On Sat, Feb 16, 2002 at 09:33:33PM -0500, Ashley Thomas wrote: > below it is said that except linux2.4[.x] every UNIX flavored OS does a > copy from kernel to user space
Even Linux 2.4[.x] does it if you aren't using the memory-mapped packet capture mechanism; libpcap from tcpdump.org currently doesn't use it. > i read that the BPF used in *BSDs was developed to avoid this kernel-user > copy for all packets. Only the filtered packets will be copied thereby > improving performance. > > does linux2.4[x] do this better ? As I remember, the Linux 2.4[.x] memory-mapped packet capture mechanism *does* copy packets - it just does the copy to a buffer in the kernel which is also mapped into user space, so that the copy doesn't have to worry about the application copying onto a location it's not allowed to, for example. So, if you don't use a filter in the Linux 2.4[.x] capture mechanism, you're *still* going to copy more packets than you're going to look at. I.e., the filter is orthogonal to the kernel-to-user-copy vs. memory-mapped nature of the capture mechanism; 2.4[.x] doesn't do the filtering significantly better - or worse - than does BSD, as far as I know, as they both use an interpreter for the same BPF machine language. The memory-mapped capture buffer might be better than a buffer in the kernel that's copied to user space (I think the Linux mechanism is one-copy, from the skbuffs to the memory-mapped buffer, whereas the BPF mechanism involves a copy to the kernel buffer and then a copy from the kernel buffer to user space), but the filtering is irrelevant to whether it's better. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
