TCPDUMP performance

Charlie Schluting charlie at
Tue Jan 4 09:46:25 PST 2005

> James Kilton wrote:
>> Hello,
>> We've installed some FreeBSD machines as Gigabit sniffers, and I'm
>> wondering if there are any things I can tweak (e.g., buffer size) to help
>> TCPDUMP capture better (we often see packets dropped by the kernel).
>> Any advice would be appreciated.


sysctl debug.bpf_bufsize=8388608
sysctl debug.bpf_maxbufsize=8388608

As a general rule, you need a decent Pentium 4 to capture > 20K packets/sec 
without drops.


More information about the freebsd-questions mailing list