libpcap question.

[Matt Comb <mattyc () orcon net nz>]

Hi, these questions are more related to libpcap but i wonder if someone
can help me.

I am currently using libpcap to sniff a connection.

When I transfer an ftp sequence on a very fast lan, It seems that I am
losing packets.

I am not sure that I have the libpcap buffer size set correctly, my
questions are as follows.

1. When I was using tcpdump, i set the packet size to 1514 so I received
the entire packet. I have set the snaplen in libpcap to this value and i
am calling getnext is this correct?

2. Should I be setting a different operating buffer for libpcap after
the open live, and if so how?

3. Or should I have snaplen much higher and then potentially get more
than one packet when i call getnext?

I'm a slightly confused about the correct way to make sure that I am
grabbing all and full packets.

Any help would be appreciated.

Matt.

p.s. is there a libpcap mailing list?