[dpdk-dev] [RFC 5/8] pdump: add classic BPF filtering

[Stephen Hemminger]

On Mon, 7 Oct 2019 22:37:43 +0530
Jerin Jacob <jerinjacobk at gmail.com> wrote:

> On Mon, 7 Oct, 2019, 10:23 PM Stephen Hemminger, <stephen at networkplumber.org>
> wrote:
> 
> > Simple classic BPF interpreter based off of libpcap.
> >
> > This is a copy of the BPF interpreter from libpcap which is
> > modified to handle mbuf meta data. The existing pcap_offline_filter
> > does not expose a way to match VLAN tags. Copying the BPF interpreter
> > also means that rte_pdump still does not have a hard dependency
> > on libpcap.
> >  
> 
> Why not use DPDK's librte_bpf library? Rather implementing cBPF
> interpreter. Currently it supports eBPF which is super set of cBPF.if is
> this features very specific to cBPF, we clould simply implement cBPF using
> eBPF or implement a new cBPF program type. That scheme could leverage
> existing JIT infrastructure also. Using JIT will improve filtering
> performance.
> 
> >
> >  

Because pcap library generates cBPF in its string to BPF compiler.
Translating cBPF to eBPF is non trivial.