From owner-freebsd-net@FreeBSD.ORG  Thu Sep 18 15:28:37 2003
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 91E4116A4B3; Thu, 18 Sep 2003 15:28:37 -0700 (PDT)
Received: from mail.sandvine.com (sandvine.com [199.243.201.138])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 4EDD143F75; Thu, 18 Sep 2003 15:28:36 -0700 (PDT)
	(envelope-from don@sandvine.com)
Received: by mail.sandvine.com with Internet Mail Service (5.5.2653.19)
	id <SZM8F576>; Thu, 18 Sep 2003 18:28:34 -0400
Message-ID: <FE045D4D9F7AED4CBFF1B3B813C85337035E37AB@mail.sandvine.com>
From: Don Bowman <don@sandvine.com>
To: 'Petri Helenius' <pete@he.iki.fi>, Bruce M Simpson <bms@spc.org>
Date: Thu, 18 Sep 2003 18:28:28 -0400
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
cc: freebsd-net@freebsd.org
cc: Josh Brooks <user@mail.econolodgetulsa.com>
cc: fenner@freebsd.org
Subject: RE: I would like to tcpdump and get all the packets...
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Sep 2003 22:28:37 -0000

From: Petri Helenius [mailto:pete@he.iki.fi]
> Bruce M Simpson wrote:
>=20
> >Er, if you check this URL:
> >http://www.freebsd.org/cgi/cvsweb.cgi/src/contrib/tcpdump/CHANGES
> >
> >Shurely you mean tcpdump 3.7.2, which is already imported=20
> (by fenner, with
> >additional hacks)?
> >
> > =20
> >
> I mean libpcap, which also tcpdump uses, if I=B4m not mistaken. Look =
in=20
> contrib/libpcap
>=20
> Pete

I found that increasing the bpf buffer size in libpcap
to 256K from the default of 4K made a tremendous difference.

--don