Re: [Caml-list] IPv6 packet parsing

[Markus Mottl <markus.mottl@gmail.com>]

On Fri, Oct 18, 2013 at 1:52 PM,  <rixed@happyleptic.org> wrote:
> I feel sorry to be clueless twice in a row, but how are these new syscalls
> supposed to help sniffing & parsing packets?

There are several ways in which they could be beneficial.  In fact,
you'll usually have to combine them.  Packet sniffers often need to
analyze some things in realtime while also logging all sniffed data to
a file for later reference.

"splice" allows you to move data from one descriptor to another
without ever having to copy it to user land in between.  "tee" allows
you to cheaply duplicate the content of one pipe to another.  E.g. you
can thus parse packets from one pipe for realtime analysis while
splicing duplicated (via "tee") data to a file.

The packet sniffer might also have another, non-verbatim output stream
that contains only filtered parts of the communication.  You could use
"vmsplice" to send data contained in your user buffers to a pipe
(without copying!) and then splice the data to a file while e.g. also
duplicating it to a socket, etc.

Anyway, I agree with Paul that such performance tweaks may often
disappoint.  Other things (e.g. batching of I/O transactions to
minimize system calls) are usually much more important.

Regards,
Markus

-- 
Markus Mottl        http://www.ocaml.info        markus.mottl@gmail.com