I would like to tcpdump and get all the packets...

[Petri Helenius]

Don Bowman wrote:

>I found that increasing the bpf buffer size in libpcap
>to 256K from the default of 4K made a tremendous difference.
>  
>

We generally use sizes from 512k to 8M depending on network interface and
hardware configuration. Used to do larger but run into some issues with KVM
allocations if the machine had been running for a while before bpf fired up.

However, until the libpcap is updated, I need to maintain local patch to
have the sysctl actually work instead of the library forcing 32k on me.

So a fresh import would be greatly appreciated.

Pete