The BSD packet filter: a new architecture for user-level packet capture

TLDR

Unix systems support user‑level packet capture, enabling network monitoring on general workstations, but the original Unix packet filter’s stack‑based evaluator performs poorly on modern RISC CPUs. Network monitors copy packets across the kernel/user‑space boundary, but a kernel packet filter can reduce this overhead by discarding unwanted packets early. The BSD Packet Filter (BPF) uses a register‑based filter evaluator that is up to 20 times faster than the original design, and its straightforward buffering strategy makes overall performance up to 100 times faster than Sun’s NIT on the same hardware.

Abstract

Many versions of Unix provide facilities for user-level packet capture, making possible the use of general purpose workstations for network monitoring. Because network monitors run as user-level processes, packets must be copied across the kernel/user-space protection boundary. This copying can be minimized by deploying a kernel agent called a packet filter, which discards unwanted packets as early as possible. The original Unix packet filter was designed around a stack-based filter evaluator that performs sub-optimally on current RISC CPUs. The BSD Packet Filter (BPF) uses a new, register-based filter evaluator that is up to 20 times faster than the original design. BPF alson uses a straighforward buffering strategy that makes its overall performance up to 100 times faster than Sun's NIT running on the same hardware.