With BPF and Digital UNIX's packetfilter, changing the filter flushes
the buffer. With Linux, changing the filter doesn't flush the buffer
- so current versions of libpcap purge the buffer themselves, so
that, after you change a filter, you don't get any packets that
wouldn't have passed t
- Original Message -
From: "Guy Harris" <[EMAIL PROTECTED]>
To:
Sent: Thursday, December 06, 2007 4:09 PM
Subject: Re: [tcpdump-workers] [PATCH] enable memory mapped access to
ethernet device for linux
There's also an issue that with the ringbuffer, the initial contents can
be qu
Guy Harris wrote:
With BPF and Digital UNIX's packetfilter, changing the filter flushes
the buffer. With Linux, changing the filter doesn't flush the buffer
- so current versions of libpcap purge the buffer themselves, so that,
after you change a filter, you don't get any packets that wou
[I sent this from my other account but it seems not to have gone through;
resending and apologies if you receive it twice.]
Paolo Abeni writes:
It does not use environment variables to control the memory mapped ring
parameters; instead the requested snap len is used: the low order bytes
are used
hello,
First, thanks for the detailed review. It seems that some of the
relevant point has been addressed by Guy Harris, so I'll try to catch
the others...
On Thu, 2007-12-06 at 12:54 -0500, Alexander Dupuy wrote:
> Rounding the ring size to nearest power of two wastes quite a bit of
> memory f
