--- contrib/libpcap/pcap-bpf.c +++ contrib/libpcap/pcap-bpf.c @@ -241,7 +241,7 @@ * XXX - there should be a user-accessible hook to set the * initial buffer size. */ - for (v = 32768; v != 0; v >>= 1) { + for (v = 1048576; v != 0; v >>= 1) { /* Ignore the return value - this is because the call fails * on BPF systems that don't have kernel malloc. And if * the call fails, it's no big deal, we just continue to