* Jonathan Stone <jonathan@DSG.Stanford.EDU> [011121 15:40] wrote:
> 
> In message <20011121161842.F25474@wooj.nexthop.com>Nick Amato writes
> 
> PF_PACKET was originally architected by people who, at the time, were
> targeting ARCnet, or 10Mbit Ethernet for "high-end".  Copying all
> packets to userspace was deemd acceptable since allegedly "everybody"
> (i.e., even an old 486) could keep up.  Even then, early deployment of
> 100Mbit Ethernet showed that PF_PACKET was a poor design for purposes
> like tcpdump; gigabit and 10Gbit Ethernet makes it look pretty silly.

Agreed, there are several papers out that show that linux's packet
filter is about as low performance as you can get.

-- 
-Alfred Perlstein [alfred@freebsd.org]
'Instead of asking why a piece of software is using "1970s technology,"
 start asking why software is ignoring 30 years of accumulated wisdom.'
                           http://www.morons.org/rants/gpl-harmful.php3