Comment 24 for bug 1758037

Looking at source the default size if you don't call pcap_set_buffer_size is *massively* larger than the PCAP_BUFFERSIZE constant libvirt has defined:

$ grep -r 'buffer_size =' *
pcap.c: p->opt.buffer_size = 0; /* use the platform's default */
pcap.c: p->opt.buffer_size = buffer_size;
pcap-linux.c: if (handle->opt.buffer_size == 0) {
pcap-linux.c: handle->opt.buffer_size = 2*1024*1024;
pcap-win32.c: if (p->opt.buffer_size == 0)
pcap-win32.c: p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE;

$ grep -r WIN32_DEFAULT_KERNEL_BUFFER_SIZE *
pcap-win32.c:#define WIN32_DEFAULT_KERNEL_BUFFER_SIZE 1000000
pcap-win32.c: * WIN32_DEFAULT_KERNEL_BUFFER_SIZE.
pcap-win32.c: p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE;

So libpcap uses 2 MB on Linux, or 1 MB on Windows.

We need to consider what maximum oldest libpcap we support to support is, to decide whether we can safely drop the pcap_Set_buffer_size call, vs increase its value.