Libpcap And snap_len

[Vikram Roopchand <vikram.roopchand () j-interop org>]

Hello There,
                  We have been using Libpcap 1.1.1 heavily and noticed
something of the following nature. It seems that during a packet read,
internal buffer to read each segment is allocated a size of "snap_len"
bytes. This is okay since we do not know how many bytes will arrive so it
makes sense to have snap_len number of bytes as buffer to read into. But
after that it looks that no realloc is done to reduce the buffer to
the captured length (caplen) size. Is this correct ? If this is the
case, isn't some memory getting wasted each time a segment is caught. For
example, in case of Ethernet, If the snap_len was kept to 65535, and the
ethernet frame can go atmost to 9022 (jumbo), we lose on quite a bit of
internal buffer each time a segment is caught. I understand there must be
some performance drop doing realloc, may be that is the reason ?

I would be grateful if anyone can shed light on this,
thanks,
best regards,
Vikram
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.