> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On
> Behalf Of Casper Dik
> Sent: Wednesday, May 02, 2001 09:37
> To: Darren Reed
> Cc: Gunther Schadow; [EMAIL PROTECTED]; [EMAIL PROTECTED];
> [EMAIL PROTECTED]; [EMAIL PROTECTED]
> Subject: [altq 829] Re: The future of ALTQ, IPsec & IPFILTER playing
> together ...
>
>
>
> >BPF uses a byte-code language, like Java, to tell the
> >matching routine what bits to compare and return a "true or
> >false". i.e. you need to build things around it if you want
> >to use it for packet matching, etc.
>
>
> BPF doesn't seem to lend itself to "keeping state" either. It's a
> packet filtering language that has no provisions for keeping external
> state, AFAIK.
Just because the 4K memory is allocated on a per-packet basis.
Checking at the BPF source code I think it's not a big issue to allocate the
memory *once* at the beginning of the capture, and use it to store
intermediate results.
However, as far as I know, also MPF guys choose to use a distinct set of
memory to store intermediate results.
Cheers,
fulvio
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message
