Re: AIX BPF Buffer Size

[José María González <chema () cs berkeley edu>]

Hi Shaun, 

Libpcap's BPF code sets the kernel buffer size to 
32 KB. If there are problems, libpcap tries 16 KB, 
then 8 KB, etc. 

32 KB may be OK depending not only on which bitrates 
you want to capture (I assume you mean a 10 Mbps 
Ethernet), but also on how many data you need from 
every packet (snaplen). If you provide more 
information on this, maybe we could provide some 
help. 

-Chema



Shaun wrote:
> Hi All,
>
> I notice that on AIX during the BPF buffer size selection loop (BIOCSBLEN)
> the buffer size ends up being around 16k. For those of us who aren't
> particularly familiar with the buffers used on other platforms is this
> small a value normal? By my calculations this space will be filled about
> 78 times a second on a busy 10MB Ethernet. How can I hope to keep up with
> the traffic on the network at this sort of rate?
>
> Thanks,
> Shaun
>
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe