The default capture buffer size is, in fact, *nominally* 1MB; however,

libpcap/WinPcap and the capture mechanism atop which they run might
either silently limit the buffer size to a smaller value or raise it to
a higher value - that's the part that's platform-dependent.

svn path=/trunk/; revision=32718

doc/dumpcap.pod

@@ -100,10 +100,13 @@ to specify two criterion, each must be preceded by the B<-b> option.
 
 =item -B  E<lt>capture buffer sizeE<gt>
 
-Set capture buffer size (in MB; default is platform-dependent).  This is
-used by the the capture driver to buffer packet data until that data can
-be written to disk.  If you encounter packet drops while capturing, try
-to increase this size.
+Set capture buffer size (in MB, default is 1MB).  This is used by the
+the capture driver to buffer packet data until that data can be written
+to disk.  If you encounter packet drops while capturing, try to increase
+this size.  Note that, while B<Dumpcap> attempts to set the buffer size
+to 1MB by default, and can be told to set it to a larger value, the
+system or interface on which you're capturing might silently limit the
+capture buffer size to a lower value or raise it to a higher value.
 
 This is available on on UNIX systems with libpcap 1.0.0 or later and on
 Windows.  It is not available on UNIX systems with earlier versions of

doc/tshark.pod

@@ -181,10 +181,13 @@ to specify two criterion, each must be preceded by the B<-b> option.
 
 =item -B  E<lt>capture buffer sizeE<gt>
 
-Set capture buffer size (in MB; default is platform-dependent).  This is
-used by the the capture driver to buffer packet data until that data can
-be written to disk.  If you encounter packet drops while capturing, try
-to increase this size.
+Set capture buffer size (in MB, default is 1MB).  This is used by the
+the capture driver to buffer packet data until that data can be written
+to disk.  If you encounter packet drops while capturing, try to increase
+this size.  Note that, while B<Tshark> attempts to set the buffer size
+to 1MB by default, and can be told to set it to a larger value, the
+system or interface on which you're capturing might silently limit the
+capture buffer size to a lower value or raise it to a higher value.
 
 This is available on on UNIX systems with libpcap 1.0.0 or later and on
 Windows.  It is not available on UNIX systems with earlier versions of

dumpcap.c

@@ -331,7 +331,7 @@ print_usage(gboolean print_ver) {
   fprintf(output, "  -I                       capture in monitor mode, if available\n");
 #endif
 #if defined(_WIN32) || defined(HAVE_PCAP_CREATE)
-  fprintf(output, "  -B <buffer size>         size of kernel buffer (def: platform-dependent)\n");
+  fprintf(output, "  -B <buffer size>         size of kernel buffer (def: 1MB)\n");
 #endif
   fprintf(output, "  -y <link type>           link layer type (def: first appropriate)\n");
   fprintf(output, "  -D                       print list of interfaces and exit\n");

gtk/main.c

@@ -1164,7 +1164,7 @@ print_usage(gboolean print_ver) {
   fprintf(output, "  -S                       update packet display when new packets are captured\n");
   fprintf(output, "  -l                       turn on automatic scrolling while -S is in use\n");
 #if defined(_WIN32) || defined(HAVE_PCAP_CREATE)
-  fprintf(output, "  -B <buffer size>         size of kernel buffer (def: platform-dependent)\n");
+  fprintf(output, "  -B <buffer size>         size of kernel buffer (def: 1MB)\n");
 #endif
   fprintf(output, "  -y <link type>           link layer type (def: first appropriate)\n");
   fprintf(output, "  -D                       print list of interfaces and exit\n");

tshark.c

@@ -238,7 +238,7 @@ print_usage(gboolean print_ver)
   fprintf(output, "  -I                       capture in monitor mode, if available\n");
 #endif
 #if defined(_WIN32) || defined(HAVE_PCAP_CREATE)
-  fprintf(output, "  -B <buffer size>         size of kernel buffer (def: platform-dependent)\n");
+  fprintf(output, "  -B <buffer size>         size of kernel buffer (def: 1MB)\n");
 #endif
   fprintf(output, "  -y <link type>           link layer type (def: first appropriate)\n");
   fprintf(output, "  -D                       print list of interfaces and exit\n");