Date: Fri, 19 Sep 2003 01:31:53 +0300 From: Petri Helenius <pete@he.iki.fi> To: Don Bowman <don@sandvine.com> Cc: freebsd-net@freebsd.org Subject: Re: I would like to tcpdump and get all the packets... Message-ID: <3F6A3259.5060409@he.iki.fi> In-Reply-To: <FE045D4D9F7AED4CBFF1B3B813C85337035E37AB@mail.sandvine.com> References: <FE045D4D9F7AED4CBFF1B3B813C85337035E37AB@mail.sandvine.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Don Bowman wrote: >I found that increasing the bpf buffer size in libpcap >to 256K from the default of 4K made a tremendous difference. > > We generally use sizes from 512k to 8M depending on network interface and hardware configuration. Used to do larger but run into some issues with KVM allocations if the machine had been running for a while before bpf fired up. However, until the libpcap is updated, I need to maintain local patch to have the sysctl actually work instead of the library forcing 32k on me. So a fresh import would be greatly appreciated. Pete
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3F6A3259.5060409>