From owner-freebsd-net Mon May 22 20:19:31 2000 Delivered-To: freebsd-net@freebsd.org Received: from camel.ethereal.net (camel.ethereal.net [216.200.22.209]) by hub.freebsd.org (Postfix) with ESMTP id 1725037B53C; Mon, 22 May 2000 20:19:26 -0700 (PDT) (envelope-from jkb@camel.ethereal.net) Received: (from jkb@localhost) by camel.ethereal.net (8.10.0.Beta10/8.10.0.Beta10) id e4N3J0940092; Mon, 22 May 2000 20:19:00 -0700 (PDT) Date: Mon, 22 May 2000 20:19:00 -0700 From: Jan Koum To: Christopher Nielsen Cc: Graham Wheeler , Dmitry Samersoff , freebsd-hackers@FreeBSD.ORG, freebsd-net@FreeBSD.ORG Subject: Re: [net] bpf question Message-ID: <20000522201900.A39617@ethereal.net> References: <39292998.4C55739A@cequrux.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.3.1i In-Reply-To: ; from cnielsen@pobox.com on Mon, May 22, 2000 at 04:16:56PM -0700 X-Operating-System: FreeBSD camel.ethereal.net 3.4-RELEASE FreeBSD 3.4-RELEASE X-Unix-Uptime: 8:11PM up 17 days, 6:48, 30 users, load averages: 1.15, 1.17, 1.16 Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org i think the buffer is 32K (from BPF_MAXBUFSIZE in bpf.h) and you should be able to bump it up a bit on your box if you wish. it might help. also, maybe we should consider upping the default buffer size in our tree? On Mon, May 22, 2000 at 04:16:56PM -0700, Christopher Nielsen wrote: > On Mon, 22 May 2000, Graham Wheeler wrote: > > > If my memory serves me correctly, Marcus Ranum wrote a white paper on > > IDS systems in the early days of NFR, in which he said that the existing > > configuration of BPF was inadequate for capturing all packets on a fast > > link, and suggested a patch to improve the situation. THe patch involved > > bumping up a buffer from about 16kb to 256kb. Unfortunately I no longer > > have the details handy, but if you did a search for BPF/IDS/NFR/Ranum > > you might find something. > > http://www.nfr.net/forum/publications/LISA-97.htm > > -- > Christopher Nielsen > (enkhyl|cnielsen)@pobox.com > Enkhyl on IRC > Space monekys ate my brain: No such file or directory > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message