tcpdump.org, neither libpcap nor tcpdump pay any attention whatsoever to a PCAP_FRAMES environment variable, so, unless you're using a version of libpcap or tcpdump that somebody *else* modified to look at that environment variable, the value of PCAP_FRAMES will make no difference whatsoever to performance. If you *are* using a version that somebody else modified, you might have to ask them what effect it will have.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
