On Fri, Jul 13, 2012 at 11:59 AM, Chris Cappuccio <ch...@nmedia.net> wrote: > But having a generic mechanism to bring network data in/out userland for analysis or manipulation, abstracted in a secure way from the kernel across multiple network card types, and "zero copy", could be very useful. The typical response to this is "well just make the slow parts of the kernel more efficient and you won't need to do this" but, especially for pcap-type applications, I think netmap _is_ the solution.
talking about userland capture exclusively: is there a comparison against freebsd bpf zero copy? how is better than bpf overall? i ask because there's been a considerable amount of work put into bpf compilers so it's replacement better justify the time spent optimizing it's predecessor
