Re: why not filtering at driver level ?

[Guy Harris <guy () alum mit edu>]

Guy Harris wrote:

> You forgot option 3:
>
>     3. Raise the limit on the maximum number of BPF instructions.
>
> You're going to have to add stuff to, or change stuff in, the kernel to 
> implement this *anyway*, so you might as well just boost the maximum 
> number of BPF instructions and not have to change libpcap *at all*.

You might also have to raise the limit on socket options; see

        http://www.tcpdump.org/lists/workers/2004/05/msg00007.html

It might be that you're running into the limit on socket options, rather 
than the limit on BPF instructions, in which case you don't have to 
change any code.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.