On Fri, Jul 13, 2012 at 16:06, Andres Perera wrote: > you did! you explicitly said that it would be advantageous for > programs looking to perform analysis on captured packets. for those > programs, it turns out the placement of the filter doesn't matter
Sure it matters. Simple example: count packets by /24. Very simple, but you can't do it with bpf. You have to pull all the packets to userland, and bpf is kind of slow at that. Not sure why I wanted to wade into this, but nobody's going to force you to use netmap.
