ring buffer in freebsd (for bpf sniffing)

[Julian Elischer]

On Wed, 14 Jan 2004, John wrote:

> I've been talking with Luca Deri about a paper he wrote (
> http://luca.ntop.org/Ring.pdf). In it he says he plans to port
> this to FreeBSD. I was just wondering if anyone has looked this 
> his work. I'd help him but seeing as this is way over my perl skills
> head i though i would post over here about it. 
> 
> The code is over here.
> 
> http://prdownloads.sourceforge.net/ntop/ring-1.0.tar.gz?download
> 
> If you haven't read the paper you should. It shows how much polling
> helps bpf capturing on FreeBSD, and compares this with linux.
> The patches add code to bpf and nic drivers from the looks of it.
> _______________________________________________


We were doing this in 1992 with BSD4.3 and it was ported to FreeBSD
in 1995. (at TRW)
Not EXACTLY this, but pretty close..
It does have some downsides..
specifically the fact that the device driver wants to be changed..

It is possible that a hybrid solution would be better..

allocation of an mmappable buffer for each instance of /dev/bpf{N}
openned with a handshake protocol. The devices would be unchanged.