Re: Buffer size question

["Ed Maste" <emaste () sandvine com>]

> > ...like pcap_setbuff(), as implemented in WinPcap...
>
> ...and which I already know about.

...and also, which I mentioned in my original email:
    Basically provide the same functionality as pcap_setbuff 
    from winpcap, but it has to be called before opening the bpf dev.

> or an environment-variable 
> based mechanism (which is probably an OK short-term answer, if just 
> boosting the default isn't acceptable - a very large default runs the 
> risk of running out of kernel address space, which I've 
> managed to do on 
> at least one OS using BPF; that caused a network configuration daemon 
> not to be able to work, which left my machine unusable).

That's exactly the case I was concerned about -- I might want
a large buffer for an IDS or similar, while also having a DHCP
client on a different interface using bpf with a standard, 
smaller buffer.

Anyway, anoncvs at cvs.tcpdump.org isn't working for me: 
cvs [login aborted]: recv() from server cvs.tcpdump.org: EOF

I'll download one of the nightly tars and try out the 
environment variable idea.

Ed Maste
Sandvine Inc.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.