The BSD Packet Filter: A new architecture for user-level packet capture Export

@misc{citeulike:3839098, abstract = {Many versions of Unix provide facilities for user-level packet capture, making possible the use of general purpose workstations for network monitoring. Because network monitors run as user-level processes, packets must be copied across the kernel/user-space protection boundary. This copying can be minimized by deploying a kernel agent called a packet filter, which discards unwanted packets as early as possible. The original Unix packet filter was designed around a stack-based filter evaluator that performs sub-optimally on current RISC CPUs. The BSD Packet Filter (BPF) uses a new, registerbased filter evaluator that is up to 20 times faster than the original design. BPF also uses a straightforward buffering strategy that makes its overall performance up to 100 times faster than Sun\&\#039;s NIT running on the same hardware. 1}, author = {Mccanne, Steven and Jacobson, Van}, citeulike-article-id = {3839098}, citeulike-linkout-0 = {http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.43.7849}, keywords = {bpf, deos, extension, os}, pages = {259--269}, posted-at = {2008-12-31 13:44:25}, priority = {2}, title = {The BSD Packet Filter: A new architecture for user-level packet capture}, url = {http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.43.7849}, year = {1993} }

TY - ELEC ID - citeulike:3839098 L3 - citeulike-article-id:3839098 N2 - Many versions of Unix provide facilities for user-level packet capture, making possible the use of general purpose workstations for network monitoring. Because network monitors run as user-level processes, packets must be copied across the kernel/user-space protection boundary. This copying can be minimized by deploying a kernel agent called a packet filter, which discards unwanted packets as early as possible. The original Unix packet filter was designed around a stack-based filter evaluator that performs sub-optimally on current RISC CPUs. The BSD Packet Filter (BPF) uses a new, registerbased filter evaluator that is up to 20 times faster than the original design. BPF also uses a straightforward buffering strategy that makes its overall performance up to 100 times faster than Sun's NIT running on the same hardware. 1 EP - 269 TI - The BSD Packet Filter: A new architecture for user-level packet capture SP - 259 KW - bpf KW - deos KW - extension KW - os AU - Mccanne, Steven AU - Jacobson, Van PY - 1993/// UR - http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.43.7849 ER -