title: FreeBSD: Questions about NIC ring buffers, mbufs, and bpf buffers
body: <p>I've been going through many technical documents on packet capture/processing and host stacks trying to understand it all, there's a few areas where I'm troubled, hopefully someone can help.</p>
  
  <p>Assuming you're running tcpdump: 
  After a packet gets copied from a NIC's ring buffer (physical NIC memory right?) 
  does it immediately get stored into an mbuf? and then BPF gets a copy of the packet <strong>from the</strong> mbuf , which is then stored in the BPF buffer, so there are two copies in memory at the same time? I'm trying to understand the exact process. </p>
  
  <p>Or is it more like: the packet gets copied from the NIC to both the mbuf (for host stack processing) and to the BPF pseudo-simultaneously?</p>
  
  <p>Once a packet goes through host stack processing by ip/tcp input functions taking the mbuf as the location(pointing to an mbuf) i.e. packets are stored in mbufs, if the packet is not addressed for the system, say received by monitoring traffic  via hub or SPAN/Monitor port, the packet is discarded and never makes its way up the host stack. </p>
  
  <p>I seem to have come across diagrams which show the NIC ring buffer(RX/TX) in a kernel "box"/separating it from userspace, which makes me second guess whether a ring buffer is actually allocated system memory different from the physical memory on a NIC.</p>
  
  <p>Assuming that a ring buffer refers to the NIC's physical memory, is it correct that the device driver determines the size of the NIC ring buffer, setting physical limitations aside? e.g. can I shrink the buffer by modifying the driver?</p>
  
  <p>Thanks! </p>