In pcap, the concepts of Kernel Buffer and User Buffer exist. Kernel Buffer is provided to the driver layer to cache packets captured on the NIC, and the User Buffer is used to interact with User applications, provide the data to the user through UserBuffer.
Int pcap_setbuff (pcap_t * p, int dim );
Set the size of the kernel buffer associated with an adapter. dim specifies the size of the buffer in bytes. the return value is 0 when the call succeeds,-1 otherwise. if an old buffer was already created with a previous call to pcap_setbuff (), it is deleted and its content is discarded. pcap_open_live () creates a 1 MByte buffer by default.
This interface is an extension of Winpcap and is used to set the Windows Kernel buffer size. However, it is not available in Linux.
PCAP_BUF_SIZE is the compilation macro of Winpcap. It is used to save information such as address, port, and interface name. The default value is 1024.
Snaplen is a parameter of pcap_open_live. It is used to define the Buffer size of captured packets. It is generally set to 65535. & Nbs