slides - PDOS - MIT
slides - PDOS - MIT
slides - PDOS - MIT
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Solution: Berkeley Packet Filter (BPF)ip*src*net*not*(18.26.5.0/24*or*18.0.0.0/24)tcpdumpkernelInputs tobytecodeHostsystem********ldh****[12]********jeq****#ETHERTYPE_IP,*L1,*L4L1:*****ld*****[26]********and****#0xffffff00********jeq****#0x121a0500,*L4,*L2L2:*****jeq****#0x12010200,*L4,*L3L3:*****ret****#TRUEL4:*****ret****#0Bytecodeprogram***** ***** packetsBPF interpreterFilteredpackets✔ Flexibility✔ Performance —— no IPC & context switch overhead✔ “Security” —— no direct control of the real machine