On Mon, 2007-03-05 at 13:00 +0000, Andy Green wrote: > I used the libpcap filter stuff to limit what I saw to just the packets > of interest. This is the filtering that tcpdump uses to do the > conditional filters like "port 22" or "host 192.168.0.1". The filter > uses something called BPF (Berkeley Packet Filter) which is done > kernelside (at least libpcap is doing the filter install with ioctls in > pcap-bpf.c). So the cost of drinking from a Monitor firehose is much > less than it sounds. Actually, I think the cost can be significant, especially for embedded systems. You traverse into userspace for each packet at least once, and a management entity in userspace will not be concerned with data packets at all. Also, a monitor interface currently always disables power save mode for many drivers. johannes
Attachment:
signature.asc
Description: This is a digitally signed message part
