On Mon, 13 Feb 2006, Tony Sterrett wrote: > I'm not sure I'd do it in that way. I'm thinking if BPF provided stateful > inspection is would be > more useful.
Asking for stateful inspection in bpf(4) is like wanting a carburettor for a pushbike. You might be able to shoehorn it in there, but it won't be pretty, will ruin its simplicity and probably won't be much use. FFPF is a different approach, and they (rightly) didn't use bpf(4) as their base implementation. Some of their ideas look pretty good, but if you are interested in pursuing them the you had probably best do it in parallel to the existing bpf(4) infrastructure. -d
