Zerocopy bpf

[elof2 at sentor.se]

Hi!

q1)
I assume that libpcap has builtin support for checking if sysctl
net.bpf.zerocopy_enable is set to 1, and if so uses zerocopy.
Correct?

q2)
This should mean that all normal sniffing tools like tcpdump, tshark, 
ngrep, argus, etc do NOT need any specific options in order to use 
zerocopy.
Correct?

q3)
How do I see if zerocopy is used or not? 'netstat -B' don't tell me 
much, and the tool 'bpfstat' don't seem to exist any more.

q4)
When activating zerocopy, should I immediately see a performance boost on 
the machine? (like less drops on a heavily loaded sniffer NIC (running in 
monitor mode))

/Elof