Subject: Re: bpf performance suckage
To: Darren Reed <darrenr@reed.wattle.id.au>
From: None <itojun@iijlab.net>
List: tech-net
Date: 06/20/2000 11:34:56
>> 	and to share bpf code between kernel and userland.
>> 	(which is rather important, however, is not done so at this moment)
>Is there a person who is responsible for bringing in tcpdump/libpcap ?

	i'm not sure about it, but i feel part of responsibility.

>> 	just to make sure, please do not nuke cases where data is not on
>> 	first mbuf.  near-future IPv6 change (options PULLDOWN_TEST)
>> 	will choke.
>Hmmm ?  Why would this effect BPF calls ?  They're done from the drivers,
>not IPV6 ?  But this change sounds like it might affect IP Filter ?

	sorry, it is bpf and tcpdump that chokes on IPv6 packett.

	to make IPv6 processing easy, we at this moment set MINCLSIZE to MHLEN,
	effectively making drivers to pack packets like this:
	- single header mbuf (MHLEN) if len <= MHLEN
	- single cluster mbuf (MCLBYTES), or multiple cluster mbufs otherwise

	new code will behave just like traditional 4.4BSDdoes, so packets will
	be packed like this:
	- single header mbuf (MHLEN) if len <= MHLEN
	- header mbuf + normal mbuf (MHLEN + MLEN) if len <= MHLEN + MLEN
	- single cluster mbuf (MCLBYTES), or multiple cluster mbufs otherwise
	with the new code, upper-layer headers on a IPv6 packet would exceed
	the first mbuf easily.  if bpf code looks at first mbuf only, we will
	fail to catch IPv6 packet by bpf.

itojun