On Mon, Mar 08, 2004 at 10:10:41PM +0100, Ulf Lamping wrote:
> So Ethereal (and tethereal too?) on win32 will have significant packet
> drops on high traffic networks,
> as the driver's buffer (default 1000KB) is just too small.
>
> WinPcap offers to increase this buffer size, so I tend to include some
> way of increasing this size.
>
> What do others think?
That would probably be reasonable.
There is currently no standard libpcap API for that (WinPcap's API for
doing that is unimplementable on BPF, as, with BPF, you cannot change
the buffer size once you've bound a network device to the BPF device,
and that binding happens at open time, so you can't change the buffer
size once you've opened a device; at some point I plan to add a new API
for opening devices that would let you specify a buffer size at open
time), so it'd be Win32-only, for now - but don't do anything to make it
difficult to make it work on UNIX as well in future releases (or do
something such as having it explicitly say it's Win32-only in the GUI).
As for doing it on the command line in Tethereal, do it with a "-B" flag
on the command line, for compatibility with WinDump - unfortunately,
"-B" *currently* sets the byte view pane height in Ethereal, but perhaps
we should have some other flag for that and have "-B" set the capture
buffer size.