linux: suggest adding a "pass all" filter in the activate routine.

That's what's been done for a while with BPF and what we're now doing
for NPF in WinPcap and Npcap.

[skip ci]

1 files changed, 7 insertions, 0 deletions

diff --git a/pcap-linux.c b/pcap-linux.c
index de21cd43..b558e459 100644
--- a/pcap-linux.c
+++ b/pcap-linux.c
@@ -4243,6 +4243,13 @@ static int pcap_handle_packet_mmap(
 	 *
 	 * Trim the snapshot length to be no longer than the
 	 * specified snapshot length.
+	 *
+	 * XXX - an alternative is to put a filter, consisting
+	 * of a "ret <snaplen>" instruction, on the socket
+	 * in the activate routine, so that the truncation is
+	 * done in the kernel even if nobody specified a filter;
+	 * that means that less buffer space is consumed in
+	 * the memory-mapped buffer.
 	 */
 	if (pcaphdr.caplen > (bpf_u_int32)handle->snapshot)
 		pcaphdr.caplen = handle->snapshot;