BSD包过滤器(BPF)的研究与改进

Research and Improvement of BSD Packet Filter(BPF)

BSD包过滤器(BSDPacketFilter,简称BPF)位于BSDUnix的内核中,它独立于TCP/IP协议栈,为应用程序访问数据链路层提供了一个原始接口,被广泛地运用在网络监控及其它软件中,如tcpdump。论文对BPF进行了研究,并对其在以太网卡被设置成混杂模式时存在的问题,在FreeBSD4.7上进行了改进,从而也使BPF为应用程序提供了一个更友好的接口。

BSD Packet Filter(BPF)lies in the kernel of BSD Unix,it is independent of the TCP/IP stack,and gives user mode processes a raw interface to access data link layer.It has been widely used in network monitors and other softwares,such as tcpdump.This paper includes a research of BPF,and a solution of a BPF's problem which exists when the Ethernet card is set into promiscuous mode,and the solution has been implemented on FreeBSD4.7.As a result,it also makes BPF provide a better interface to application program.