kbara

libpcap version 1.5.3 ``` % tcpdump -ntr ../tests/data/tcp-ack-66-bytes.pcap '1 == 1 and 1

Is "ether[1] > tcp[100] or ip" really equivalent to ip, even given that it's an ipv4 packet? My understanding is that an out-of-bounds packet access makes the whole expression fail,...

Thank you for the link to the keynote; the slides on libpcap's history are quite interesting, and provide some perspective. But, going back to the bug report: I see two...

On the off-chance it's marginally interesting, `tcp[10000] != 0 or tcp` displays the same disparity in behaviour on the sample packet.

I'm not assuming C-style short-circuit behaviour; it's not consistent with what tcpdump shows with the optimizer enabled, although I can't think of an unoptimized expression off-hand which is not compatible...

I think that is probably too much of a breaking change, given the amount of history libpcap has, and how widely it is used. What do you think about the...

I haven't had a chance to look at it closely, but I know @DRMacIver has been doing some interesting automated performance regression tests on Hypothesis. Re: @lukego , I tend...

That is incredibly shiny.

If this is feasible, it would be excellent in many ways. The only downside is that it'll absolutely fully load a whole CPU core, and the budget per packet will...

If no one has stepped up by March, I'm interested. I'd really like to see this.