for clients (processes) that need to do trivial filtering, e.g., tcpdump 'ether multicast and not broadcast', it's an overhaul for nothing
the placement of the filtering stack in the kernel is completely irrelevant to "how simple" it will end up. if you come up with a sbin/bpfd it will still have to do locking between clients, and present a higher level subset to be of any use i don't expect *every* application to manage the rx/tx rings directly, reinject when they're done to actual uses of userland packet capture, this whole situation resembles "wayland is not an x replacement, it just does compositing" On Fri, Jul 13, 2012 at 3:24 PM, Chris Cappuccio <ch...@nmedia.net> wrote: > Andres Perera [andre...@zoho.com] wrote: >> >> so i should move the whole filtering stack to userland... seems like a >> needless work for simple packet capture > > And I completely disagree. > > You think what the kernel does now is simple ?
