lkml.org 
[lkml]   [2001]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: detailed description of linux socket filter and sniffing problem
--- Alan Cox <alan@lxorguk.ukuu.org.uk> wrote:
> > 5) so i remove the filter expression by means of setsockopt
> > SO_DETACH_FILTER and then regenrate the bpfcode for the nw
> expression.
> >
> > 6) now i do a attach operation on the socket by means of setsockopt
> and
> > so attach the new filter.
>
> You can just issue a new SO_ATTACH_FILTER and it will swap them over
> rather
> than having an 'all packets' time. You will have some buffered frames
> matching
> the old filter

Hello Alan,

But the reason why i am not doing this right now is that as soon as i
determine that i need to change the bpfcode, i would possibly require
that at that very instant i don't miss the next 2-3 packets
corresponding to the new criteria which are of prime importance. Then
if i take my time in compiling and then attaching the new code in the
manner u have suggested, the kernel might drop those important packets
as during this time the bpfcode is still the old one. So, at that very
instant i detach the bpfcode. This helps me in the way that this is the
fastest way in which i can grab the next 2-3 packets. But this would
possibly provide an inlet for the invalid or not required packets also
to be buffered in the kernel. So, if i have a way that the buffered
packets should be now filtered on the basis of the new bpfcode which i
have attached to the socket, then things will be fine.

Thus this is the reason why i am trying to find the solution for the
case as i have explained it in the previous mail.

If there is some way out for this problem, then please suggest me the
same, as i am in urgent need of a solution for this problem of mine.

PS: Alan, It's a great pleasure to have your mail in my inbox. I have
read your name so much in the kernel code, that seeing your mail seems
like dream come true.

=====

Image by FlamingText.com

__________________________________________________
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail
http://personal.mail.yahoo.com/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:56    [W:1.393 / U:0.556 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site