Date: Mon, 21 Jun 2004 11:29:19 -0400 From: Ed Maste <emaste@sandvine.com> To: freebsd-hackers@freebsd.org Subject: RE: memory mapped packet capturing - bpf replacement ? Message-ID: <FE045D4D9F7AED4CBFF1B3B813C8533701BD40ED@mail.sandvine.com>
next in thread | raw e-mail | index | archive | help
Sergey Lyubka wrote: > Discussion on -current, "read vs mmap", explained this. > If userland process does pre-fault allocated memory, ng_mmq > appears to be considerably faster than pcap: Excellent! > If I connect it directly to ng_ether, the network stack stops working. > The question is - how to make it `transparent', so event the "lower" > hook is connected, mbufs are still passed to upper network > stack layers ? > Is it possible without additional copies like ng_tee/ng_hub do ? Perhaps you could have two hooks, one connected to each of the lower and upper ng_ether hooks. Then just copy the data into your ringbuffer and pass the mbuf back out the other hook? -ed
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FE045D4D9F7AED4CBFF1B3B813C8533701BD40ED>