Wireshark · Ethereal-dev: Re: [ethereal-dev] AIX: gtk problem solved, now an ethereal problem

[Laurent Deniel <deniel@xxxxxxxxxxx>]

Craig Rodrigues wrote:
> 
> >
> >         (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
> >
> >         (void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
> >         if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
> >                 sprintf(ebuf, "%s: %s", device, pcap_strerror(errno));
> >                 goto bad;
> >         }
> >
> > Ideas?
> 
> OK, I just tried something, and it seemed to work.
> In pcap-bpf.c, I changed the following line:
> 
>         v = 32768;  /* XXX this should be a user-accessible hook */
> 
> to:
>         v = 16384;
> 
> Now the ioctl() for BIOCSBLEN is called with a smaller value for v,
> and things seem to work.....although all the messages I receive back
> look like Token Ring packets now.
> 
> Can anyone tell me what BIOCSBLEN is, and what the correct value of v
> should be?
> 

It is for increasing the buffer size (can not be greater than BPF_MAXBUFSIZE)
but might be also limited by the underlying network stack. I remember that
AIX was the OS which has the smallest maximum socket buffer space by default
(as compared to DU, HPUX, Solaris) and some other limitations as well :-). 
So this problem could be related to the same sizing limitation (I do not have
an AIX box here to check if it can be increased by kernel modification or
network subsystem tuning).

Laurent.

--
Laurent DENIEL        | E-mail: deniel@xxxxxxxxxxx
Paris, FRANCE         |         laurent.deniel@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
                      | WWW   : http://www.worldnet.fr/~deniel
    All above opinions are personal, unless stated otherwise.