You can set the BPF bufsize via sysctl:
sysctl -w debug.bpf_bufsize=whatever
See sysctl.conf(5) for more info about how to set this as part of the boot
process. See sysctl(8) for more info on sysctl.
On Thu, Jun 28, 2001 at 01:39:03PM +0100, Knapp, Ralf wrote:
> Dear Steve, Craig or Van
>
> I �m using NeTraMet Vers. 4.3 on an FreeBSD 4.2 System (i386)
> with libpcap-04.
>
>
> NeTraMet uses libpcap for monitoring and get the packets on the LAN.
>
> It could be that ethernet packets were dropped by the kernel and
> NeTraMet, which happens when i capture some minutes of the LAN traffic
> with tcpdump 3.5 .
> Tcpdump gives an information about how many packets were filtered and
> how many packet were dropped by the kernel.
> NeTraMet doesn�t do this.
> How could i be on the secure site, that NeTraMet get all packets.
> If NeTraMet droppes the packets like tcpdump what can I do.
>
> In the newsforum from NeTraMet someone says to boost the bpf buffer but
> he didn�t know how.
> (the counter it is referring to in /sys/net/bpf.c in the kernel.)
> seems to be
> # define BPF_BUFSIZE 4096
> so i have to increase this.
> And there for I have to recompile the c-source code, but which of the
> source and how.
>
>
> Could you help me or give some hints??
> libpcap uses this code too, or???
> Does libpcap reports if it dropps some packets??
>
>
> Thanks in advice
>
> Ralf Knapp
>
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
--
Jon Dugan | Senior Network Engineer, NCSA Network Development
[EMAIL PROTECTED] | 57C CAB, 605 E Springfield, Champaign, IL 61820
217/244-7715 | http://www.ncsa.uiuc.edu/people/jdugan
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
