the comparison started against freebsd bpf's augmentations:
"
Zero-copy buffer mode
bpf devices may also operate in the BPF_BUFMODE_ZEROCOPY mode, in which
packet data is written directly into two user memory buffers by the ker-
nel, avoiding both system call and copying overhead. Buffers are of
fixed (and equal) size, page-aligned, and an even multiple of the page
size. The maximum zero-copy buffer size is returned by the BIOCGETZMAX
ioctl. Note that an individual packet larger than the buffer size is
necessarily truncated.
"
from here the only choices are: a) that feature is out of place;
netmap is a more general approach where the optimization should take
place, and b) who's talking about grafted-on bpf enhancements? bpf is
just the vm making filtering decisions
both arguments fail on account that i only care about capturing.
netmap's site offers a bridge implementation as an example -- i would
think that's an area where netmap's offerings are more attractive
On Fri, Jul 13, 2012 at 4:43 PM, Ted Unangst <[email protected]> wrote:
> On Fri, Jul 13, 2012 at 16:06, Andres Perera wrote:
>
>> you did! you explicitly said that it would be advantageous for
>> programs looking to perform analysis on captured packets. for those
>> programs, it turns out the placement of the filter doesn't matter
>
> Sure it matters. Simple example: count packets by /24. Very simple,
> but you can't do it with bpf. You have to pull all the packets to
> userland, and bpf is kind of slow at that.
>
> Not sure why I wanted to wade into this, but nobody's going to force
> you to use netmap.
