Re: [tcpdump-workers] buffer size question

rupesh gautam wrote: why changing buffer size is unimplementable on systems with bpf. It's not *completely* unimplementable. It can, however, not be done after the BPF device has been bound to a network interface, which means that it cannot be done after "pcap_open_live()". I don't know why the

[tcpdump-workers] buffer size question

why changing buffer size is unimplementable on systems with bpf. and does packet drop depends upon packet filter??- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] Buffer size question

On Mon, Oct 18, 2004 at 04:37:41PM -0700, Guy Harris wrote: > Including such an argument at the time the new API is introduced > obviously doesn't introduce compatibility issues for that API. :-) > (I'm actually thinking of an attribute/value list for various open > options in the API, so t

Re: [tcpdump-workers] Buffer size question

On Oct 18, 2004, at 3:04 PM, Alexander Dupuy wrote: Guy Harris writes: Unfortunately, given that, on systems with BPF, you cannot change the buffer size after a BPF device has been bound to a network interface, "pcap_setbuff()" is unimplementable on those systems, so it's not a candidate for

[tcpdump-workers] Buffer size question

Guy Harris writes: Unfortunately, given that, on systems with BPF, you cannot change the buffer size after a BPF device has been bound to a network interface, "pcap_setbuff()" is unimplementable on those systems, so it's not a candidate for libpcap. I didn't realize it was possible to set the bu

Re: [tcpdump-workers] Buffer size question

On Oct 15, 2004, at 6:19 AM, Hannes Gredler wrote: shouldn't we have upper/lower boundary checks for such a buffer ? i.e. minbuffer 1.5K maxbuffer 128K I think the BPF kernel code in most of the BSDs already impose upper and lower bounds; are you suggesting that libpcap impose its own bounds

Re: [tcpdump-workers] Buffer size question

> shouldn't we have upper/lower boundary checks for > such a buffer ? > > i.e. minbuffer 1.5K > maxbuffer 128K So would you propose just returning an error from pcap_open_live if the obtained buffer size is less than minbuffer? Something like if PCAP_MAXBUFFER environment var is set and >

Re: [tcpdump-workers] Buffer size question

On Fri, 15 Oct 2004, Hannes Gredler wrote: > shouldn't we have upper/lower boundary checks for > such a buffer ? > > i.e. minbuffer 1.5K > maxbuffer 128K And if this is done, shouldn't we be doing some input validation? The user might not even give a numeric value, much less positive one.

Re: [tcpdump-workers] Buffer size question

shouldn't we have upper/lower boundary checks for such a buffer ? i.e. minbuffer 1.5K maxbuffer 128K /hannes On Thu, Oct 14, 2004 at 02:29:14PM -0400, Ed Maste wrote: | > I'll download one of the nightly tars and try out the | > environment variable idea. | | Here's my simple patch to all

Re: [tcpdump-workers] Buffer size question

> I'll download one of the nightly tars and try out the > environment variable idea. Here's my simple patch to allow an environment variable PCAP_BUFSIZE to override the default initial buffer size. --- pcap-bpf.c Tue Oct 5 03:23:39 2004 +++ pcap-bpf.c.new Thu Oct 14 14:21:41 2004 @@ -578

Re: [tcpdump-workers] Buffer size question

> > ...like pcap_setbuff(), as implemented in WinPcap... > > ...and which I already know about. ...and also, which I mentioned in my original email: Basically provide the same functionality as pcap_setbuff from winpcap, but it has to be called before opening the bpf dev. > or an environ

Re: [tcpdump-workers] Buffer size question

Gianluca Varenni wrote: ...like pcap_setbuff(), as implemented in WinPcap... ...and which I already know about. Unfortunately, given that, on systems with BPF, you cannot change the buffer size after a BPF device has been bound to a network interface, "pcap_setbuff()" is unimplementable on those

Re: [tcpdump-workers] Buffer size question

- Original Message - From: "Guy Harris" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 14, 2004 1:45 AM Subject: Re: [tcpdump-workers] Buffer size question > Ed Maste wrote: > > > 1) Add a new pcap API function pcap_set_bufsize th

Re: [tcpdump-workers] Buffer size question

Ed Maste wrote: 1) Add a new pcap API function pcap_set_bufsize that can be used to set the size used for following pcap_open_live calls (by setting a libpcap global variable). The global variable is a bit ugly. If you're going to have API changes... 2) Add a new function like pcap_open_live that

[tcpdump-workers] Buffer size question

(I just subscribed to the list so don't have the original message to reply to.) I have some more comments on the recent thread about the pcap buffer size code in pcap-bpf.c. The code to try smaller and smaller buffer sizes until a valid size is found has the following comment: /*