Re: [tcpdump-workers] Inefficiency in BPF code for DLT_RAW

2010-01-04 Thread Guy Harris
On Jan 3, 2010, at 6:42 PM, Darren Reed wrote: > On 23/12/09 06:09 PM, Guy Harris wrote: > >> DLT_IPv4 and DLT_IPv6? > > Can I request for DLT numbers to be allocated? > 228 & 229 would appear to be next. OK, DLT_IPV4 is 228 and DLT_IPV6 is 229. I used capital-V; if people would prefer a lowe

Re: [tcpdump-workers] Inefficiency in BPF code for DLT_RAW

2010-01-04 Thread Darren Reed
On 23/12/09 06:09 PM, Guy Harris wrote: On Dec 23, 2009, at 2:01 AM, Darren Reed wrote: The links that support the IP tunnels are a fixed type, be it IPv4 or IPv6, and are reported as being DLT_RAW because there is no real layer 2 header present. ... In the face of modern

Re: [tcpdump-workers] Inefficiency in BPF code for DLT_RAW

2010-01-04 Thread Sebastien Roy
On Wed, 2009-12-23 at 18:09 -0800, Guy Harris wrote: > On Dec 23, 2009, at 2:01 AM, Darren Reed wrote: > > > The links that support the IP tunnels are a fixed type, be > > it IPv4 or IPv6, and are reported as being DLT_RAW because > > there is no real layer 2 header present. > > ... > > >

Re: [tcpdump-workers] Inefficiency in BPF code for DLT_RAW

2009-12-23 Thread Darren Reed
On 23/12/09 06:09 PM, Guy Harris wrote: On Dec 23, 2009, at 2:01 AM, Darren Reed wrote: The links that support the IP tunnels are a fixed type, be it IPv4 or IPv6, and are reported as being DLT_RAW because there is no real layer 2 header present. ... In the face of modern

Re: [tcpdump-workers] Inefficiency in BPF code for DLT_RAW

2009-12-23 Thread Guy Harris
On Dec 23, 2009, at 2:01 AM, Darren Reed wrote: > The links that support the IP tunnels are a fixed type, be > it IPv4 or IPv6, and are reported as being DLT_RAW because > there is no real layer 2 header present. ... > In the face of modern processors, this might seem like > micro-optim

[tcpdump-workers] Inefficiency in BPF code for DLT_RAW

2009-12-23 Thread Darren Reed
Looking at the BPF code that gets generated for links such as the IP tunnels in Solaris, there appears to be an inefficiency in the opcodes generated. Let me explain. The links that support the IP tunnels are a fixed type, be it IPv4 or IPv6, and are reported as being DLT_RAW because there is no