Re: PF or BPF

2006-02-15 Thread Diana Eichert
On Tue, 14 Feb 2006, Otto Moerbeek wrote: SNIP Something like: Even a thread started by Dave might eventually--if the topic has sufficiently departed from the original subject--lead to a (small) improvement to OpenBSD? -Otto Exactly!

Re: xargs PF or BPF

2006-02-14 Thread Michael Schmidt
Matthias Kilian wrote: And watch out for silly file names containing whitespace. BTW: if this is a contest on creative use of find(1) and other standard tools: $ find . -type f | sed '[EMAIL PROTECTED]@grep -l -- foo @' | sh Yes, this isn't robust against whitespace, either PLUS it's

Re: xargs PF or BPF

2006-02-14 Thread Otto Moerbeek
On Tue, 14 Feb 2006, Michael Schmidt wrote: Matthias Kilian wrote: And watch out for silly file names containing whitespace. BTW: if this is a contest on creative use of find(1) and other standard tools: $ find . -type f | sed '[EMAIL PROTECTED]@grep -l -- foo @' | sh Yes,

Re: xargs PF or BPF

2006-02-14 Thread Ray Lai
On Tue, Feb 14, 2006 at 11:39:45AM +0100, Otto Moerbeek wrote: On Tue, 14 Feb 2006, Michael Schmidt wrote: Matthias Kilian wrote: And watch out for silly file names containing whitespace. BTW: if this is a contest on creative use of find(1) and other standard tools: $

Re: xargs PF or BPF

2006-02-14 Thread Otto Moerbeek
On Tue, 14 Feb 2006, Ray Lai wrote: On Tue, Feb 14, 2006 at 11:39:45AM +0100, Otto Moerbeek wrote: On Tue, 14 Feb 2006, Michael Schmidt wrote: Matthias Kilian wrote: And watch out for silly file names containing whitespace. BTW: if this is a contest on creative use of

Re: PF or BPF

2006-02-14 Thread Diana Eichert
I was thinking there should have been something in the commit message about Dave contributing to this fix. The entire xargs discussion wouldn't have occurred if I hadn't used find in my reply to Dave regarding PF or BPF. http://marc.theaimsgroup.com/?l=openbsd-cvsm=113991945111836w=2 Log message

Re: PF or BPF

2006-02-14 Thread Miod Vallat
I was thinking there should have been something in the commit message about Dave contributing to this fix. The entire xargs discussion wouldn't have occurred if I hadn't used find in my reply to Dave regarding PF or BPF. Something like ``please do not feed the Feustel again''? Miod

Re: PF or BPF

2006-02-14 Thread Otto Moerbeek
On Tue, 14 Feb 2006, Diana Eichert wrote: I was thinking there should have been something in the commit message about Dave contributing to this fix. The entire xargs discussion wouldn't have occurred if I hadn't used find in my reply to Dave regarding PF or BPF. http

Re: PF or BPF

2006-02-14 Thread Otto Moerbeek
On Tue, 14 Feb 2006, Tony Sterrett wrote: I'm not sure I'd do it in that way. I'm thinking if BPF provided stateful inspection is would be more useful. Asking for stateful inspection in bpf(4) is like wanting a carburettor for a pushbike. You might be able to shoehorn it in there,

Re: PF or BPF

2006-02-13 Thread Ted Unangst
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What can BPF do that PF can not? different things.

Re: PF or BPF

2006-02-13 Thread Dave Feustel
On Monday 13 February 2006 12:45, Ted Unangst wrote: On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What can BPF do that PF can not? different things. OK, I'll bite. Such as? (this might be a loong, drawnout thread, but I've got time :-)) -- Lose, v., experience a loss, get rid

Re: PF or BPF

2006-02-13 Thread Greg Thomas
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What can BPF do that PF can not? Your questions keep getting better and better. Just curious as to whether you've heard of Google? 1. Make an /etc/bpf.conf and see what happens. Oh, wait, I don't see a reference to a config file in man bpf

Re: PF or BPF

2006-02-13 Thread Ted Unangst
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: On Monday 13 February 2006 12:45, Ted Unangst wrote: On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What can BPF do that PF can not? different things. OK, I'll bite. Such as? no, if you can't read a man page, you aren't qualified

Re: PF or BPF

2006-02-13 Thread Jon Simola
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: On Monday 13 February 2006 12:45, Ted Unangst wrote: On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What can BPF do that PF can not? different things. OK, I'll bite. Such as? (this might be a loong, drawnout thread, but I've got

Re: PF or BPF

2006-02-13 Thread Joe S
Dave Feustel wrote: What can BPF do that PF can not? Thanks, Dave Feustel One is a packet sniffer, one is a firewall. However, you are not qualified to operate such tools. Please disconnect your keyboard from your PC.

