i think the buffer is 32K (from BPF_MAXBUFSIZE in bpf.h) and you should be
able to bump it up a bit on your box if you wish. it might help. also,
maybe we should consider upping the default buffer size in our tree?
On Mon, May 22, 2000 at 04:16:56PM -0700, Christopher Nielsen <[EMAIL PROTECTED]>
wrote:
> On Mon, 22 May 2000, Graham Wheeler wrote:
>
> > If my memory serves me correctly, Marcus Ranum wrote a white paper on
> > IDS systems in the early days of NFR, in which he said that the existing
> > configuration of BPF was inadequate for capturing all packets on a fast
> > link, and suggested a patch to improve the situation. THe patch involved
> > bumping up a buffer from about 16kb to 256kb. Unfortunately I no longer
> > have the details handy, but if you did a search for BPF/IDS/NFR/Ranum
> > you might find something.
>
> http://www.nfr.net/forum/publications/LISA-97.htm
>
> --
> Christopher Nielsen
> (enkhyl|cnielsen)@pobox.com
> Enkhyl on IRC
> Space monekys ate my brain: No such file or directory
>
>
>
> To Unsubscribe: send mail to [EMAIL PROTECTED]
> with "unsubscribe freebsd-net" in the body of the message
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message
