Date: Sat, 21 Sep 2002 07:52:45 -0400 From: Richard A Steenbergen <ras@e-gerbil.net> To: Petri Helenius <pete@he.iki.fi> Cc: freebsd-net@freebsd.org Subject: Re: pcap & bpf Message-ID: <20020921115245.GA1123@overlord.e-gerbil.net> In-Reply-To: <3D8C35E2.803199B3@he.iki.fi> References: <3D8C35E2.803199B3@he.iki.fi>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Sep 21, 2002 at 12:03:30PM +0300, Petri Helenius wrote:
> (I'm sending a copy here since I'm running this on FreeBSD and got
> no reply so far from the tcpdump folks)
>
> Function pcap_open_live in pcap-bpf.c contains the code snippet below.
>
> To me, this does not make too much sense, because:
> - if v is too big to be accommodated (either by configuration or
> resources, BIOCSBLEN will fail. However the code ignores the return
> code
Read the comments and the rest of the code in the section you pasted.
/*
* Try finding a good size for the buffer; 32768 may be too
* big, so keep cutting it in half until we find a size
* that works, or run out of sizes to try.
*
* XXX - there should be a user-accessible hook to set the
* initial buffer size.
*/
It couldn't get any blunter if they used a hammer. :)
> - it then proceeds to BIOCSETIF which will succeed either with the
> bufsize of 32768 or whatever is default in the OS.
>
> Suggestions:
> - Do not touch the buffer size (at least without giving the option
> to specify the size)
debug.bpf_bufsize: 4096
debug.bpf_maxbufsize: 524288
32k is already a bump up from the default of 4k, which at the time that
was set (and hard coded) probably seemed "good enough". Obviously as
interfaces have gotten faster, that number has become out of date. Yes
they SHOULD make it pcap-user tunable, the comment even says so, but until
they do... Well it should be really really simple to add a hook for
changing it, if you wanted to try submitting it to the pcap folks. :)
--
Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras
PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020921115245.GA1123>