> I've added bpf filters to the input and output side of the ip forwarding
> code and been using them for some months.  The performance is reasonable
> for slow links (like up to 56k).  The optimizer in tcpdump is actually
> pretty good.
> 
> If you are interested, I'll send you the diffs.  There is currently no
> notification of dropped packets.

Brad,

I'd be interested in your diffs... 

I've just connected my host to the net and while I've hacked inetd to
allow binding to specific addresses only (so I can offer different
services on each interface), I need to filter out calls to portmaper
and nfs etc - rather than have to hack them too.

--sjg