Wireshark-dev: Re: [Wireshark-dev] Are Capture Filters Implemented in Software or the Network C

From: Gene Cumm <gene.cumm@xxxxxxxxx>
Date: Sun, 21 Nov 2021 21:36:03 -0500


On Sun, Nov 21, 2021, 2:07 PM Guy Harris <gharris@xxxxxxxxx> wrote:
The filtering is *not* done in the network adapter (which isn't necessarily a card - it could be built into the computer); an adapter that does the filtering itself could probably be built, and libpcap could be modified to recognize cards that can do filtering and to tell the adapter's driver, rather than the kernel's packet capture mechanism, what the filter program is.  I don't know of any adapters of that sort, however, and libpcap currently has no code to do so.

I'd still consider LoMs "cards" in a loose sense but that's me. 

FPGA-based network acquisition cards do implement filters in "hardware" (not in the system CPU).  Napatech, Accolade, Silicom and Chelsio have products.