tcpdump mailing list archives
Re: what is the best value for PCAP_FRAMES?
From: Guy Harris <guy () alum mit edu>
Date: Wed, 1 Dec 2010 09:13:33 -0800
On Dec 1, 2010, at 1:19 AM, Jon Zhou wrote:
The bigger PCAP_FRAMES or a smaller value will get a better performance? I.e. PCAP_FRAMES=max tcpdump -I eth0 -w /dev/null Or PCAP_FRAMES=4096 tcpdump .....
As distributed by tcpdump.org, neither libpcap nor tcpdump pay any attention whatsoever to a PCAP_FRAMES environment variable, so, unless you're using a version of libpcap or tcpdump that somebody *else* modified to look at that environment variable, the value of PCAP_FRAMES will make no difference whatsoever to performance. If you *are* using a version that somebody else modified, you might have to ask them what effect it will have.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- what is the best value for PCAP_FRAMES? Jon Zhou (Dec 01)
- Re: what is the best value for PCAP_FRAMES? Guy Harris (Dec 01)