In some email I received from Perry E. Metzger, sie wrote:
> 
> Darren Reed <darrenr@reed.wattle.id.au> writes:
> > > To my mind, bpf is sufficient. Hell, NFR uses it and that's the best IDS
> > > I know.
> > 
> > NFR does not use the same version of BPF as we do.  They optimized it.
> 
> "Optimization", from what I remember, seems to have been largely a
> question of bumping up the buffer size, wasn't it?

Ah, now that I look, bpf in -current is lagging behind output from
tcpdump.org.  Who's the maintainer of libpcap/tcpdump things in NetBSD ?

Darren