From owner-freebsd-net@FreeBSD.ORG Wed Jan 14 16:01:08 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 01DAE16A4CE for ; Wed, 14 Jan 2004 16:01:08 -0800 (PST) Received: from rwcrmhc12.comcast.net (rwcrmhc12.comcast.net [216.148.227.85]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0262143D6B for ; Wed, 14 Jan 2004 16:01:05 -0800 (PST) (envelope-from julian@elischer.org) Received: from interjet.elischer.org ([24.7.73.28]) by comcast.net (rwcrmhc12) with ESMTP id <2004011500010401400pnmtee>; Thu, 15 Jan 2004 00:01:04 +0000 Received: from localhost (localhost.elischer.org [127.0.0.1]) by InterJet.elischer.org (8.9.1a/8.9.1) with ESMTP id QAA16077; Wed, 14 Jan 2004 16:01:03 -0800 (PST) Date: Wed, 14 Jan 2004 16:01:01 -0800 (PST) From: Julian Elischer To: John In-Reply-To: <20040114235719.GA20586@mail.unixjunkie.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-net@freebsd.org Subject: Re: ring buffer in freebsd (for bpf sniffing) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jan 2004 00:01:08 -0000 On Wed, 14 Jan 2004, John wrote: > I've been talking with Luca Deri about a paper he wrote ( > http://luca.ntop.org/Ring.pdf). In it he says he plans to port > this to FreeBSD. I was just wondering if anyone has looked this > his work. I'd help him but seeing as this is way over my perl skills > head i though i would post over here about it. > > The code is over here. > > http://prdownloads.sourceforge.net/ntop/ring-1.0.tar.gz?download > > If you haven't read the paper you should. It shows how much polling > helps bpf capturing on FreeBSD, and compares this with linux. > The patches add code to bpf and nic drivers from the looks of it. > _______________________________________________ We were doing this in 1992 with BSD4.3 and it was ported to FreeBSD in 1995. (at TRW) Not EXACTLY this, but pretty close.. It does have some downsides.. specifically the fact that the device driver wants to be changed.. It is possible that a hybrid solution would be better.. allocation of an mmappable buffer for each instance of /dev/bpf{N} openned with a handshake protocol. The devices would be unchanged.