Masanobu Yuhara Brian N. Bershad Fujitsu Laboratories Ltd. Department of Computer Science 1015 Kamikodanaka and Engineering FR-35 Nakahara-ku University of Washington Kawasaki 211, Japan Seattle, WA 98195 Chris Maeda J. Eliot B. Moss School of Computer Science Dept. of Computer Science Carnegie Mellon University University of Massachusetts 5000 Forbes Ave. Amherst, MA 01003 Pittsburgh, PA 15213
This paper describes a new packet filter mechanism that efficiently dispatches incoming network packets to one of multiple endpoints, for example address spaces. Earlier packet filter systems iteratively applied each installed filter against every incoming packet, resulting in high processing overhead whenever multiple filters existed. Our new packet filter provides an associative match function that enables similar but not identical filters to be combined together into a single filter. The filter mechanism, which we call the Mach Packet Filter (MPF), has been implemented for the Mach 3.0 operating system and is being used to support endpoint-based protocol processing, whereby each address space implements its own suite of network protocols. With large numbers of registered endpoints, MPF outperforms the earlier BSD Packet Filter (BPF) by over a factor of four. MPF also allows a filter program to dispatch fragmented packets, which was quite difficult with previous filter mechanisms.
To Become a USENIX Member, please see our Membership Information.