Nadav Har'El wrote:
>
> However, it appears that Linux provides an in-kernel BFP-like feature called
> "Linux Socket Filter" [3], that is included in modern kernels (e.g., it
> is included in Redhat 7, but probably in earlier distributions too), which
> seems perfect for my needs. But searching around, it seems that nobody is
> actually using it... Does anybody know why? Also why didn't the libpcap people
> use LSF on Linux, instead of their inefficient user-space solution? Is there
> something wrong with LSF? I'd love to hear from anybody with any experience
> in LSF.
Although I have never used LSF, I can assume the reasons may be the
following:
1) Linux only non portable solution.
2) For most typical networking solutions I can think of you'd prefer to
either use raw sockets and do the matching yourself (for a small enough
amount of data) or write a kernel module that does all the processing
you want done at all (for large amount of data) and LSF falls somewhere
in the middle which means most people will go to either extreme.
I don't know what is your application and therefor cannot recommend
either path, but you might want to consider the previously mentioned
options as a replacement along with LSF.
Gilad.
PS. One more options for the reason avoid LSF is that when spell check
this reply using Netscape6 the spellchecker kept suggesting I should
replace LSF with either NFS or LSD, both known to cause permanant brain
damage to users... ;-))
--
Gilad Ben-Yossef <[EMAIL PROTECTED]>
http://benyossef.com :: +972(54)756701
"Anything that can go wrong, will go wrong, while interrupts are disabled. "
-- Murphey's law of kernel programing.
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
