From owner-freebsd-hackers  Mon Dec 11  3: 4:53 2000
From owner-freebsd-hackers@FreeBSD.ORG  Mon Dec 11 03:04:47 2000
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from fep09-svc.tin.it (mta09-acc.tin.it [212.216.176.40])
	by hub.freebsd.org (Postfix) with ESMTP
	id EC74937B69D; Mon, 11 Dec 2000 03:03:58 -0800 (PST)
Received: from lorix ([213.45.186.90]) by fep09-svc.tin.it
          (InterMail vM.4.01.02.27 201-229-119-110) with SMTP
          id <20001211095457.XMRP13287.fep09-svc.tin.it@lorix>;
          Mon, 11 Dec 2000 10:54:57 +0100
Message-ID: <004001c06358$37cc9480$016464c8@lorix>
From: "Loris Degioanni" <loris@netgroup-serv.polito.it>
To: "Stefan Esser" <se@FreeBSD.org>,
	"Guy Harris" <gharris@flashcom.net>
Cc: "Matt Dillon" <dillon@earth.backplane.com>,
	"Dragos Ruiu" <dr@kyx.net>, <tcpdump-workers@tcpdump.org>,
	<ethereal-dev@ethereal.com>, <snort-devel@lists.sourceforge.net>,
	<freebsd-hackers@FreeBSD.org>, <tech@openbsd.org>,
	"Stefan Esser" <se@FreeBSD.org>
References: <0012072118150Q.09615@smp.kyx.net> <200012080547.eB85lKc17216@earth.backplane.com> <20001207233958.C352@quadrajet.flashcom.com> <20001208003839.A352@quadrajet.flashcom.com> <20001209142132.A822@StefanEsser.FreeBSD.org>
Subject: R: [tcpdump-workers] Re: Re: [Ethereal-dev] Re: Fwd: kyxtech: freebsd outsniffed by wintendo !!?!?
Date: Mon, 11 Dec 2000 10:49:48 +0100
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2314.1300
X-MIMEOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

> On 2000-12-08 00:38 -0800, Guy Harris <gharris@flashcom.net> wrote:
> > (Both FreeBSD and OpenBSD have the maximum buffer size for BPF as
512KB
> > in the top of the CVS tree; NetBSD still has it as 32K.)
>
> You can change both the default and maximum BPF buffer sizes at
> run time (affecting an subsequent open()) in FreeBSD:
>
> # sysctl -w debug.bpf_bufsize=32768 debug.bpf_maxbufsize=4194304
>
> makes the default buffer size 32K and limits the size to 4MB, for
> example.

Notice however that in pcap-bpf.c, pcap_open_live()  forces the buffer
size to 32K through an IOCTL. This means that the sysctl is overridden
if BPF is used throug libpcap.

Loris.








To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message