> shouldn't we have upper/lower boundary checks for > such a buffer ? > > i.e. minbuffer 1.5K > maxbuffer 128K
So would you propose just returning an error from pcap_open_live if the obtained buffer size is less than minbuffer? Something like if PCAP_MAXBUFFER environment var is set and > 0, start with that value else if ioctl(BIOCGBLEN) is > 32K, use that else start at 32K do divide-by-two loop to find a workable size if PCAP_MINBUFFER environment var is set, return error if ioctl(BIOCGBLEN) returns less than the environment var What do you think of this? Ed Maste Sandvine Inc. - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
