From owner-freebsd-net@FreeBSD.ORG Thu Sep 18 15:31:59 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A42BF16A4BF; Thu, 18 Sep 2003 15:31:59 -0700 (PDT) Received: from silver.he.iki.fi (helenius.fi [193.64.42.241]) by mx1.FreeBSD.org (Postfix) with ESMTP id BEA7043F75; Thu, 18 Sep 2003 15:31:57 -0700 (PDT) (envelope-from pete@he.iki.fi) Received: from he.iki.fi (h81.vuokselantie10.fi [193.64.42.129]) by silver.he.iki.fi (8.12.9/8.11.4) with ESMTP id h8IMVuSq039558; Fri, 19 Sep 2003 01:31:56 +0300 (EEST) (envelope-from pete@he.iki.fi) Message-ID: <3F6A3259.5060409@he.iki.fi> Date: Fri, 19 Sep 2003 01:31:53 +0300 From: Petri Helenius User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20030916 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Don Bowman References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: fenner@freebsd.org cc: Josh Brooks cc: freebsd-net@freebsd.org Subject: Re: I would like to tcpdump and get all the packets... X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Sep 2003 22:31:59 -0000 Don Bowman wrote: >I found that increasing the bpf buffer size in libpcap >to 256K from the default of 4K made a tremendous difference. > > We generally use sizes from 512k to 8M depending on network interface and hardware configuration. Used to do larger but run into some issues with KVM allocations if the machine had been running for a while before bpf fired up. However, until the libpcap is updated, I need to maintain local patch to have the sysctl actually work instead of the library forcing 32k on me. So a fresh import would be greatly appreciated. Pete