[annoyed as ever about never being cc:ed on this stuff]
On Wed, Oct 17, 2007 at 01:21:31PM -0700, Stephen Hemminger wrote:
And various crashdump over network tools.
It's a completely useless hook for a binary network stack. It only
supports UDP and only point to point. And it will have crap
performance. It's much less useful here than, say, TUN/TAP.
It doesn't buy anything for a rootkit either, which will continue to
trivially hide servers in userspace as they already do.
This point is completely FUD.
This is correct. It also applies to the TX side of things. The point,
of course, is to bypass as much of the stack as possible so that when
the kernel crashes, we're more likely to actually get our netpoll
data.
Let's hear about this better alternative first, shall we? I for one am
a little skeptical of its existence. Going through a larger fraction
of the network stack, running softirqs, etc., are all big (potentially
fatal) steps backward from the point of view of a debugger.
--
Mathematics is the supreme nostalgia of our time.
-