From owner-freebsd-questions@FreeBSD.ORG  Tue Jan  4 17:46:25 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7AF3816A4CE
	for <freebsd-questions@freebsd.org>;
	Tue,  4 Jan 2005 17:46:25 +0000 (GMT)
Received: from mailhost.schluting.com (schluting.com [131.252.214.57])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5139C43D2D
	for <freebsd-questions@freebsd.org>;
	Tue,  4 Jan 2005 17:46:25 +0000 (GMT)
	(envelope-from charlie@schluting.com)
Received: from localhost (localhost [127.0.0.1])
	by mailhost.schluting.com (Postfix) with ESMTP id 016FD21D9
	for <freebsd-questions@freebsd.org>;
	Tue,  4 Jan 2005 09:46:25 -0800 (PST)
Received: from mailhost.schluting.com ([127.0.0.1])
 by localhost (schluting.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
 id 41823-09 for <freebsd-questions@freebsd.org>;
 Tue,  4 Jan 2005 09:46:20 -0800 (PST)
Received: from [131.252.209.122] (smelly.cat.pdx.edu [131.252.209.122])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mailhost.schluting.com (Postfix) with ESMTP id 3CB9B2116
	for <freebsd-questions@freebsd.org>;
	Tue,  4 Jan 2005 09:46:20 -0800 (PST)
Message-ID: <41DAD66B.7080505@schluting.com>
Date: Tue, 04 Jan 2005 09:46:19 -0800
From: Charlie Schluting <charlie@schluting.com>
User-Agent: Mozilla Thunderbird 1.0 (X11/20041215)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-questions@freebsd.org
References: <20050102152416.65565.qmail@web51904.mail.yahoo.com>
	<41DAD26C.9010500@sbcglobal.net>
In-Reply-To: <41DAD26C.9010500@sbcglobal.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by your mom at schluting.com
Subject: Re: TCPDUMP performance
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Jan 2005 17:46:25 -0000

> James Kilton wrote:
> 
>> Hello,
>>
>> We've installed some FreeBSD machines as Gigabit sniffers, and I'm
>> wondering if there are any things I can tweak (e.g., buffer size) to help
>> TCPDUMP capture better (we often see packets dropped by the kernel).
>>
>> Any advice would be appreciated.
>>

This:

sysctl debug.bpf_bufsize=8388608
sysctl debug.bpf_maxbufsize=8388608

As a general rule, you need a decent Pentium 4 to capture > 20K packets/sec 
without drops.

-Charlie