bpf, ipfw and before-and-after

[Sam Leffler]

> In article <1564916751.1060101774 at melange.errno.com>,
> Sam Leffler  <sam at errno.com> wrote:
>> > My point is that the extra calls to bpf_mtap would harm performance
>> > even when bpf wasn't being used.
>>
>> In -current I believe all the calls are prefixed with a check for
>> ifp->if_bpf or similar.  So any slow down should only happen when BPF is
>> active.
>
> That does not follow, because the check of ifp->if_bpf itself takes
> time.  There is no way to avoid the performance penalty except at
> compile time.  Yes, branch prediction helps, but it doesn't eliminate
> the problem.  Even with gigabit ethernet those individual nanoseconds
> add up quickly to the point where they matter.  With 10 Gb ethernet on
> the way, it will only get worse.

You said there were calls to bpf_mtag and they would add noticeable 
overhead even when BPF was not in use.  I said these are only made when BPF 
is in use.  What doesn't follow?

I'm not arguing about keeping up with 10Gb media...

	Sam