From owner-freebsd-net@FreeBSD.ORG Wed Jul 4 15:16:30 2012 Return-Path: Delivered-To: net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 311C8106564A; Wed, 4 Jul 2012 15:16:30 +0000 (UTC) (envelope-from vladimir.budnev@gmail.com) Received: from mail-lb0-f182.google.com (mail-lb0-f182.google.com [209.85.217.182]) by mx1.freebsd.org (Postfix) with ESMTP id 6E9B58FC14; Wed, 4 Jul 2012 15:16:29 +0000 (UTC) Received: by lbon10 with SMTP id n10so13246680lbo.13 for ; Wed, 04 Jul 2012 08:16:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; bh=6xICex31CiVssPBm597AffrlL05oER7XB3R4IwrzIpA=; b=rNo0tR07htORx+KyUpbT4Yxzwb3eRyqlvycRdgqhanIvkDSBSRz9UbsLfHEed/+Bjp iDL3bM0dsEF0Zhk3o73faYbprzV6rDw7Sh+n8pnvDkjpoMZNZkD5J0++t7yS3EfoWNK5 r9GeTXN1iNsai1HXaOUPATY3e/UthAsi2QnUQ2sZWHBdZ94n5/DmpajfNDPc0hX3lI91 /BsybpwVHOcYxmszJWy4v5R0Ql97n0a3wz8TTRifHIM8fJrmKEaO2vT4WoeDPqKKewnq Ed2FYI5qXJ1NxZHwI7LxtPt8mLgzjHnNIsCmcFRMcSRJL00zgUzIVd2jP25HJPME1sUB ChqA== Received: by 10.112.23.42 with SMTP id j10mr10172783lbf.20.1341414534704; Wed, 04 Jul 2012 08:08:54 -0700 (PDT) Received: from [192.168.66.106] ([80.253.27.98]) by mx.google.com with ESMTPS id s3sm13658537lbk.11.2012.07.04.08.08.51 (version=SSLv3 cipher=OTHER); Wed, 04 Jul 2012 08:08:52 -0700 (PDT) Message-ID: <4FF45C81.3030907@gmail.com> Date: Wed, 04 Jul 2012 19:08:49 +0400 From: Budnev Vladimir User-Agent: Mozilla/5.0 (X11; Linux i686; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 MIME-Version: 1.0 To: freebsd-questions@freebsd.org, net@freebsd.org Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: Subject: how to correctly distinguish broadcast udp packets vs unicast (socket, pcap or bpf)? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Jul 2012 15:16:30 -0000 Good day to all. What is the correct way to distinguish udp packets that obtained by application and were send on 255.255.255.255 ip addr from those that were send to unicast ip? Seems it is impossible with read/recvfrom so we'v made that with libpcap. It coul be done with directly bpf api without pcap wrapper but i'm not sure about how big pcap overhead is. The questions is if we have about 1Gb incoming traffic and using pcap filter for specific port how big is impact of using pcap in such situation? Is it possbile to estimate? Target traffic is about 1Mbit and while testing CPU is about 1-2% but i'm not sure about all the conditions. recfrom recieves all the data without loss in such condition, is it possible that pcap because of its filtering nature(i dont know in details how bpf is realized deep in kernel:( ) will add big overhead while listening?