[Bro-Dev] snaplen and drops

[Martin Holste]

> So if you use libpcap >= 1.0.0, you should have AF_PACKET support by default. Snort/Suricata probably implemented separate AF_PACKET support for systems that ship libpcap < 1.0.0.

I've used pcap > 1.0 and had much worse performance than AF_PACKET, so
I'd be willing to bet that IRQ CPU utilization is higher with pcap and
AF_PACKET does a polling mechanism to decrease its IRQ overhead.  I
can't speak to the mmap techniques and whether or not they differ, but
IRQ alone would be enough to make a noticeable difference.