R: [tcpdump-workers] Re: Re: [Ethereal-dev] Re: Fwd: kyxtech: freebsd outsniffed by wintendo !!?!?

[Loris Degioanni]

> On 2000-12-08 00:38 -0800, Guy Harris <[EMAIL PROTECTED]> wrote:
> > (Both FreeBSD and OpenBSD have the maximum buffer size for BPF as
512KB
> > in the top of the CVS tree; NetBSD still has it as 32K.)
>
> You can change both the default and maximum BPF buffer sizes at
> run time (affecting an subsequent open()) in FreeBSD:
>
> # sysctl -w debug.bpf_bufsize=32768 debug.bpf_maxbufsize=4194304
>
> makes the default buffer size 32K and limits the size to 4MB, for
> example.

Notice however that in pcap-bpf.c, pcap_open_live()  forces the buffer
size to 32K through an IOCTL. This means that the sysctl is overridden
if BPF is used throug libpcap.

Loris.






-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe