core: optimize BPF filter

When monitoring high trafic interfaces, the BPF filter can become
quite important. We optimize it a bit by first checking if the
ethernet address is a multicast one. If it is not, we only have to
check for EDP.

diff --git a/CHANGELOG b/CHANGELOG
index 5539adf84a343f259582ea179fa4043f588ebac8..49744f2be53762216c96af69f81880f18be74ca9 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -4,6 +4,7 @@ lldpd (0.5.6)
     + Add a whitelist for some drivers (currently: dsa and veth)
   * Fixes:
     + Compilation issues with NetSNMP 5.7 (and with earlier versions too)
+    + Small optimization of BPF filter
 
 lldpd (0.5.5)
   * Features:

diff --git a/src/interfaces.c b/src/interfaces.c
index 312189e365542bb094c8192485b63027180c6c19..c35bc8405dda5f7e42b861135a431550939f402d 100644 (file)
--- a/src/interfaces.c
+++ b/src/interfaces.c
@@ -46,28 +46,42 @@
 /* CDP: "ether dst 01:00:0c:cc:cc:cc" */
 /* SONMP: "ether dst 01:00:81:00:01:00" */
 /* EDP: "ether dst 00:e0:2b:00:00:00" */
-#define LLDPD_FILTER_F                 \
-       { 0x20, 0, 0, 0x00000002 },     \
-       { 0x15, 0, 7, 0xc200000e },     \
-       { 0x28, 0, 0, 0x00000000 },     \
-       { 0x15, 0, 16, 0x00000180 },    \
-       { 0x28, 0, 0, 0x0000000c },     \
-       { 0x15, 13, 0, 0x000088cc },    \
-       { 0x15, 0, 13, 0x00008100 },    \
-       { 0x28, 0, 0, 0x00000010 },     \
-       { 0x15, 10, 11, 0x000088cc },   \
-       { 0x15, 0, 2, 0x2b000000 },     \
-       { 0x28, 0, 0, 0x00000000 },     \
-       { 0x15, 7, 8, 0x000000e0 },     \
-       { 0x15, 1, 0, 0x0ccccccc },     \
-       { 0x15, 0, 2, 0x81000100 },     \
-       { 0x28, 0, 0, 0x00000000 },     \
-       { 0x15, 3, 4, 0x00000100 },     \
-       { 0x15, 0, 3, 0x52cccccc },     \
-       { 0x28, 0, 0, 0x00000000 },     \
-       { 0x15, 0, 1, 0x000001e0 },     \
-       { 0x6, 0, 0, 0x0000ffff },      \
+/* For optimization purpose, we first check if the first bit of the
+   first byte is 1. if not, this can only be an EDP packet:
+
+   tcpdump -dd "(ether[0] & 1 = 1 and
+                 ((ether proto 0x88cc and ether dst 01:80:c2:00:00:0e) or
+                  (ether dst 01:e0:52:cc:cc:cc) or
+                  (ether dst 01:00:0c:cc:cc:cc) or
+                  (ether dst 01:00:81:00:01:00))) or
+                (ether dst 00:e0:2b:00:00:00)"
+*/
+
+#define LLDPD_FILTER_F                         \
+       { 0x30, 0, 0, 0x00000000 },             \
+       { 0x54, 0, 0, 0x00000001 },             \
+       { 0x15, 0, 14, 0x00000001 },            \
+       { 0x28, 0, 0, 0x0000000c },             \
+       { 0x15, 0, 4, 0x000088cc },             \
+       { 0x20, 0, 0, 0x00000002 },             \
+       { 0x15, 0, 2, 0xc200000e },             \
+       { 0x28, 0, 0, 0x00000000 },             \
+       { 0x15, 12, 13, 0x00000180 },           \
+       { 0x20, 0, 0, 0x00000002 },             \
+       { 0x15, 0, 2, 0x52cccccc },             \
+       { 0x28, 0, 0, 0x00000000 },             \
+       { 0x15, 8, 9, 0x000001e0 },             \
+       { 0x15, 1, 0, 0x0ccccccc },             \
+       { 0x15, 0, 2, 0x81000100 },             \
+       { 0x28, 0, 0, 0x00000000 },             \
+       { 0x15, 4, 5, 0x00000100 },             \
+       { 0x20, 0, 0, 0x00000002 },             \
+       { 0x15, 0, 3, 0x2b000000 },             \
+       { 0x28, 0, 0, 0x00000000 },             \
+       { 0x15, 0, 1, 0x000000e0 },             \
+       { 0x6, 0, 0, 0x0000ffff },              \
        { 0x6, 0, 0, 0x00000000 },
+
 static struct sock_filter lldpd_filter_f[] = { LLDPD_FILTER_F };
 
 /* net/if.h */