From c7e5ad67b5e9f2ec54a046c8c0989568b72e7016 Mon Sep 17 00:00:00 2001 From: dmiller Date: Wed, 29 Oct 2014 05:31:08 +0000 Subject: [PATCH] Do optimization of pcap filters via set_pcap_filter Optimizing reduces BPF instructions from 45 to 10 for large-scan case. Also use PCAP_NETMASK_UNKNOWN instead of 0 since we don't provide a netmask. --- libnetutil/netutil.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc index b7727f77f..535066011 100644 --- a/libnetutil/netutil.cc +++ b/libnetutil/netutil.cc @@ -4069,7 +4069,7 @@ void set_pcap_filter(const char *device, pcap_t *pd, const char *bpf, ...) { netutil_fatal("%s called with too-large filter arg\n", __func__); va_end(ap); - if (pcap_compile(pd, &fcode, buf, 0, 0) < 0) + if (pcap_compile(pd, &fcode, buf, 1, PCAP_NETMASK_UNKNOWN) < 0) netutil_fatal("Error compiling our pcap filter: %s", pcap_geterr(pd)); if (pcap_setfilter(pd, &fcode) < 0) netutil_fatal("Failed to set the pcap filter: %s\n", pcap_geterr(pd));