[Bro-Dev] snaplen and drops

Robin Sommer robin at icir.org
Thu Oct 27 20:36:46 PDT 2011

On Thu, Oct 27, 2011 at 22:31 +0200, you wrote:

> Which kernel and libpcap version do you use? 

Fedora 15, kernel 2.6.40, libpcap 1.1.1, Intel NIC.

> libpcap requests a two megabyte sized shared buffer (default size)
> from the kernel.

That's it! I just patched libcap to request a much larger buffer, and
right now it's looking like the drops are indeed gone even at the 65K

> You could try to make libpcap allocate a bigger buffer with
> pcap_set_buffer_size(). However, this must be called before
> pcap_activate(), which means that you cannot use pcap_open_live() but
> have to call pcap_create, pcap_set_snaplen, pcap_set_timeout,
> pcap_activate yourself...

Argh. Are they serious? There's essentially no way to control the
buffer size? My patch now looks for an environment variable ...

Thanks for pointing this out,


Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the bro-dev mailing list