hello all. does anybody know an equivalent of the "sysctl net.bpf.maxbufsize" command on *BSD?

illumos source code defines BPF_MAXBUFSIZE to two different values, but it does not seem to use it

the port of bpf is... weird I think

but no, I don't know an equivalent toggle, sorry :\

the headers you're seeing are how there's one set of bpf in ipf, and one set actually in the OS, and neither is entirely normal. I think.

it is not in getconf output either

the effective maximum value must be at least 524288 because that's what libpcap sets on the socket

well, maybe it does not, pcap-bpf.c tries to accommodate at least 6 OSes, but for *BSD systems the sysctl value (524288 or greater) makes perfect sense