[lkml]   [2001]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: detailed description of linux socket filter and sniffing problem
--- Alan Cox <> wrote:
> > 5) so i remove the filter expression by means of setsockopt
> > SO_DETACH_FILTER and then regenrate the bpfcode for the nw
> expression.
> >
> > 6) now i do a attach operation on the socket by means of setsockopt
> and
> > so attach the new filter.
> You can just issue a new SO_ATTACH_FILTER and it will swap them over
> rather
> than having an 'all packets' time. You will have some buffered frames
> matching
> the old filter

Hello Alan,

But the reason why i am not doing this right now is that as soon as i
determine that i need to change the bpfcode, i would possibly require
that at that very instant i don't miss the next 2-3 packets
corresponding to the new criteria which are of prime importance. Then
if i take my time in compiling and then attaching the new code in the
manner u have suggested, the kernel might drop those important packets
as during this time the bpfcode is still the old one. So, at that very
instant i detach the bpfcode. This helps me in the way that this is the
fastest way in which i can grab the next 2-3 packets. But this would
possibly provide an inlet for the invalid or not required packets also
to be buffered in the kernel. So, if i have a way that the buffered
packets should be now filtered on the basis of the new bpfcode which i
have attached to the socket, then things will be fine.

Thus this is the reason why i am trying to find the solution for the
case as i have explained it in the previous mail.

If there is some way out for this problem, then please suggest me the
same, as i am in urgent need of a solution for this problem of mine.

PS: Alan, It's a great pleasure to have your mail in my inbox. I have
read your name so much in the kernel code, that seeing your mail seems
like dream come true.


Image by

Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:56    [W:1.393 / U:0.556 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site