calculating buffer size

cynthia_thomas · 01-19-2006, 09:47 PM

hi,

I am currently working in an intrusion detection system. I want to store the captured packets in a buffer and then process them one by one . Can anybody tell me a formula for allocating the buffer size so the packets won't be dropped due to buffer overflow.

i hope it will depend of the NIC speed and processing speed

thanks and regards
cynthia

Matir · 01-19-2006, 10:49 PM

There's really no way to guarantee your buffer will never overflow. If we assume 100Mb ethernet, then you'll be getting 12.5MB/sec. If you process less than 12.5MB/sec of data, your buffer will eventually overflow.

That being said, you're not likely to get a full 100Mb/sec of data, at least not for long.

In any case, why are you doing your own capturing? Why not just build your software on top of something like libpcap?