On Thu, Aug 29, 2002 at 05:57:16PM -0500, Barclay, Nathan wrote: > I ran into a message from 2001 that seems to indicate that in FreeBSD 3.4, > BPF filter programs are limited to 512 bytes.
Actually, from looking at the kernel code on my FreeBSD 3.4 machine, it's 512 *instructions*; an instruction is 8 bytes long, so that's 4K bytes. > Can anyone tell me whether similar limits exist using BPF filtering > with Solaris and Irix and, if so, what the limits are? In both Solaris and Irix, BPF filtering is done in libpcap, not the kernel (neither the Solaris nor the Irix kernel have a BPF filter engine in the kernel); the user-mode BPF code in libpcap doesn't impose a hard limit on the program size. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
