This is the way I see it.
A copy of the network activity is written to a buffer, and
snoop reads from the buffer. As long as snoop is able to get the data out fast enough (writing directly to a file is faster than writing to a terminal or a
bziper), then the buffer will never fill up.
But if there is a high volume of network activity, and
snoop can't write it out fast as it comes in (for whatever reason), then
snoop has to wait, therefore the original buffer gets full.
If the buffer gets large, what happens?
- In favor of maximum throughput, the buffer grows, indefinitely.
- In favor of low memory usage, some data might be excluded.
- In favor of stable results, the network I/O is bottle-necked until there is more room in the buffer.
I am particularly interested in Solaris, but information on other UNIX systems would be interesting.