Max OS-X issues: read privledges / bpf buffer size

["Eric St.John" <estjohn () umich edu>]

I'm trying to use libpcap in Darwin (uses bpf). In order to capture the 
packets, I must have read acess to the /dev/bpf* files. I can chmod 
these, but as soon as I reboot their privledges are reset! Any ideas?

I would also like to get a larger bpf buffer size. I call ioctl(fd, 
BIOCSBLEN, (caddr_t)&v); with v initially equal to 64 MB.  After the 
call v is changed to 32 K and a call with BIOCGBLEN confirms this.  Is 
there anything I can do (short of recompiling Darwin) to get around 
this?  I am trying to capture at sustained speeds of 80Mbps - 320Mbps.  
With these speeds I need a larger buffer for when the OS wanders off to 
do other stuff.

One last thing,  I noticed in some other mails this month that 
eliminating timestamping will increase performance of bpf.  I don't use 
this feature of bpf, is there a way for me to turn it off in Darwin?

Thanks,
Eric
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.