> is fast, as fast as it gets. It is my understanding that BPF
> is very fast
wrong. It is an interpreted bytecode, much slower than,
say, approaches which translate individual filters into
native machine code (DPT/DPF ? don't remember the exact reference,
it was some usenix/sigcomm paper).
> and that BPF scales very well for even complex
> expressions.
this is more a ruleset compiler issue, where you try to analyse
the whole ruleset and find out what are the important
field to look at, build a tree/trie to drive your
searches, use lookup and hash tables, etc.e tc. -- there is a lot of
recent literature on the topic of fast packet classification.
cheers
luigi
> would want a number representing the class. Also, it's beenong
> noted before, the BPF machine needs some state awareness between
> packets.
>
> regards
> -Gunther
>
> --
> Gunther Schadow, M.D., Ph.D. [EMAIL PROTECTED]
> Medical Information Scientist Regenstrief Institute for Health Care
> Adjunct Assistent Professor Indiana University School of Medicine
> tel:1(317)630-7960 http://aurora.regenstrief.org
>
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message