Re: PF or BPF

2006-02-13 Thread Stuart Henderson
On 2006/02/13 13:00, Dave Feustel wrote: On Monday 13 February 2006 12:45, Ted Unangst wrote: On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What can BPF do that PF can not? different things. OK, I'll bite. Such as? (this might be a loong, drawnout thread, but I've got time

Re: PF or BPF

2006-02-13 Thread Dave Feustel
before? Dereck, Thanks for the support. However, my situation is not desparate. By refusing to answer a question to which he indicated he had an answer, Ted has left all of us hanging as to whether he *really* knows what the differences are between the capabilities of pf and bpf. *I* could

Re: PF or BPF

2006-02-13 Thread Greg Thomas
the capabilities of pf and bpf. You're a complete tool. If I said what Ted said then that would be possible. I think everyone here realizes that Ted knows the differences. *I* could certainly not testify that Ted actually knows the answer to that question as he claims to. :-) (BTW, I had

Re: PF or BPF

2006-02-13 Thread dereck
] wrote: On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: On Monday 13 February 2006 12:45, Ted Unangst wrote: On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What can BPF do that PF can not? different things. OK, I'll bite. Such as? no, if you can't read a man page, you

Re: PF or BPF

2006-02-13 Thread Jason Crawford
are between the capabilities of pf and bpf. *I* could certainly not testify that Ted actually knows the answer to that question as he claims to. :-) If he can code rthreads, I think it's pretty safe to say he understands the differences between bpf and pf, those seem like some really

Re: PF or BPF

2006-02-13 Thread Dave Feustel
On Monday 13 February 2006 14:52, Jason Crawford wrote: You cannot learn all there is to know about bpf and how to effectively use it in 10 minutes, so you, personally, do NOT need to use bpf at all. It's what the other utilities like pf and tcpdump use to do what they do. The utilities are

Re: PF or BPF

2006-02-13 Thread Ted Unangst
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What OpenBSD programs use bpf. tcpdump.

Re: PF or BPF

2006-02-13 Thread Josh Grosse
On Mon, Feb 13, 2006 at 03:29:09PM -0500, Dave Feustel wrote: So let's try a r e a l s i m p l e q u e s t i o n : What OpenBSD programs use bpf. I used this command, Dave: find /usr/src -name *.c -exec grep bpf {} /dev/null \; And discovered this list: libpcap

Re: PF or BPF

2006-02-13 Thread Aaron Glenn
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: Well, one thing is for certain, the caustic responders to this thread aren't psychic. So let's try a r e a l s i m p l e q u e s t i o n : What OpenBSD programs use bpf. Please don't try to figure out why I am asking the question.

Re: PF or BPF

2006-02-13 Thread Otto Moerbeek
On Mon, 13 Feb 2006, Ted Unangst wrote: On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What OpenBSD programs use bpf. tcpdump. And there's more: $ cd /usr/src $ grep -lr bpf.h bin sbin usr.bin usr.sbin libexec will give you a nice list. -Otto

Re: PF or BPF

2006-02-13 Thread Jason Crawford
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: On Monday 13 February 2006 14:52, Jason Crawford wrote: You cannot learn all there is to know about bpf and how to effectively use it in 10 minutes, so you, personally, do NOT need to use bpf at all. It's what the other utilities like pf and

Re: PF or BPF

2006-02-13 Thread Diana Eichert
On 2/13/06, Dave Feustel [EMAIL PROTECTED] wrote: What OpenBSD programs use bpf. Oh c'mon Dave, use the tools that are given to you. find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \; will find files that include references to bpf. Your comments re: Ted are sad. I can't believe

