Keith French wrote:
> In the Capture options dialog box, you can alter the kernel buffer
> size. The user guide says that increasing this from the default of
> 1Mb, can help when packets are being dropped.
>
> Is there any point in setting this to a much higher value, or will it
> be a trade off with the PC's CPU performance?
>
> What is generally the most effective setting for the kernel buffer size?
>
Hi Keith!
Please note first, that the current 0.10.11 release has a bug, which
renders this setting having simply no effect. This was already fixed in
the current developers releases.
So if you want to see *any* effect, you'll have to use a buildbot build
http://www.ethereal.com/distribution/buildbot-builds/.
This buffer is used to "park" the incoming network data until the hard
disk is able to save things. So if your hard disk subsystem permanently
cannot save the network traffic coming in, increasing this size won't
help a lot. However, it *will* help if the CPU is temporarily
overloaded, but has enough power shortly after.
There are currently no general guidelines how to set this value, this
will depend on the CPU, memory, network link, hard disk, ...
A value of maybe 20 MB might be suitable for all possible cases (if that
is not enough, increasing might not help), but that's really only a very
rough guess from myself without any real knowledge behind it.
If anyone has better knowledge (or already done some testing), *please*
share it with us...
Regards, ULFL
