Re: [tcpdump-workers] BPF in hardware

2004-11-22 Thread Jefferson Ogata
Guy Harris wrote: That obviates the need to design the expression tree representation (as I'd like to be able to hand expression trees *not* constructed by libpcap's parser to the filter installer, that should be designed well enough to be usable and extensible as necessary), but does mean you'd

Re: [tcpdump-workers] BPF in hardware

2004-11-22 Thread Guy Harris
On Nov 22, 2004, at 4:01 PM, Livio Ricciulli wrote: How far is the current implementation from this architecture? None of it has been done - the only way to be further from that architecture would be not to have come up with that architecture. Any change to support generating anything other than

Re: [tcpdump-workers] BPF in hardware

2004-11-22 Thread Livio Ricciulli
Guy Harris wrote: On Nov 22, 2004, at 1:26 PM, Livio Ricciulli wrote: The idea is to automatically translate the BPF expressions passed to libpcap into MTP macrocode and load it into the card on the fly ___in_addition_to___ the normal BPF software matching. By "BPF expressions" do you mean "BPF pr

Re: [tcpdump-workers] BPF in hardware

2004-11-22 Thread Guy Harris
On Nov 22, 2004, at 1:26 PM, Livio Ricciulli wrote: The idea is to automatically translate the BPF expressions passed to libpcap into MTP macrocode and load it into the card on the fly ___in_addition_to___ the normal BPF software matching. By "BPF expressions" do you mean "BPF programs" or do you m

[tcpdump-workers] BPF in hardware

2004-11-22 Thread Livio Ricciulli
Hi, I was thinking of contributing some code to libpcap for interfacing to the MTP PCI cards (http://www.metanetworks.org/products/mtp.html). These newly developed Ethernet cards can perform packet matching at 1G (and soon 10G) wire-speed before they DMA the packets through the PCI bus to the host.

Re: [tcpdump-workers] ring buffer with tcpdump

2004-11-22 Thread Will Drewry
On Mon, 22 Nov 2004 13:10:09 +0100, Ramon Kukla <[EMAIL PROTECTED]> wrote: > Hi everybody, > > I searched the web and checked a couple of times the tcpdump manuals to > be sure that I didn't overlooked something. But I have to admit that I > didn't find any solution for my problem. > I would like

[tcpdump-workers] ring buffer with tcpdump

2004-11-22 Thread Ramon Kukla
Hi everybody, I searched the web and checked a couple of times the tcpdump manuals to be sure that I didn't overlooked something. But I have to admit that I didn't find any solution for my problem. I would like to run tcpdump saving the dumps into a number of files with the size 'n'. Currently I'm