Re: Max OS-X issues: read privledges / bpf buffer

[Bruce M Simpson <bms () spc org>]

Hi,

On Fri, Sep 03, 2004 at 11:41:42AM -0700, Guy Harris wrote:
> > One last thing,  I noticed in some other mails this month that 
> > eliminating timestamping will increase performance of bpf.  I don't use 
> > this feature of bpf, is there a way for me to turn it off in Darwin?
>
> I suspect they either said, or at least meant, "increase performance of 
> packet capture" (referring to the general process, not specifically to 
> BPF) or "*would* increase performance of BPF"; BPF has no mechanism to 
> avoid time stamping packets.

Commenting out the call to microtime() in bpf.c would be one trivial way
to go about doing this. On FreeBSD, you could sacrifice accuracy for
lower execution time by using getmicrotime().

Or you could add a bpf ioctl to toggle this behaviour for a particular
bpf instance.

BMS
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.