libpcap buffering...

[barcaroller]

I have two questions related to buffers in libpcap.

- I would like to to use the pcap_set_buffer_size() to run various
performance tests. However, I do not know the default buffer size (on
a 64-bit Linux system with 16 GB of RAM) and I do not know how to get
it (there is no pcap_get_buffer_size()). How can I tell what the
existing buffer size is before I start changing that value?

- I would like to improve the performance of pcap_dump() when writing
packets to disk. I know that pcap_dump() already uses some kind of
buffering. What is the best way to approach this? Can the
aforementioned function (pcap_set_buffer_size()) be used for this
purpose, or is that function used only during packet capture (e.g.
pcap_next())?

Thanks much!

[Guy Harris]

Post by barcaroller
I have two questions related to buffers in libpcap.
- I would like to to use the pcap_set_buffer_size() to run various performance tests. However, I do not know the default buffer size (on a 64-bit Linux system with 16 GB of RAM) and I do not know how to get it (there is no pcap_get_buffer_size()). How can I tell what the existing buffer size is before I start changing that value?

You'd have to modify libpcap to provide that information.

Post by barcaroller
- I would like to improve the performance of pcap_dump() when writing packets to disk. I know that pcap_dump() already uses some kind of buffering.

The only buffering it uses is the buffer provided by the "standard I/O library" routines (fopen(), fwrite(), fclose()) that it uses to open the dump file, write to it, and close it.

Post by barcaroller
What is the best way to approach this? Can the aforementioned function (pcap_set_buffer_size()) be used for this purpose,

No. The standard I/O buffer is completely separate for the packet capture buffering.