> > ...like pcap_setbuff(), as implemented in WinPcap...
>
> ...and which I already know about.
...and also, which I mentioned in my original email:
Basically provide the same functionality as pcap_setbuff
from winpcap, but it has to be called before opening the bpf dev.
> or an environment-variable
> based mechanism (which is probably an OK short-term answer, if just
> boosting the default isn't acceptable - a very large default runs the
> risk of running out of kernel address space, which I've
> managed to do on
> at least one OS using BPF; that caused a network configuration daemon
> not to be able to work, which left my machine unusable).
That's exactly the case I was concerned about -- I might want
a large buffer for an IDS or similar, while also having a DHCP
client on a different interface using bpf with a standard,
smaller buffer.
Anyway, anoncvs at cvs.tcpdump.org isn't working for me:
cvs [login aborted]: recv() from server cvs.tcpdump.org: EOF
I'll download one of the nightly tars and try out the
environment variable idea.
Ed Maste
Sandvine Inc.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
