On 10/4/26 17:10, Stephen Hemminger wrote:
> The AF_PACKET PMD is special case really intended for monitoring
> applications, not for general use. You are probably better off using
AF_XDP
> for general use.
I agree there are cases in which AF_XDP is better, but it redirects
packets from the host stack and needs bpf()/XDP. The AF_PACKET approach
allows for passive monitoring without taking the traffic and works even
when there is already an XDP program attached or bpf() not allowed.
> The kernel does have flags to filter by direction, so you could
> avoid having it be done in the PMD.
Thanks for the hint. It made me find the PACKET_IGNORE_OUTGOING sockopt
(Linux 4.20+, fa788d986a3a). v2 drops the capture_dir=<in|out|inout> in
favor of ignore_outgoing=<0|1>.
