On 08/22/2013 07:10 PM, Jon Schipp wrote:
Are BPF filters compiled for each packet that reaches a filter? I assumed they were compiled once and then applied until the sniffing application process ends.
BPF filters are attached to the kernel's socket representation. If no JIT is active, the instructions you have passed from user-space are run inside a minimal "virtual machine". If you use the kernel's JIT compiler, then arch specific opcodes are emitted at the time the filter is being attached to the socket (so only done once), and the kernel jumps to the JIT image instead of running the interpreter for each packet. When the application ends, the socket is destroyed, therefore also the JIT image attached to your socket. BPF filters are used in various code, sec-comp, PTP, packet&raw sockets and so on. When you have pf_packet sockets then the packet is forwarded to each protocol handler and the filter is being run there.
"A simple benchmark <https://lwn.net/Articles/437986/> shows a 50ns savings for each invocation of a simple filter - that may seem small, but, when multiplied by the number of packets going through a system, that difference can add up quickly." [1] [1] https://lwn.net/Articles/437981/
-- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
