Re: buffering packets with libpcap 1.0.0

[Guy Harris <guy () alum mit edu>]

On Oct 23, 2009, at 5:09 PM, Virgil Mihailovici wrote:

> I have a couple of questions:
> 1. I am trying to change the size of the ring buffer allocated by  
> pcap, it
> seems that I have to use pcap_set_buffer_size to do that. The  
> question is,
> can I call this as a user,

You can have your application call it in between calling pcap_create()  
and pcap_activate().

> 2. In order to avoid copies, I am trying to "hold on" to the packets
> returned (not return them back to the ring). Is there any way to  
> accomplish
> this?

No.  The ring shares memory between kernel and userland, and it's not  
designed to allow an arbitrary amount of (wired-down) memory  
(consuming kernel address space) to exist.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.