Date: Mon, 22 May 2000 14:35:36 +0200 From: Graham Wheeler <gram@cequrux.com> To: Dmitry Samersoff <dms@wplus.net> Cc: freebsd-hackers@FreeBSD.ORG, freebsd-net@FreeBSD.ORG Subject: Re: bpf question Message-ID: <39292998.4C55739A@cequrux.com> References: <XFMail.20000519175724.dms@wplus.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Dmitry Samersoff wrote: > > I have stoped on perforamnce bpf itself. > > Is there alternate driver or can changing of bpf queue in kernel help, and where > I can read about it? If my memory serves me correctly, Marcus Ranum wrote a white paper on IDS systems in the early days of NFR, in which he said that the existing configuration of BPF was inadequate for capturing all packets on a fast link, and suggested a patch to improve the situation. THe patch involved bumping up a buffer from about 16kb to 256kb. Unfortunately I no longer have the details handy, but if you did a search for BPF/IDS/NFR/Ranum you might find something. -- Dr Graham Wheeler E-mail: gram@cequrux.com Director, Research and Development WWW: http://www.cequrux.com CEQURUX Technologies Phone: +27(21)423-6065 Firewalls/VPN Specialists Fax: +27(21)424-3656 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?39292998.4C55739A>