From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Original-To: caml-list@sympa.inria.fr Delivered-To: caml-list@sympa.inria.fr Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) by sympa.inria.fr (Postfix) with ESMTPS id EC81E7EE25 for ; Fri, 18 Oct 2013 22:09:55 +0200 (CEST) Received-SPF: None (mail3-smtp-sop.national.inria.fr: no sender authenticity information available from domain of markus.mottl@gmail.com) identity=pra; client-ip=74.125.82.171; receiver=mail3-smtp-sop.national.inria.fr; envelope-from="markus.mottl@gmail.com"; x-sender="markus.mottl@gmail.com"; x-conformance=sidf_compatible Received-SPF: Pass (mail3-smtp-sop.national.inria.fr: domain of markus.mottl@gmail.com designates 74.125.82.171 as permitted sender) identity=mailfrom; client-ip=74.125.82.171; receiver=mail3-smtp-sop.national.inria.fr; envelope-from="markus.mottl@gmail.com"; x-sender="markus.mottl@gmail.com"; x-conformance=sidf_compatible; x-record-type="v=spf1" Received-SPF: None (mail3-smtp-sop.national.inria.fr: no sender authenticity information available from domain of postmaster@mail-we0-f171.google.com) identity=helo; client-ip=74.125.82.171; receiver=mail3-smtp-sop.national.inria.fr; envelope-from="markus.mottl@gmail.com"; x-sender="postmaster@mail-we0-f171.google.com"; x-conformance=sidf_compatible X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AosCALmUYVJKfVKrlWdsb2JhbABagz9SviaBHQgWDgEBAQEHDQkJEiqCJQEBBUABFAcdAQMMBgULAwouIQEBEQEFARwGE4dzAQMPok+MVYMKhBkKGScNZIkBAQUMjFqCcAeEKQOWHoFrjFCDSxgphGsg X-IPAS-Result: AosCALmUYVJKfVKrlWdsb2JhbABagz9SviaBHQgWDgEBAQEHDQkJEiqCJQEBBUABFAcdAQMMBgULAwouIQEBEQEFARwGE4dzAQMPok+MVYMKhBkKGScNZIkBAQUMjFqCcAeEKQOWHoFrjFCDSxgphGsg X-IronPort-AV: E=Sophos;i="4.93,524,1378850400"; d="scan'208";a="30924149" Received: from mail-we0-f171.google.com ([74.125.82.171]) by mail3-smtp-sop.national.inria.fr with ESMTP/TLS/RC4-SHA; 18 Oct 2013 22:09:55 +0200 Received: by mail-we0-f171.google.com with SMTP id t60so4170521wes.16 for ; Fri, 18 Oct 2013 13:09:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=OeFNPim0KN4j0vhhx5Q2my0rqoDde3CszOsEe6EvGwc=; b=K+OSXa73CPP4n0nQe6lTNN2dzEfnw8N05i5UAbh/v2zn6qC+im4xaOYc4k2XOSS2yg ayVPXM1URl7G1X2vxDYFPpzdNTmp3iDjseaZr0RNNE8KcJKk+WCdASp5RngWAYujQ26z IUWM13AGHCFCKn/0Q6B2HAg3AD0hr0sN/vRVyWqMxS3T2eBSTSlFRvMPSkCP6hdiQF8D wKTmw8xJz8VKTT5hbWOD5ix3wn5xXjMvpUxZlup+7WYcZdGbH/rq0x+hYDaLh6edihyV 9d1d/q7jKsJbKjb+hllOEtpq4bVmP6zEi9i82gqsYctZXMRkXZU0W+zhO1+Q7uqiDP3X CHrw== MIME-Version: 1.0 X-Received: by 10.194.88.225 with SMTP id bj1mr3346407wjb.50.1382126994856; Fri, 18 Oct 2013 13:09:54 -0700 (PDT) Received: by 10.194.172.4 with HTTP; Fri, 18 Oct 2013 13:09:54 -0700 (PDT) In-Reply-To: <20131018175225.GA6256@dell.happyleptic.org> References: <20131018115553.GA28679@ombreroze.happyleptic.org> <20131018115955.GG25839@dark.recoil.org> <20131018121612.GB28679@ombreroze.happyleptic.org> <20131018122018.GJ25839@dark.recoil.org> <20131018175225.GA6256@dell.happyleptic.org> Date: Fri, 18 Oct 2013 16:09:54 -0400 Message-ID: From: Markus Mottl To: Chapi Chapo Cc: OCaml Mailing List Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [Caml-list] IPv6 packet parsing On Fri, Oct 18, 2013 at 1:52 PM, wrote: > I feel sorry to be clueless twice in a row, but how are these new syscalls > supposed to help sniffing & parsing packets? There are several ways in which they could be beneficial. In fact, you'll usually have to combine them. Packet sniffers often need to analyze some things in realtime while also logging all sniffed data to a file for later reference. "splice" allows you to move data from one descriptor to another without ever having to copy it to user land in between. "tee" allows you to cheaply duplicate the content of one pipe to another. E.g. you can thus parse packets from one pipe for realtime analysis while splicing duplicated (via "tee") data to a file. The packet sniffer might also have another, non-verbatim output stream that contains only filtered parts of the communication. You could use "vmsplice" to send data contained in your user buffers to a pipe (without copying!) and then splice the data to a file while e.g. also duplicating it to a socket, etc. Anyway, I agree with Paul that such performance tweaks may often disappoint. Other things (e.g. batching of I/O transactions to minimize system calls) are usually much more important. Regards, Markus -- Markus Mottl http://www.ocaml.info markus.mottl@gmail.com