tcpdump mailing list archives
Filter complexity and performance
From: "Dmitry Rubinstein" <Dmitry.Rubinstein () bhive net>
Date: Mon, 15 Jan 2007 08:08:22 -0500
Greetings, everyone! We are trying to capture stuff using a relatively simple filter (on Linux, using Phil Wood's PCAP with ssldump on top of it). What we want is basically to capture the traffic to and from a specific port of a specific host (say, 10.0.0.1:80). So far we did it using the filter 'host 10.0.0.1 and port 80', but obviously that means we also see traffic originating from 10.0.0.1 to port 80 of other hosts. The simple way to prevent that would be to use a bit more elaborate filter: '(dst host 10.0.0.1 and dst port 80) or (src host 10.0.0.1 and src port 80)'. This means the filter has grown two fold in the number of clauses. What will be the implications upon the performance of the filtering code? Will we be able to capture twice as few packets (hopefully not)? I was hoping to kinda avoid the need to do this test if anyone has already did some sort of evaluation... Thanks! -- Sailing: The fine art of getting wet and becoming ill while slowly going nowhere at great expense. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Filter complexity and performance Dmitry Rubinstein (Jan 15)
- Re: Filter complexity and performance Jonathan Gruenhut (Jan 15)
- Re: Filter complexity and performance Fabian Schneider (Jan 15)
- Re: Filter complexity and performance Jefferson Ogata (Jan 16)