bpf, ipfw and before-and-after

[John Polstra]

In article <1564916751.1060101774 at melange.errno.com>,
Sam Leffler  <sam at errno.com> wrote:
> > My point is that the extra calls to bpf_mtap would harm performance
> > even when bpf wasn't being used.
> 
> In -current I believe all the calls are prefixed with a check for 
> ifp->if_bpf or similar.  So any slow down should only happen when BPF is 
> active.

That does not follow, because the check of ifp->if_bpf itself takes
time.  There is no way to avoid the performance penalty except at
compile time.  Yes, branch prediction helps, but it doesn't eliminate
the problem.  Even with gigabit ethernet those individual nanoseconds
add up quickly to the point where they matter.  With 10 Gb ethernet on
the way, it will only get worse.

John
-- 
  John Polstra
  John D. Polstra & Co., Inc.                        Seattle, Washington USA
  "Two buttocks cannot avoid friction."                     -- Malawi saying