memory mapped packet capturing - bpf replacement ?

[Ed Maste]

Matthew Dillon wrote:
> 
> There's no reason why the time has to be in microseconds or 
> even that it must be adjusted to realtime.  You also do not 
> have to support low power modes during testing which means 
> that just time-stamping the packets with the TSC plus a simple 
> base offset to correct for variences between cpus and machines 
> on the network ought to be sufficient.

Fair enough.  In my case I didn't need the timestamp anyway
so just disabling it was the least-effort way to remove the 
overhead.

I pointed out the timestamp issue only because it will penalize
BPF against a new method (that doesn't have them) more than one 
might expect.

-ed