how to correctly distinguish broadcast udp packets vs unicast
(socket, pcap or bpf)?
vladimir.budnev at gmail.com
Wed Jul 4 15:16:30 UTC 2012
Good day to all.
What is the correct way to distinguish udp packets that obtained by
application and were send on 255.255.255.255 ip addr from those that
were send to unicast ip?
Seems it is impossible with read/recvfrom so we'v made that with
libpcap. It coul be done with directly bpf api without pcap wrapper but
i'm not sure about how big pcap overhead is.
The questions is if we have about 1Gb incoming traffic and using pcap
filter for specific port how big is impact of using pcap in such
situation? Is it possbile to estimate? Target traffic is about 1Mbit and
while testing CPU is about 1-2% but i'm not sure about all the conditions.
recfrom recieves all the data without loss in such condition, is it
possible that pcap because of its filtering nature(i dont know in
details how bpf is realized deep in kernel:( ) will add big overhead
More information about the freebsd-questions