Tcpdump has the option -B
to set the capture buffer size.
The value is then passed to libpcap (library used by tcpdump
to do the actual packet capturing)
via the pcap_set_buffer_size()
function.
tcpdump(1) (tcpdump's man page) says that the capture buffer size
is specified in units of KiB (1024 bytes);
the source seems to confirm this.
pcap_set_buffer_size(3pcap) (pcap_set_buffer_size's man page)
does not specify the default buffer size
(which is used if this function is not called),
but again, from the libpcap source, this seems to be 2 MiB,
at least on Linux (but is most likely system dependent).
With regard to packet buffering and dropping,
you should also pay attention to setting
the snaplen (-s
) parameter appropriately.
From tcpdump(1):
-s snaplen
--snapshot-length=snaplen
Snarf snaplen bytes of data from each packet rather than the
default of 655351 bytes.
Packets truncated because of a limited snapshot
are indicated in the output with ‘‘[|proto
]’’,
where proto
is the name of the protocol level
at which the truncation has occurred.
Note that taking larger snapshots
both increases the amount of time it takes to process packets
and, effectively, decreases the amount of packet buffering.
This may cause packets to be lost.
︙
... you should limit snaplen to the smallest number
that will capture the protocol information you're interested in.
Setting snaplen to 0 sets it to the default of 655351,
for backwards compatibility with recent older versions of tcpdump
.
________________
1 Recent versions of the man page
say 262144 rather than 65535 (both places).
This means that with a fixed buffer size,
you can increase the number of packets that fit into the buffer
(and thus not being dropped)
by decreasing the snaplen
size.