Re: Buffer size question

[Guy Harris <guy () alum mit edu>]

Gianluca Varenni wrote:

> ...like pcap_setbuff(), as implemented in WinPcap...

...and which I already know about.

Unfortunately, given that, on systems with BPF, you cannot change the 
buffer size after a BPF device has been bound to a network interface, 
"pcap_setbuff()" is unimplementable on those systems, so it's not a 
candidate for libpcap.

Some mechanism to supply that information at open time, whether it's an 
additional argument (which I think is the right long-term answer), a 
change to libpcap so that it doesn't reduce the buffer size below the 
default (which libpcap 0.8 already does), or an environment-variable 
based mechanism (which is probably an OK short-term answer, if just 
boosting the default isn't acceptable - a very large default runs the 
risk of running out of kernel address space, which I've managed to do on 
at least one OS using BPF; that caused a network configuration daemon 
not to be able to work, which left my machine unusable).
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.