On Fri, Jul 13, 2012 at 17:56, Geoff Steckel wrote: > On 07/13/2012 05:13 PM, Ted Unangst wrote: >> On Fri, Jul 13, 2012 at 16:06, Andres Perera wrote: >> >>> you did! you explicitly said that it would be advantageous for >>> programs looking to perform analysis on captured packets. for those >>> programs, it turns out the placement of the filter doesn't matter >> Sure it matters. Simple example: count packets by /24. Very simple, >> but you can't do it with bpf. You have to pull all the packets to >> userland, and bpf is kind of slow at that. >> >> Not sure why I wanted to wade into this, but nobody's going to force >> you to use netmap. > A perhaps silly question: in order to achieve the throughput described, > is the application in a hard loop monitoring the ring status? If so, the > statistic is of limited applicability.
Well, of course if you want to count every packet you need to look at every packet, but the total counts can be swept up on a daily or whatever basis. If I want to know how much traffic I sent to XYZ/24 last week, I'm still happy if that stat is missing the last minute of traffic. I'm less happy if the stat is missing 33% of the total traffic because bpf couldn't copy it out in time.
