Darren Reed <darrenr@reed.wattle.id.au> writes:
> > To my mind, bpf is sufficient. Hell, NFR uses it and that's the best IDS
> > I know.
> 
> NFR does not use the same version of BPF as we do.  They optimized it.

"Optimization", from what I remember, seems to have been largely a
question of bumping up the buffer size, wasn't it?

--
Perry E. Metzger		perry@wasabisystems.com
--
NetBSD Development, Support & CDs. http://www.wasabisystems.com/