tcpdump mailing list archives
Re: Max OS-X issues: read privledges / bpf buffer
From: Bruce M Simpson <bms () spc org>
Date: Fri, 3 Sep 2004 23:48:39 -0700
Hi, On Fri, Sep 03, 2004 at 11:41:42AM -0700, Guy Harris wrote:
One last thing, I noticed in some other mails this month that eliminating timestamping will increase performance of bpf. I don't use this feature of bpf, is there a way for me to turn it off in Darwin?I suspect they either said, or at least meant, "increase performance of packet capture" (referring to the general process, not specifically to BPF) or "*would* increase performance of BPF"; BPF has no mechanism to avoid time stamping packets.
Commenting out the call to microtime() in bpf.c would be one trivial way to go about doing this. On FreeBSD, you could sacrifice accuracy for lower execution time by using getmicrotime(). Or you could add a bpf ioctl to toggle this behaviour for a particular bpf instance. BMS - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- Max OS-X issues: read privledges / bpf buffer size Eric St.John (Sep 03)
- Re: Max OS-X issues: read privledges / bpf buffer Guy Harris (Sep 03)
- Re: Max OS-X issues: read privledges / bpf buffer Bruce M Simpson (Sep 03)
- Re: Max OS-X issues: read privledges / bpf buffer Guy Harris (Sep 03)