If you think you need to wrap your own buffering around pcap_dump() for performance...

[Guy Harris <gharris () sonic net>]

...the problem is probably just that the standard buffer size for the I/O library on your platform is too small, and 
libpcap should increase it.

See libpcap issue 792:

        https://github.com/the-tcpdump-group/libpcap/issues/792

If you've done any buffering of that sort to increase the writing speed of pcap_dump(), please update that issue to 
indicate how big your buffer was, so we know how big libpcap should make it.

(Bear in mind that the UNIX "standard I/O library" was originally developed on and for PDP-11's, where you had at most 
a 64KiB instruction space and a 64KiB data space, and the file system block size was one 512-KiB sector, and 4.2BSD 
just boosted the buffer size to the file system block size, typically 8KiB; when libpcap was developed, Sun were 
deciding whether to have the main memory size be 4MiB or 8MiB on the SPARCstation 1.  Memory sizes have increased a 
little bit since then....)
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers