Hi Shaun, Libpcap's BPF code sets the kernel buffer size to 32 KB. If there are problems, libpcap tries 16 KB, then 8 KB, etc.
32 KB may be OK depending not only on which bitrates you want to capture (I assume you mean a 10 Mbps Ethernet), but also on how many data you need from every packet (snaplen). If you provide more information on this, maybe we could provide some help. -Chema Shaun wrote: > > Hi All, > > I notice that on AIX during the BPF buffer size selection loop (BIOCSBLEN) > the buffer size ends up being around 16k. For those of us who aren't > particularly familiar with the buffers used on other platforms is this > small a value normal? By my calculations this space will be filled about > 78 times a second on a busy 10MB Ethernet. How can I hope to keep up with > the traffic on the network at this sort of rate? > > Thanks, > Shaun > > - > This is the TCPDUMP workers list. It is archived at > http://www.tcpdump.org/lists/workers/index.html > To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
