Solaris/UNIX: Does snoop have the potential to slow down network traffic?

view full story

http://serverfault.com – This is the way I see it. A copy of the network activity is written to a buffer, and snoop reads from the buffer. As long as snoop is able to get the data out fast enough (writing directly to a file is faster than writing to a terminal or a bziper), then the buffer will never fill up. But if there is a high volume of network activity, and snoop can't write it out fast as it comes in (for whatever reason), then snoop has to wait, therefore the original buffer gets full. If the buffer gets large, what happens? In favor of maximum throughput, the buffer grows, indefinitely. :-/ In favor of l (HowTos)