Behaviour under overload

We cannot control incoming packet rate, so we must consider the occurrence of overloads.

At the input level, we rely on FreeBSD's polling to prevent livelock (work done at ICSI as part of the Xorp Project).

large amount of buffering between the subsystems is provided to deal with short term overload;

queue buildup in the intermediate buffers is used as a hint of impending CPU overload, and used to selectively shut down some modules/classifiers depending on their [configured] importance and [computed] CPU usage;

disk I/O is managed entirely by the I/O subsystem, which can schedule requests to prevent external queries from starving the real-time capture activity;