Re: PF or BPF

2006-02-13 Thread Diana Eichert
On Mon, 13 Feb 2006, Matthias Kilian wrote: On Mon, Feb 13, 2006 at 02:03:27PM -0700, Diana Eichert wrote: find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \; ^(a) ^(b) (a) I doubt there are any file names ending in a pipe symbol in /usr/src. (b)

Re: PF or BPF

2006-02-13 Thread Jason Crawford
On 2/13/06, Matthias Kilian [EMAIL PROTECTED] wrote: On Mon, Feb 13, 2006 at 02:03:27PM -0700, Diana Eichert wrote: find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \; ^(a) ^(b) (a) I doubt there are any file names ending in a pipe symbol in

Re: PF or BPF

2006-02-13 Thread Stuart Henderson
On 2006/02/13 16:53, Jason Crawford wrote: On 2/13/06, Matthias Kilian [EMAIL PROTECTED] wrote: On Mon, Feb 13, 2006 at 02:03:27PM -0700, Diana Eichert wrote: find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \; ^(a) ^(b) (a) I doubt there are

Re: PF or BPF

2006-02-13 Thread Diana Eichert
On Mon, 13 Feb 2006, Stuart Henderson wrote: (a) I doubt there are any file names ending in a pipe symbol in /usr/src. man ksh it's in quotes, this is handled by find, not the shell. (b) pipeing to xargs(1) may be faster. why? grep foo 1 2 3 4 5 6 7 ... vs. grep foo 1 grep foo

Re: PF or BPF

2006-02-13 Thread Greg Thomas
On 2/13/06, Stuart Henderson [EMAIL PROTECTED] wrote: On 2006/02/13 16:53, Jason Crawford wrote: On 2/13/06, Matthias Kilian [EMAIL PROTECTED] wrote: On Mon, Feb 13, 2006 at 02:03:27PM -0700, Diana Eichert wrote: find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \;

Re: PF or BPF

2006-02-13 Thread Luke Bakken
find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \; ^(a) ^(b) (a) I doubt there are any file names ending in a pipe symbol in /usr/src. man ksh The point being made is that '*.[ch]' is what you want. | does not mean or in a character class in

Re: PF or BPF

2006-02-13 Thread Jason Crawford
On 2/13/06, Stuart Henderson [EMAIL PROTECTED] wrote: On 2006/02/13 16:53, Jason Crawford wrote: On 2/13/06, Matthias Kilian [EMAIL PROTECTED] wrote: On Mon, Feb 13, 2006 at 02:03:27PM -0700, Diana Eichert wrote: find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \;

Re: PF or BPF

2006-02-13 Thread Diana Eichert
On Mon, 13 Feb 2006, Greg Thomas wrote: SNIP (b) pipeing to xargs(1) may be faster. why? grep foo 1 2 3 4 5 6 7 ... vs. grep foo 1 grep foo 2 grep foo 3 grep foo 4 grep foo 5 grep foo 6 grep foo 7 One of the nice things about misc is that even if a discussion

Re: xargs PF or BPF

2006-02-13 Thread Tim Donahue
On Monday 13 February 2006 17:13, Stuart Henderson wrote: On 2006/02/13 16:53, Jason Crawford wrote: On 2/13/06, Matthias Kilian [EMAIL PROTECTED] wrote: On Mon, Feb 13, 2006 at 02:03:27PM -0700, Diana Eichert wrote: find /usr/src -name *.[c|h] -exec grep 'bpf.h' /dev/null {} \; it's

Re: PF or BPF

2006-02-13 Thread Ray Lai
On Mon, Feb 13, 2006 at 05:28:22PM -0500, Jason Crawford wrote: Well in the case of /usr/src, I think you must MIGHT hit the maximum argument length for the shell by using xargs, unless you did it inside of each directory in /usr/src. That and well, explaining xargs to Dave will end up leading

Re: xargs PF or BPF

2006-02-13 Thread Martin Schröder
On 2006-02-13 18:10:53 -0500, Tim Donahue wrote: As done by xargs? grep foo 1 grep foo 2 grep foo 3 quote src=xargs(1) Any arguments specified on the command line are given to the utility upon each invocation, followed by some number of the arguments read from stan- dard

