On 05/27/2011 11:03 AM, Guy Harris wrote:
On May 27, 2011, at 5:20 AM, ri...@happyleptic.org wrote:
If I understand this code correctly, in the next release of the libpcap
if a client program ask for a capture length bigger than the MTU then
the size allocated for each frame in the ring buffer will be sized down
to avoid wasting space ?
If, for a device that's supplying frames with Ethernet headers, and that's not doing any
form of offloading that might lead to oversized "packets" being delivered, a
program asks for a capture length bigger than the current MTU + 18, the size allocated
for each frame in the ring buffer will be sized down.
That's not currently being done for any other link-layer type, as the "+ 18"
part is necessary - the frame size needs to be large enough to include not just the
payload but the link-layer header (and, in case it happens to get delivered, the CRC),
and the MTU for an interface is the size of the largest chunk of data that can be handed
to the Ethernet layer to have the header and CRC added, i.e. it's 1500 for
non-jumbo-frame Ethernet, and that's not big enough for a maximum-sized Ethernet packet.
Might want to add an extra 4 bytes for a possible VLAN header too.
Thanks,
Ben
--
Ben Greear <gree...@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
