fairly fast packet filter1.5.0

GPL (GNU General Public License)    
3.1/5 19
The fairly fast packet filter (FFPF) is an approach to network packet processing.




The fairly fast packet filter (FFPF) is an approach to network packet processing that adds many new features to existing filtering solutions like BPF.

fairly fast packet filter is designed for high speed by pushing computationally intensive tasks to the kernel or even network processors and by minimising packet copying.

By providing both access to richer programming languages and explicit extensibility, it is also considerably more flexible than existing approaches.

FFPF provides a complete solution for network monitoring that caters to all applications available today. Exploiting its extensibility, the language can even be used as a meta-filter to `script' together filters from other approaches, such as BPF.

Here are some key features of "fairly fast packet filter":

fast: processes significantly more packets per second than LSF (reference)
scalable: transparently supports hardware assist, like that given by the Intel IXP2x00 network processors
backward compatible: supports all existing libpcap based applications
extensible: separates functionality from the framework. FFPF currently ships with implementations of BPF, Aho Corasick, Boyer Moore Horspool, and many more
modular: new functions can be written in as little as 3 lines of code
secure: relies on Keynote for authentication and resource control
open and standard adherent: licensed under the GNU General Public License (GPL). It implements the Monitoring API (MAPI) draft as designed by the EU-SCAMPI consortium

What's New in This Release:

enabled kernelspace processing
enabled all 5 buffer implementations (Continuous, Fixed-size slot, Variable sized slot, Double ring and Index)
added TCP stream reassembly and early implementation of zero-copy reassembly
added PCAP input and output support, for userspace testing and offline use
added additional minor functions: TCP Synprotect, output to files, ...
added support for UDEV
extended controlplane: flowspaces can now be queried for live state
fixed up many bugs, hacks and irregularities.
Last updated on February 21st, 2006

0 User reviews so far.