Skip to content

Improve filtering capabilities: Berkeley Packet Filter#937

Merged
GyulyVGC merged 11 commits intomainfrom
bpf
Aug 19, 2025
Merged

Improve filtering capabilities: Berkeley Packet Filter#937
GyulyVGC merged 11 commits intomainfrom
bpf

Conversation

@GyulyVGC
Copy link
Owner

@GyulyVGC GyulyVGC commented Aug 16, 2025

This PR replaces the old, limited filters with a new single filter allowing to specify an arbitrarily complex Berkeley Packet Filter program.

This filter is applied directly to the PCAP source, hence it does the filtering at lower level without the need for Sniffnet itself to match packets against filters.

This improves performance with the drawback of losing information about the number of filtered-out packets.
In fact, PCAP doesn't offer a reliable API to see the filtered out-packets; from pcap_stat manual page:

The statistics do not behave the same way on all platforms. ps_recv might count packets whether they passed any filter set with pcap_setfilter or not, or it might count only packets that pass the filter. It also might, or might not, count packets dropped because there was no room in the operating system's buffer when they arrived.

This PR also considerably renews and simplifies the app’s initial page.

bpf.mp4

Fixes #810.

@GyulyVGC GyulyVGC added this to the v1.4.1 milestone Aug 16, 2025
@GyulyVGC GyulyVGC self-assigned this Aug 16, 2025
@GyulyVGC GyulyVGC added the enhancement New feature, request, or improvement label Aug 16, 2025
Copy link
Owner Author

@GyulyVGC GyulyVGC left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚢

@GyulyVGC GyulyVGC merged commit 34dcdc9 into main Aug 19, 2025
6 checks passed
@GyulyVGC GyulyVGC deleted the bpf branch August 19, 2025 10:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature, request, or improvement

1 participant