From owner-freebsd-hackers Mon May 22 5:36:29 2000 Delivered-To: freebsd-hackers@freebsd.org Received: from citadel.cequrux.com (citadel.cdsec.com [192.96.22.18]) by hub.freebsd.org (Postfix) with ESMTP id DC3DA37C04B; Mon, 22 May 2000 05:35:49 -0700 (PDT) (envelope-from gram@cequrux.com) Received: (from nobody@localhost) by citadel.cequrux.com (8.8.8/8.6.9) id OAA08918; Mon, 22 May 2000 14:35:30 +0200 (SAST) Received: by citadel.cequrux.com via recvmail id 8838; Mon May 22 14:34:32 2000 Message-ID: <39292998.4C55739A@cequrux.com> Date: Mon, 22 May 2000 14:35:36 +0200 From: Graham Wheeler Organization: Cequrux Technologies X-Mailer: Mozilla 4.7 [en] (X11; U; FreeBSD 2.2.8-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: Dmitry Samersoff Cc: freebsd-hackers@FreeBSD.ORG, freebsd-net@FreeBSD.ORG Subject: Re: bpf question References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Dmitry Samersoff wrote: > > I have stoped on perforamnce bpf itself. > > Is there alternate driver or can changing of bpf queue in kernel help, and where > I can read about it? If my memory serves me correctly, Marcus Ranum wrote a white paper on IDS systems in the early days of NFR, in which he said that the existing configuration of BPF was inadequate for capturing all packets on a fast link, and suggested a patch to improve the situation. THe patch involved bumping up a buffer from about 16kb to 256kb. Unfortunately I no longer have the details handy, but if you did a search for BPF/IDS/NFR/Ranum you might find something. -- Dr Graham Wheeler E-mail: gram@cequrux.com Director, Research and Development WWW: http://www.cequrux.com CEQURUX Technologies Phone: +27(21)423-6065 Firewalls/VPN Specialists Fax: +27(21)424-3656 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message