Hi, I have been using libpcap 0.4 which comes packed with RH6.2. I'll be migrating to libpcap 0.6, soon. The changelog says that Linux implementation of libpcap now uses PF_PACKET sockets and the filtering itself is done in the kernel. So am I correct in assuming that in 0.4, the filtering in linux was actually done in userland (even though the timestamping was done at the time packet appears on the wire) ?
And so with the kernel filtering, will applications running libpcap 0.6 on Linux, perform perceptibly better (assuming high packet traffic rate, longer per-packet processing time and a CPU starved linux 6.2, which causes the packet drops currently with libpcap 0.4) ? Is there any reason why upgrading to 0.7 may be a better idea instead ? (The changelog for 0.7 didnt show anything which my application cares about.) Thanks for your suggestions, Joe __________________________________________________ Do You Yahoo!? Try FREE Yahoo! Mail - the world's greatest free email! http://mail.yahoo.com/ - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
