In message <20011121161842.F25474@wooj.nexthop.com>Nick Amato writes

PF_PACKET was originally architected by people who, at the time, were
targeting ARCnet, or 10Mbit Ethernet for "high-end".  Copying all
packets to userspace was deemd acceptable since allegedly "everybody"
(i.e., even an old 486) could keep up.  Even then, early deployment of
100Mbit Ethernet showed that PF_PACKET was a poor design for purposes
like tcpdump; gigabit and 10Gbit Ethernet makes it look pretty silly.


>It's worth noting that an advantage of PF_PACKET vs. bpf(4) is that
>a PF_PACKET socket may be bound to an ethertype (or 802.3 frame)
>and can receive these frames on any interface if desired (analogous
>to a raw IP socket).  IIRC, a bpf pseudodevice must be bound to an
>interface to receive, thus requiring a bpf in the kernel for every
>interface on which one wants to receive.

I thought Jason Thorpe was making NetBSD's bpf into a cloning device?