In message <20011121174903.A1522@noc.untraceable.net>Andrew Brown writes
>[apparent violent agreement elided]

I thought we were politely disagreeing about the utility of PF_PACKET...?

>>...
>>Andrew, please dont take this the wrong way, but have you ever
>>tried to use this monstrosity?
>
>which?  bpf (yes) or PF_PACKET (no)?  a "raw" bpf or libpcap?

I meant PF_PACKET. Mogul, Rashid and Acceta outlined the problems with
PF_PACKET-style architecture 14 years ago in DEC WRL-TR-87-2,
some 10 years before Linux PF_PACKET.

(I used packetfilter in anger way back when; and to collect my
thesis data, i did pretty much what MJR et. al did to bpf.)