All of m0n0wall runs on a RAM disk as it is. The problem is that no matter how much RAM is available, the extra beyond what m0n0wall is built to use is ignored.
By the way, why cant you add, say 20MB empty buffer.raw file in image and rewrite it then? I cant understand then how do you change log size, settings and status, rules table that have varaiable size and so on? So there's only one way - to build it with 20MB extra space for capture buffer. It's more than enough If user sets a right filter. Even 5 MB is good
But Flash Card is better of course