Re: what is the best value for PCAP_FRAMES?

[Guy Harris <guy () alum mit edu>]

On Dec 1, 2010, at 1:19 AM, Jon Zhou wrote:

> The bigger PCAP_FRAMES or a smaller value will get a better performance?
>
> I.e.
>
> PCAP_FRAMES=max tcpdump -I eth0 -w /dev/null
>
> Or
>
> PCAP_FRAMES=4096 tcpdump .....

As distributed by tcpdump.org, neither libpcap nor tcpdump pay any attention whatsoever to a PCAP_FRAMES environment 
variable, so, unless you're using a version of libpcap or tcpdump that somebody *else* modified to look at that 
environment variable, the value of PCAP_FRAMES will make no difference whatsoever to performance.  If you *are* using a 
version that somebody else modified, you might have to ask them what effect it will have.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.