[Winpcap-users] Re: reducing dropped packets

[Guy Harris]

David Chang wrote:

> Does libpcap allow pcap_setbuff() now?

No.  Unfortunately, it can't be made to work with BPF; the buffer size 
needs to be specified at open time.  It'll probably show up in a future 
open API.

> Also, how can I minimize the amount of effort it takes the hardware to 
> receive a packet (better NIC, faster CPU, etc), pass it up to the kernel 
> (O.S. kernel settings), winpcap to filter the packet (winpcap filter 
> expression and other API settings), and my application to receive that 
> packet (use pcap_next instead of pcap_dispatch, etc)?

pcap_next() vs. pcap_dispatch() won't make a difference there.