Looking at source the default size if you don't call pcap_set_buffer_size is *massively* larger than the PCAP_BUFFERSIZE constant libvirt has defined:
$ grep -r 'buffer_size =' * pcap.c: p->opt.buffer_size = 0; /* use the platform's default */ pcap.c: p->opt.buffer_size = buffer_size; pcap-linux.c: if (handle->opt.buffer_size == 0) { pcap-linux.c: handle->opt.buffer_size = 2*1024*1024; pcap-win32.c: if (p->opt.buffer_size == 0) pcap-win32.c: p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE;
$ grep -r WIN32_DEFAULT_KERNEL_BUFFER_SIZE * pcap-win32.c:#define WIN32_DEFAULT_KERNEL_BUFFER_SIZE 1000000 pcap-win32.c: * WIN32_DEFAULT_KERNEL_BUFFER_SIZE. pcap-win32.c: p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE;
So libpcap uses 2 MB on Linux, or 1 MB on Windows.
We need to consider what maximum oldest libpcap we support to support is, to decide whether we can safely drop the pcap_Set_buffer_size call, vs increase its value.
Looking at source the default size if you don't call pcap_set_ buffer_ size is *massively* larger than the PCAP_BUFFERSIZE constant libvirt has defined:
$ grep -r 'buffer_size =' * >opt.buffer_ size == 0) { >opt.buffer_ size = 2*1024*1024; KERNEL_ BUFFER_ SIZE;
pcap.c: p->opt.buffer_size = 0; /* use the platform's default */
pcap.c: p->opt.buffer_size = buffer_size;
pcap-linux.c: if (handle-
pcap-linux.c: handle-
pcap-win32.c: if (p->opt.buffer_size == 0)
pcap-win32.c: p->opt.buffer_size = WIN32_DEFAULT_
$ grep -r WIN32_DEFAULT_ KERNEL_ BUFFER_ SIZE * c:#define WIN32_DEFAULT_ KERNEL_ BUFFER_ SIZE 1000000 KERNEL_ BUFFER_ SIZE. KERNEL_ BUFFER_ SIZE;
pcap-win32.
pcap-win32.c: * WIN32_DEFAULT_
pcap-win32.c: p->opt.buffer_size = WIN32_DEFAULT_
So libpcap uses 2 MB on Linux, or 1 MB on Windows.
We need to consider what maximum oldest libpcap we support to support is, to decide whether we can safely drop the pcap_Set_ buffer_ size call, vs increase its value.