From owner-freebsd-hackers@FreeBSD.ORG Mon Jun 21 15:29:36 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9709716A4CE for ; Mon, 21 Jun 2004 15:29:36 +0000 (GMT) Received: from mail.sandvine.com (sandvine.com [199.243.201.138]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2A76D43D54 for ; Mon, 21 Jun 2004 15:29:36 +0000 (GMT) (envelope-from emaste@sandvine.com) Received: by mail.sandvine.com with Internet Mail Service (5.5.2657.72) id ; Mon, 21 Jun 2004 11:29:21 -0400 Message-ID: From: Ed Maste To: freebsd-hackers@freebsd.org Date: Mon, 21 Jun 2004 11:29:19 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain; charset="iso-8859-1" Subject: RE: memory mapped packet capturing - bpf replacement ? X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Jun 2004 15:29:36 -0000 Sergey Lyubka wrote: > Discussion on -current, "read vs mmap", explained this. > If userland process does pre-fault allocated memory, ng_mmq > appears to be considerably faster than pcap: Excellent! > If I connect it directly to ng_ether, the network stack stops working. > The question is - how to make it `transparent', so event the "lower" > hook is connected, mbufs are still passed to upper network > stack layers ? > Is it possible without additional copies like ng_tee/ng_hub do ? Perhaps you could have two hooks, one connected to each of the lower and upper ng_ether hooks. Then just copy the data into your ringbuffer and pass the mbuf back out the other hook? -ed