Re: Buffer size question

[Guy Harris <guy () alum mit edu>]

Ed Maste wrote:

> 1) Add a new pcap API function pcap_set_bufsize that can be used
> to set the size used for following pcap_open_live calls (by setting 
> a libpcap global variable).

The global variable is a bit ugly.  If you're going to have API changes...

> 2) Add a new function like pcap_open_live that adds a buffer size 
> argument.  http://www.tcpdump.org/lists/workers/2000/msg01358.html

...you might as well do that, as there are other reasons for a new API.

> 3) Use an environment variable (PCAP_BUFFER_MAX?) to set the 
> initial trial buffer size.  Existing applications could even use a 
> larger size without recompiling.
>
> 4) Do a BIOCGBLEN ioctl before trying the initial size.  If the 
> size returned is greater than the initial size, just avoid 
> BIOCSBLEN.  On FreeBSD I've got a sysctl debug.bpf_bufsize that 
> sets the default buffer size, but it has no effect for libpcap.  
> The disadvantage is that the same size gets used for all pcap 
> users, which might be undesirable.

One of those might also be useful.

In fact, libpcap 0.8[.x] already does 4).  Adding 3) might be useful to 
override the default for existing programs.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.