question concerning proper usage of kernel variables net.bpf.bufsize and vm_kmem_size_max

[Raymond Owens]

System:
Dell 2850 dual dual-core 3 Ghz Xeon processors
FreeBSD 6.1 amd64 
6Gb Ram

Problem:
System crashes when net.bpf.bufsize kernel variable is altered to value above 67Mb

Situation:
Box performs packet capture using Bro IDS application. It was seen that the larger the net.bpf.bufsize variable was made the more traffic that was captured. Unfortunately when the net.bpf.bufsize and net.bpf.maxbufsize variables exceed certain limits, the box immediately crashes sometimes rebooting sometimes falling to single user mode. There are a number of identical systems and the precise value at which this crash occurs varies, one box crashes when the variable is set to over 8Mb, others can be set successfully to 67Mb. Crash logs seem to consistently give messages that 'kmem_map too small'. The 'VM_KMEM_SIZE_MAX' variable is set by default apparently to 400Mb.


Questions:
Is there a limit to the value that net.bpf.bufsize and net.bpf.maxbufsize can be set to?

Is there a limit to the value that VM_KMEM_SIZE_MAX can be set to?

Can VM_KMEM_SIZE_MAX be set manually with sysctl?

Will increasing the value of VM_KMEM_SIZE_MAX have any chance of preventing the crash?

Thanks