Re: pcap & bpf

2002-09-21 Thread Neelkanth Natu
Hi, --- Petri Helenius <[EMAIL PROTECTED]> wrote: > (I'm sending a copy here since I'm running this on FreeBSD and got > no reply so far from the tcpdump folks) > > Function pcap_open_live in pcap-bpf.c contains the code snippet below. > > To me, this does not make too much sense, because: >

Re: pcap & bpf

2002-09-21 Thread Petri Helenius
> 32k is already a bump up from the default of 4k, which at the time that > was set (and hard coded) probably seemed "good enough". Obviously as > interfaces have gotten faster, that number has become out of date. Yes > they SHOULD make it pcap-user tunable, the comment even says so, but until >

Re: pcap & bpf

2002-09-21 Thread Richard A Steenbergen
On Sat, Sep 21, 2002 at 12:03:30PM +0300, Petri Helenius wrote: > (I'm sending a copy here since I'm running this on FreeBSD and got > no reply so far from the tcpdump folks) > > Function pcap_open_live in pcap-bpf.c contains the code snippet below. > > To me, this does not make too much sense