memory mapped packet capturing - bpf replacement ?
emaste at sandvine.com
Mon Jun 21 08:29:36 PDT 2004
Sergey Lyubka wrote:
> Discussion on -current, "read vs mmap", explained this.
> If userland process does pre-fault allocated memory, ng_mmq
> appears to be considerably faster than pcap:
> If I connect it directly to ng_ether, the network stack stops working.
> The question is - how to make it `transparent', so event the "lower"
> hook is connected, mbufs are still passed to upper network
> stack layers ?
> Is it possible without additional copies like ng_tee/ng_hub do ?
Perhaps you could have two hooks, one connected to each of the
lower and upper ng_ether hooks. Then just copy the data into your
ringbuffer and pass the mbuf back out the other hook?
More information about the freebsd-hackers