[Saul <saul@xxxxxxxxxx>]

packet steve wrote:
> I commonly take captures with Solaris snoop and do off-line decodes with
> ethereal.  Under some conditions, the snoop capture program can't keep up
> with the data stream and drops packets.  Does anyone know of tricks to
> minimize dropped packets?  (I'll try increasing the process priority.)
Are
> there any kernel tunables (e.g., via ndd) that might help?


Maybe you can filter-out some of the net traffic uninteresting protocols so
that less data would be written to the capture file thus making it faster?
Another option is to locate the capture file on local disk instead (if thats
the case) of an NFS mount.


Saul