Improving NetSniff capture performance on FreeBSD by increasing the PCAP capture buffer size

NetSniff is an IP traffic analysis tool that is capable of multi-protocol, live capture analysis. Previous work has revealed that under live capture situations, NetSniff performance was often limited not by available system resources, but rather by the size of the buffer employed by the PCAP library to store captured packets prior to processing. In this paper we examine how this buffer size is determined and look at what performance gains we can achieve when we increase the size of the PCAP buffer.