2 ms·
Indeed. There's a great talk about those early days at https://www.youtube.com/watch?v=XHlqIqPvKw8 https://www.youtube.com/watch?v=XHlqIqPvKw8 ; I'd recommend a
by jsnell 11y ago
Indeed. There's a great talk about those early days at https://www.youtube.com/watch?v=XHlqIqPvKw8 https://www.youtube.com/watch?v=XHlqIqPvKw8 ; I'd recommend anyone who is interested in the design and implementation of little languages to watch that. Few things will make a language designer throw out everything and restart from scratch, but I guess having Van Jacobson dismiss the initial design as unusable would do it!
But after that common starting point they quickly developed lives of their own, and should not be treated as a single unit. You'll get things like pflua as a completely distinct implementation of the filtering language compiling to lua instead of BPF, pfmatch with language extensions that are not really compilable to BPF, seccomp and other uses of BPF in the Linux kernel for things that have nothing at all to do with packet processing, a (e)BPF code generator backend in LLVM, and so on.
- tptacek 11y agoBPF and libpcap are certainly separable, but tcpdump is practically just the test driver program for libpcap. :)