memory mapped packet capturing - bpf replacement ?

[Ed Maste]

Sergey Lyubka wrote:
> Discussion on -current, "read vs mmap", explained this.
> If userland process does pre-fault allocated memory, ng_mmq
> appears to be considerably faster than pcap:

Excellent!

> If I connect it directly to ng_ether, the network stack stops working.
> The question is - how to make it `transparent', so event the "lower"
> hook is connected, mbufs are still passed to upper network 
> stack layers ?
> Is it possible without additional copies like ng_tee/ng_hub do ?

Perhaps you could have two hooks, one connected to each of the 
lower and upper ng_ether hooks.  Then just copy the data into your
ringbuffer and pass the mbuf back out the other hook?

-ed