alexander medvedev wrote:
i am trying to minimize the dropped packet count, which maybe due to a too small buffer in the BPF driver.
are there any bad implications of setting the BPF buffer size to 1meg and hardcoding pcap-bpf.c to use the buffer size of 1meg? [wasting kernel memory does not count.]
There are no implications I know of other than, as you note, using a lot of kernel memory.
(That *could* be significant if the size you're using is a significant fraction of the available kernel address space in the area from which it allocates memory for the BPF buffer.
I ran into that on one system where I'd set the buffer size really large - I'd sysctl'ed the default and maximum buffer size to some large value, and the DHCP agent on the system couldn't ask for an IP address because I was running a capture program which allocated one BPF buffer and there wasn't room for another one; if I remember correctly, that meant the machine wasn't able to get an IP address after sleeping and waking up, or perhaps it was after the DHCP lease expired, and, as my home directory was NFS-mounted, I couldn't get much done in my login session, and couldn't log in remotely to fix it. I might've set the sizes to some *really* big value, though, such as 16MB.)
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
