From Dustin Spicuzza:

- Fixed bug where create_ring would fail for particular snaplen and
  buffer size combinations
- Changed ring allocation to retry with 5% less buffer size instead of
  50%

CREDITS

@@ -32,6 +32,7 @@ Additional people who have contributed patches:
 	Dean Gaudet			<dean at arctic dot org>
 	Don Ebright			<Don dot Ebright at compuware dot com> 
 	Dug Song			<dugsong at monkey dot org>
+	Dustin Spicuzza			<dustin at virtualroadside dot com>
 	Eric Anderson			<anderse at hpl dot hp dot com>
 	Erik de Castro Lopo		<erik dot de dot castro dot lopo at sensorynetworks dot com>
 	Florent Drouin			<Florent dot Drouin at alcatel-lucent dot fr>

pcap-linux.c

@@ -2600,19 +2600,29 @@ create_ring(pcap_t *handle)
 
 	frames_per_block = req.tp_block_size/req.tp_frame_size;
 
+	/* ask the kernel to create the ring */
+retry:
 	req.tp_block_nr = req.tp_frame_nr / frames_per_block;
 
 	/* req.tp_frame_nr is requested to match frames_per_block*req.tp_block_nr */
 	req.tp_frame_nr = req.tp_block_nr * frames_per_block;
-
-	/* ask the kernel to create the ring */
-retry:
+	
 	if (setsockopt(handle->fd, SOL_PACKET, PACKET_RX_RING,
 					(void *) &req, sizeof(req))) {
-		/* try to reduce requested ring size to prevent memory failure */
 		if ((errno == ENOMEM) && (req.tp_block_nr > 1)) {
-			req.tp_frame_nr >>= 1;
-			req.tp_block_nr = req.tp_frame_nr/frames_per_block;
+			/*
+			 * Memory failure; try to reduce the requested ring
+			 * size.
+			 *
+			 * We used to reduce this by half -- do 5% instead.
+			 * That may result in more iterations and a longer
+			 * startup, but the user will be much happier with
+			 * the resulting buffer size.
+			 */
+			if (req.tp_frame_nr < 20)
+				req.tp_frame_nr -= 1;
+			else
+				req.tp_frame_nr -= req.tp_frame_nr/20;
 			goto retry;
 		}
 		if (errno == ENOPROTOOPT) {