[Bro-Dev] snaplen and drops

[Lothar Braun]

Hi,

On Oct 28, 2011, at 5:36 AM, Robin Sommer wrote:
>> You could try to make libpcap allocate a bigger buffer with
>> pcap_set_buffer_size(). However, this must be called before
>> pcap_activate(), which means that you cannot use pcap_open_live() but
>> have to call pcap_create, pcap_set_snaplen, pcap_set_timeout,
>> pcap_activate yourself...
> 
> Argh. Are they serious? There's essentially no way to control the
> buffer size? My patch now looks for an environment variable ...


You can change the buffer size in Bro if you use the new API for opening an interface. However, this will not work with libpcap versions < 1.0.0 

But that's not a real problem (at leat for  Linux) because these versions do not support memory mapping, anyways. 

If you want to use the new API and do not want to drop support for libpcap < 1.0.0, you have to check the pcap version in cmake and set some define for old versions (e.g. -DOLD_PCAP). Then you can have something like the following in PktSrc.cc:

#ifdef OLD_PCAP
	pd = pcap_open_live(...);
	if (!pd) 
		do_some_complaining();
		return;
#else
	int status;
        pd = pcap_create(device, errorbuf);
        if (!pd)
            do_some_complaining();
        status = pcap_set_snaplen(pd, snaplen);
        if (status < 0)
                goto fail;
        status = pcap_set_promisc(pd, promisc);
        if (status < 0)
                goto fail;
        status = pcap_set_timeout(pd, to_ms);
        if (status < 0)
                goto fail;

	/* increase the buffer size */
	status = pcap_set_buffer_size(pd, new_bigger_buffer_size)
        if (status < 0)
                goto fail;

        status = pcap_activate(p);
        if (status < 0)
                goto fail;
#endif

	do_some_more_useful_stuff_if_necessary();

#ifndef OLD_PCAP
fail:
	do_some_complaining();
	pcap_close(pd);
#endif


--
Lothar Braun
Chair for Network Architectures and Services (I8)
Department of Informatics
Technische Universität München
Boltzmannstr. 3, 85748 Garching bei München, Germany
Phone:  +49 89 289-18010       Fax: +49 89 289-18033
E-mail: braun at net.in.tum.de