tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Improving the data supplied by BPF

On Sat, Dec 27, 2008 at 9:03 PM, Darren Reed <> 
> The filter is applied before the counter increments.
> It is a count of packets accepted by the filter.
> It is not a count of packets on the NIC unless the filter accepts
> all packets on the NIC.
> So if your filter was "arp" or "port 67", then if there were
> 500,000pps of NFS traffic, the counter would not move because
> of NFS packets, only because of the ARP or DHCP/BOOTP messages.
looks I had a too quick view to the code :)


 - Arnaud

Home | Main Index | Thread Index | Old Index