tcpdump mailing list archives

Re: Inefficiency in BPF code for DLT_RAW


From: Sebastien Roy <Sebastien.Roy () Sun COM>
Date: Mon, 04 Jan 2010 09:32:46 -0500

On Wed, 2009-12-23 at 18:09 -0800, Guy Harris wrote:
On Dec 23, 2009, at 2:01 AM, Darren Reed wrote:

The links that support the IP tunnels are a fixed type, be
it IPv4 or IPv6, and are reported as being DLT_RAW because
there is no real layer 2 header present.

      ...

In the face of modern processors, this might seem like
micro-optimisation but I see it more as a precision error:
it is not possible to precisely tell libpcap (and thus the
BPF compiler) that a link only sees one protocol and
therefore does not need to handle both protocol cases.

Thoughts?

DLT_IPv4 and DLT_IPv6?

Sounds like a fine idea to me.

-Seb


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: