Date: Mon, 22 May 2000 20:19:00 -0700 From: Jan Koum <jkb@ethereal.net> To: Christopher Nielsen <cnielsen@pobox.com> Cc: Graham Wheeler <gram@cequrux.com>, Dmitry Samersoff <dms@wplus.net>, freebsd-hackers@FreeBSD.ORG, freebsd-net@FreeBSD.ORG Subject: Re: [net] bpf question Message-ID: <20000522201900.A39617@ethereal.net> In-Reply-To: <Pine.BSF.4.21.0005221611020.5955-100000@cassandra.wayward-volvo.org>; from cnielsen@pobox.com on Mon, May 22, 2000 at 04:16:56PM -0700 References: <39292998.4C55739A@cequrux.com> <Pine.BSF.4.21.0005221611020.5955-100000@cassandra.wayward-volvo.org>
next in thread | previous in thread | raw e-mail | index | archive | help
i think the buffer is 32K (from BPF_MAXBUFSIZE in bpf.h) and you should be able to bump it up a bit on your box if you wish. it might help. also, maybe we should consider upping the default buffer size in our tree? On Mon, May 22, 2000 at 04:16:56PM -0700, Christopher Nielsen <cnielsen@pobox.com> wrote: > On Mon, 22 May 2000, Graham Wheeler wrote: > > > If my memory serves me correctly, Marcus Ranum wrote a white paper on > > IDS systems in the early days of NFR, in which he said that the existing > > configuration of BPF was inadequate for capturing all packets on a fast > > link, and suggested a patch to improve the situation. THe patch involved > > bumping up a buffer from about 16kb to 256kb. Unfortunately I no longer > > have the details handy, but if you did a search for BPF/IDS/NFR/Ranum > > you might find something. > > http://www.nfr.net/forum/publications/LISA-97.htm > > -- > Christopher Nielsen > (enkhyl|cnielsen)@pobox.com > Enkhyl on IRC > Space monekys ate my brain: No such file or directory > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000522201900.A39617>