Re: PF or BPF

2006-02-13 Thread Stuart Henderson
On 2006/02/13 17:28, Jason Crawford wrote: Well in the case of /usr/src, I think you must MIGHT hit the maximum argument length for the shell by using xargs I haven't seen xargs do the wrong thing here. Embedded spaces annoy, but that's what -print0 (to find) and -0 (to xargs) are for. I almost

Re: PF or BPF

2006-02-13 Thread Marco Peereboom
BPF do that PF can not? different things. OK, I'll bite. Such as? (this might be a loong, drawnout thread, but I've got time :-)) -- Lose, v., experience a loss, get rid of, lose the weight Loose, adj., not tight, let go, free, loose clothing

Re: PF or BPF

2006-02-13 Thread Tony Sterrett
know about state which PF does. BPF is used (or can be used ) on a lot of systems but its is a BSD Native as the named indicates. There has been some research on adding state and performance enhancement in projects named BPF+ and DBPF. I'm looking at the tradeoff of porting bpf

Re: PF or BPF

2006-02-13 Thread Ted Unangst
On 2/13/06, Tony Sterrett [EMAIL PROTECTED] wrote: I'm looking at the tradeoff of porting bpf with states from linux to OpenBSD from linux. Daniel Hartmeier in Design and Performance of the OpenBSD Stateful Packet Filter (pf) says that pf is more efficient than bpf, so it may be pointless.

Re: PF or BPF

2006-02-13 Thread Dave Feustel
On Monday 13 February 2006 19:36, Marco Peereboom wrote: Time for you to start using Linux, Windows or OSX. OpenBSD is clearly not fulfilling your needs Your psychic abilities are failing you again. and the lists are unfriendly. So What? http://www.oxide.org/cvs/tedu.html Commit

Re: PF or BPF

2006-02-13 Thread Steve Shockley
dereck wrote: The responses here are totally out of line. So was his last comment in http://groups.google.com/group/lucky.openbsd.misc/msg/942c4c6d5bc26fca

Re: PF or BPF

2006-02-13 Thread Dave Feustel
Marco, I would like to add that I appreciate the work you and the rest of the crew are doing to develop OpenBSD. On Monday 13 February 2006 19:36, Marco Peereboom wrote: http://www.oxide.org/cvs/tedu.html Commit Statistics: Total: 864 src: 834 (96.528%) ports: 6 (0.694%) www: 24

Re: PF or BPF

2006-02-13 Thread Shane J Pearson
Hi Dave, On 2006.02.14, at 12:53 PM, Dave Feustel wrote: Marco, I would like to add that I appreciate the work you and the rest of the crew are doing to develop OpenBSD. It might be best in the future to first outline what you've done to research your questions and then ask the question.

Re: xargs PF or BPF

2006-02-13 Thread Damien Miller
On Tue, 14 Feb 2006, noob lenoobie wrote: On Mon, 13 Feb 2006, Matthias Kilian wrote: (b) pipeing to xargs(1) may be faster. Why so many people is using xargs ? I mean for instance why bother use xargs AND a pipe to do somthing like this : find ./ -type f -print | xargs -i rm -f

Re: PF or BPF

2006-02-13 Thread Damien Miller
On Mon, 13 Feb 2006, Dave Feustel wrote: Marco, I would like to add that I appreciate the work you and the rest of the crew are doing to develop OpenBSD. Please show your appreciation by educating yourself using the available manpages (which represent a huge amount of work) before asking

Re: xargs PF or BPF

2006-02-13 Thread Andrew Pinski
On Feb 13, 2006, at 9:24 PM, Damien Miller wrote: Because that will fail when there are too many arguments, and will probably break on filenames with spaces (use xargs -0 for these). Why not use -exec in find? find . -type f -name ttt -exec rm {}\; -- Pinski

Re: xargs PF or BPF

2006-02-13 Thread Ted Unangst
On 2/13/06, Damien Miller [EMAIL PROTECTED] wrote: Why so many people is using xargs ? I mean for instance why bother use xargs AND a pipe to do somthing like this : find ./ -type f -print | xargs -i rm -f Instead of rm -f $(find ./ -type f -print) Because that will fail when

Re: PF or BPF

2006-02-13 Thread Dave Feustel
On Monday 13 February 2006 21:25, Damien Miller wrote: On Mon, 13 Feb 2006, Dave Feustel wrote: Marco, I would like to add that I appreciate the work you and the rest of the crew are doing to develop OpenBSD. Please show your appreciation by educating yourself using the available

