why not filtering at driver level ?

[madhuresh <madhurag () iitk ac in>]

Hi,

I am just anxious to know that why we do filtering of packets at user 
space and not at driver level (kernel space). What if libpcap can 
communicate the filter options to the driver under consideration which 
will then transfer, only the filtered packets to a new interface say 
ABC0. Then libpcap can read these filtered packets from ABC0 and can 
directly transfer to tcpdump for parsing.

This will save lots of bytes to be transferred from kernel to user 
space, which indeed is a costly operation.

One major issue is that driver has to still pass the packets (which dont 
satisfy filter options) to kernel as other applications might be waiting 
for these packets.

So is it possible to transfer only filtered packets to the libpcap under 
the constraint of above statement ? How ?

Please answer.

Thanks

-Madhuresh

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.