> PF_PACKET was originally architected by people who, at the time, were
> targeting ARCnet, or 10Mbit Ethernet for "high-end".  Copying all
> packets to userspace was deemd acceptable since allegedly "everybody"
> (i.e., even an old 486) could keep up

I never saw an ethernet card for a 486 that got anywhere near LAN
saturation even with big packets - the best was the AMD PCnet-ISA!
Even many 32bit EISA cards wouldn't do it....

Adding another user-space copy would kill it completely!

It was only 3 or 4 years ago that SMC were trying to sell ISA ethernet
cards that didn't have enough buffer space for a single ftp - never mind
NFS.

Mind you I remember our corporate network people complaining that the
ethernet was 'overloaded' if the utilisation went above 10%!
We were writing the comms protocol stacks.....
Nothing semi-real hit 100% until the VMEbus CMC-130 (68020 card - split memory),
the sBus cards did it better though...

I suspect that even those 'high end' systems were VERY sluggish...

We did a filter engine for a firewall product based on a decision tree
of bit-masked comparisons as a streams module to bung above the raw
streams ethernet code (why does everyone put the mux in the hw driver?).
Building the table was a bit tricky - but it was reasonably fast...

    David