5.2.1 + snort, dropping packets

[Sergey Lyubka]

> This might be old information, but on stable branch, libpcap
> overrode the 'debug.bpf_bufsize' and always made it 4K. I made
> a local change and it fixed it for me. Not sure if that is
> corrected on current.
> 
> On the system you indicate you should be able to get ~300Kpps
> into user space via bpf, or at least, you can with stable.

thanks for the hint!
libpcap 0.8.3, which is already ported to -current,
fixes this problem.