Could anyone add some clarity to the 'slightly lower performance' that one would encounter using Berkeley Packet Filter?


I know io-pkt has been around for quite a while but we're finally forced, due to hardware obsolescence, to move away 
from our io-net filter an io-pkt equivalent. The filtering page recommends BPF as the interface of first choice, and it 
was fairly straightforward to move to BPF. Unfortunately, our new devnp-e1000/io-pkt/BPF combination has significant 
performance issues compared to our old devn-i82544/io-net/filter combination.

We're using BPF to slurp and inject frames of a proprietary protocol. We open a BPF file handle, set the interface, set 
'immediate' to 1, set 'header complete' to 1, and 'see sent' to 0. From there we just read and write the file descriptor
.

We're heading into the bowels of the system kernel trace but in the meantime we're curious to know if 'slightly lower 
performance' means a few µseconds or hundreds of µseconds.

Thanks.

Mark