[Bro-Dev] snaplen and drops

[Robin Sommer]

On Thu, Oct 27, 2011 at 22:31 +0200, you wrote:

> Which kernel and libpcap version do you use? 

Fedora 15, kernel 2.6.40, libpcap 1.1.1, Intel NIC.

> libpcap requests a two megabyte sized shared buffer (default size)
> from the kernel.

That's it! I just patched libcap to request a much larger buffer, and
right now it's looking like the drops are indeed gone even at the 65K
snaplen.

> You could try to make libpcap allocate a bigger buffer with
> pcap_set_buffer_size(). However, this must be called before
> pcap_activate(), which means that you cannot use pcap_open_live() but
> have to call pcap_create, pcap_set_snaplen, pcap_set_timeout,
> pcap_activate yourself...

Argh. Are they serious? There's essentially no way to control the
buffer size? My patch now looks for an environment variable ...

Thanks for pointing this out,

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org