On 29 Apr 2011 (18), at 3:59 PM, Attilla de Groot wrote: > > On Apr 29, 2011, at 3:55 PM, Kyle Creyts wrote: > >> How is this being done? I've looked at looked at PF_RING and TNAPI... is >> there anything better out there? > > http://events.ccc.de/congress/2006/Fahrplan/attachments/1225-23c3-slides-av.pdf > > That should give you some answers. :-)
The paper that I wrote for this talk might give you a bit more information than the just the slides: http://events.ccc.de/congress/2006/Fahrplan/attachments/1153-23C3_ArienVijn.pdf This solution filters at full line rate. I am happy to tell more if you are interested. -- Arien
