From owner-freebsd-net  Thu May  3  0:53: 7 2001
Delivered-To: freebsd-net@freebsd.org
Received: from info.iet.unipi.it (info.iet.unipi.it [131.114.9.184])
	by hub.freebsd.org (Postfix) with ESMTP id 5339137B423
	for <freebsd-net@freebsd.org>; Thu,  3 May 2001 00:53:04 -0700 (PDT)
	(envelope-from luigi@info.iet.unipi.it)
Received: (from luigi@localhost)
	by info.iet.unipi.it (8.9.3/8.9.3) id JAA44246;
	Thu, 3 May 2001 09:50:25 +0200 (CEST)
	(envelope-from luigi)
From: Luigi Rizzo <luigi@info.iet.unipi.it>
Message-Id: <200105030750.JAA44246@info.iet.unipi.it>
Subject: Re: [altq 838] Re: The future of ALTQ, IPsec & IPFILTER playing    
 together ...
In-Reply-To: <3AF108F2.BA4AF637@aurora.regenstrief.org> from Gunther Schadow
 at "May 3, 2001 07:29:54 am"
To: Gunther Schadow <gunther@aurora.regenstrief.org>
Date: Thu, 3 May 2001 09:50:25 +0200 (CEST)
Cc: Darren Reed <darrenr@reed.wattle.id.au>, thorpej@zembu.com,
	snap-users@kame.net, julian@elischer.org, freebsd-net@freebsd.org,
	ipfilter@coombs.anu.edu.au, altq@csl.sony.co.jp
X-Mailer: ELM [version 2.4ME+ PL61 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

> is fast, as fast as it gets. It is my understanding that BPF
> is very fast

wrong. It is an interpreted bytecode, much slower than,
say, approaches which translate individual filters into
native machine code (DPT/DPF ? don't remember the exact reference,
it was some usenix/sigcomm paper).

>               and that BPF scales very well for even complex
> expressions.

this is more a ruleset compiler issue, where you try to analyse
the whole ruleset and find out what are the important
field to look at, build a tree/trie to drive your
searches, use lookup and hash tables, etc.e tc. -- there is a lot of
recent literature on the topic of fast packet classification.

	cheers
	luigi

> would want a number representing the class. Also, it's beenong
> noted before, the BPF machine needs some state awareness between
> packets.
> 
> regards
> -Gunther
> 
> -- 
> Gunther Schadow, M.D., Ph.D.                    gschadow@regenstrief.org
> Medical Information Scientist      Regenstrief Institute for Health Care
> Adjunct Assistent Professor        Indiana University School of Medicine
> tel:1(317)630-7960                         http://aurora.regenstrief.org
> 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message