rupesh gautam wrote:
i am using ethereal for studying packet drop in it. what is default
buffer length ethereal uses.....and can we change buffer length by
command line....if not then should i change in code and recompile it....
What do you mean by "buffer length"?
If you mean the buffer into which the packet capture mechanism in the
kernel puts packets before the user-mode code in libpcap (as called by
Ethereal) reads the packets, that's only configurable on Windows
(because libpcap currently doesn't have an API to set it; one problem is
that, on systems with BPF, such as the BSDs, you have to set the buffer
size *before* binding a BPF device to an interface, meaning it can only
be set at open time, and there's no argument to "pcap_open_live()" for
that; this will probably be fixed in the future - there is no schedule
for this).
So you can only change the buffer size on Windows, using the "-B"
command line option.
