Re: Improving the data supplied by BPF

["Arnaud Lacombe" <lacombar%gmail.com@localhost>]

On Sat, Dec 27, 2008 at 9:03 PM, Darren Reed <darrenr%netbsd.org@localhost> 
wrote:
> The filter is applied before the counter increments.
>
> It is a count of packets accepted by the filter.
>
> It is not a count of packets on the NIC unless the filter accepts
> all packets on the NIC.
>
> So if your filter was "arp" or "port 67", then if there were
> 500,000pps of NFS traffic, the counter would not move because
> of NFS packets, only because of the ARP or DHCP/BOOTP messages.
>
looks I had a too quick view to the code :)

cheers,

 - Arnaud