On Tue, Mar 12, 2002 at 03:10:01PM -0800, Guy Harris wrote: > On Tue, Mar 12, 2002 at 02:37:14PM -0800, Joe Amici wrote: > > I have been using libpcap 0.4 which comes packed with > > RH6.2. I'll be migrating to libpcap 0.6, soon. The > > changelog says that Linux implementation of libpcap > > now uses PF_PACKET sockets and the filtering itself is > > done in the kernel. So am I correct in assuming that > > in 0.4, the filtering in linux was actually done in > > userland > > Yes.
...although the "libpcap 0.4" in RH 6.2 might is, I think, actually the result of applying some patches from Alexey Kuznetzov to the LBL libpcap 0.4; the patches replace the bulk of the Linux support, adding, among other things, support for in-kernel filtering. Of course, that requires that your kernel have CONFIG_FILTER support; if it doesn't, neither RH 6.2's "libpcap 0.4", nor libpcap 0.6.2 nor 0.7.1 from tcpdump.org, will be able to do any in-kernel filtering. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
