research: is there a reason to set rx-buffers not to its maximum?

[strizhechenko]

In case of (real) forwarding or receiving traffic for local application it's bad idea, because of latency. Question is about the case of just receiving mirror copy of traffic for analyze.

[vincentbernat]

Yes, latency. Increasing buffers at every level leads to buffer bloat which heavily impacts latency. Small buffers are enough to catch short bursts while letting higher level protocols (eg TCP) handle congestion gracefully.

See: https://www.bufferbloat.net/projects/bloat/wiki/Introduction/

[strizhechenko]

Hi @vincentbernat. Thank you for the link. I added few details about this issue, you absolutely right in cases of just forwarding/receiving traffic into an application.