Question regarding libpcap filters and sflow, how to filter 1 out of every N packets.

[Diego Valverde <diego.valverde.g () gmail com>]

Hi,



I am fairly new to libpcap so this may be a simple question.

I am currently working on a implementation of an SFLOW client for an
embedded device.

The SFLOW standard requires samples of only 1 out of every N packets,
therefore I was looking for a filter that will allow only 1 out of every
sampled packets to get transferred from kernel space to user space.

I haven't seen this kind of filtering functionality available so far, but
again I am fairly new at libpcap.



Is there a way to specify 1 out of every N packets sampling using an
existing  filter combination?

if not where should I look into the code in order to extend the filtering
functionally for my particular needs?



Thanks so much, any help is deeply appreciated.



-Diego
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.