Guy Harris wrote:
You forgot option 3:
3. Raise the limit on the maximum number of BPF instructions.
You're going to have to add stuff to, or change stuff in, the kernel to
implement this *anyway*, so you might as well just boost the maximum
number of BPF instructions and not have to change libpcap *at all*.
You might also have to raise the limit on socket options; see
http://www.tcpdump.org/lists/workers/2004/05/msg00007.html
It might be that you're running into the limit on socket options, rather
than the limit on BPF instructions, in which case you don't have to
change any code.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.