In message <20001107120318.C498@dr-evil.z.zembu.com>Jason R Thorpe writes
>On Tue, Nov 07, 2000 at 12:01:53PM -0800, Jonathan Stone wrote:
>
> > Dawson Engler's DPF does this; is there reason not to use that, or at
> > least leverage heavily off i9t?
>
>Point me at a paper about it, please.  Note that I am intending to make
>these features an integral part of BPF at some point.

SIGCOMM '96.  a more complete description is at:
http://www.pdos.lcs.mit.edu/~engler/dpf.html