On Jan 23, 2011, at 4:40 PM, Andrej van der Zee wrote:
> Aha memory mapped between kernel and user-space, good.
Note that I said "might"; the platforms and interfaces where that happens are
1) regular network interfaces on reasonably recent Linuxes (I think the memory-mapped mechanism has been around for several years) and sufficiently recent libpcap (1.0.0 and later);
2) USB (not "USB network interfaces" - those are covered under "regular network interfaces" - but raw USB bus sniffing) on sufficiently recent Linuxes and sufficiently recent libpcap (1.1.0 and later; 1.0.0 USB capture support had a number of bugs);
3) regular network interfaces on, I think, FreeBSD 8.0 and later.
On other platforms and other adapters, there's a copy from the kernel to userland.
