TCPDUMP performance

[Charlie Schluting]

> James Kilton wrote:
> 
>> Hello,
>>
>> We've installed some FreeBSD machines as Gigabit sniffers, and I'm
>> wondering if there are any things I can tweak (e.g., buffer size) to help
>> TCPDUMP capture better (we often see packets dropped by the kernel).
>>
>> Any advice would be appreciated.
>>

This:

sysctl debug.bpf_bufsize=8388608
sysctl debug.bpf_maxbufsize=8388608

As a general rule, you need a decent Pentium 4 to capture > 20K packets/sec 
without drops.

-Charlie