On Thu, Aug 22, 2013 at 12:17 PM, Daniel Borkmann <[email protected]>wrote:
> On 08/22/2013 07:10 PM, Jon Schipp wrote: > >> Are BPF filters compiled for each packet that reaches a filter? >> I assumed they were compiled once and then applied until the sniffing >> application process ends. >> > > BPF filters are attached to the kernel's socket representation. If no JIT > is > active, the instructions you have passed from user-space are run inside a > minimal "virtual machine". If you use the kernel's JIT compiler, then arch > specific opcodes are emitted at the time the filter is being attached to > the > socket (so only done once), and the kernel jumps to the JIT image instead > of > running the interpreter for each packet. Ah, the performance increase with JIT is due to the arch specific instructions over the interpreted instructions. When the application ends, the socket > is destroyed, therefore also the JIT image attached to your socket. > > BPF filters are used in various code, sec-comp, PTP, packet&raw sockets > and so > on. When you have pf_packet sockets then the packet is forwarded to each > protocol > handler and the filter is being run there. > > "A simple benchmark > <https://lwn.net/Articles/**437986/<https://lwn.net/Articles/437986/>> >> shows a 50ns savings >> >> for each invocation of a simple filter - that may seem small, but, when >> multiplied by the number of packets going through a system, that >> difference >> can add up quickly." [1] >> >> [1] https://lwn.net/Articles/**437981/ <https://lwn.net/Articles/437981/> >> > > -- Jon Schipp, jonschipp.com, sickbits.net -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