Re: PF or BPF

2006-02-13 Thread Jason Crawford
On 2/13/06, Stuart Henderson [EMAIL PROTECTED] wrote: On 2006/02/13 17:28, Jason Crawford wrote: Well in the case of /usr/src, I think you must MIGHT hit the maximum argument length for the shell by using xargs I haven't seen xargs do the wrong thing here. Embedded spaces annoy, but that's

Re: xargs PF or BPF

2006-02-13 Thread Andrew Pinski
On Feb 13, 2006, at 9:53 PM, Jason Crawford wrote: On 2/13/06, Andrew Pinski [EMAIL PROTECTED] wrote: On Feb 13, 2006, at 9:24 PM, Damien Miller wrote: Because that will fail when there are too many arguments, and will probably break on filenames with spaces (use xargs -0 for these). Why

Re: xargs PF or BPF

2006-02-13 Thread Jason Crawford
On 2/13/06, Andrew Pinski [EMAIL PROTECTED] wrote: On Feb 13, 2006, at 9:24 PM, Damien Miller wrote: Because that will fail when there are too many arguments, and will probably break on filenames with spaces (use xargs -0 for these). Why not use -exec in find? find . -type f -name ttt

Re: xargs PF or BPF

2006-02-13 Thread Jason Crawford
On 2/13/06, Andrew Pinski [EMAIL PROTECTED] wrote: On Feb 13, 2006, at 9:53 PM, Jason Crawford wrote: On 2/13/06, Andrew Pinski [EMAIL PROTECTED] wrote: On Feb 13, 2006, at 9:24 PM, Damien Miller wrote: Because that will fail when there are too many arguments, and will probably break on

Re: xargs PF or BPF

2006-02-13 Thread Damien Miller
On Mon, 13 Feb 2006, Andrew Pinski wrote: On Feb 13, 2006, at 9:24 PM, Damien Miller wrote: Because that will fail when there are too many arguments, and will probably break on filenames with spaces (use xargs -0 for these). Why not use -exec in find? find . -type f -name ttt -exec

Re: xargs PF or BPF

2006-02-13 Thread Andrew Pinski
On Feb 13, 2006, at 10:00 PM, Jason Crawford wrote: Time to write your own program in C instead if the time to invoke rm is taking too much time. No point, xargs does what I need it to do, and is much more efficient than having find execute rm itself. The fewer times you call execve(2) the

Re: xargs PF or BPF

2006-02-13 Thread Damien Miller
On Mon, 13 Feb 2006, Andrew Pinski wrote: Time to write your own program in C instead if the time to invoke rm is taking too much time. rm *is* a small program written in C. You need to consider how the tools actually invoke it - think about it for a while. -d

Re: PF or BPF

2006-02-13 Thread Diana Eichert
On Mon, 13 Feb 2006, Jason Crawford wrote: SNIP He couldn't even figure out how to find the applications that use bpf, so I think figuring out all the features in a utility might be out of his grasp... Jason hence my original suggestion, minus my | miscue of course.

Re: PF or BPF

2006-02-13 Thread Tony Sterrett
On Feb 13, 2006, at 5:16 PM, Ted Unangst wrote: On 2/13/06, Tony Sterrett [EMAIL PROTECTED] wrote: I'm looking at the tradeoff of porting bpf with states from linux to OpenBSD from linux. Daniel Hartmeier in Design and Performance of the OpenBSD Stateful Packet Filter (pf) says that pf is

Re: xargs PF or BPF

2006-02-13 Thread Matthias Kilian
On Mon, Feb 13, 2006 at 06:32:53PM -0800, Ted Unangst wrote: find ./ -type f -print | xargs -i rm -f Instead of rm -f $(find ./ -type f -print) Because that will fail when there are too many arguments, and will probably break on filenames with spaces (use xargs -0 for these).

Re: PF or BPF

2006-02-13 Thread Damien Miller
On Mon, 13 Feb 2006, Tony Sterrett wrote: I'm not sure I'd do it in that way. I'm thinking if BPF provided stateful inspection is would be more useful. Asking for stateful inspection in bpf(4) is like wanting a carburettor for a pushbike. You might be able to shoehorn it in there, but it