zmap/zmap — pull request #170 by MrPumo (2014-05-29 08:51:24+00:00)
Title: Improve pcap filter to avoid unusefull pkt get processed (feedback only)

If I'm not wrong, it seems to me that function "validate_packet" get called for each pkt matching pcap_filter (that is statically defined at compilation time). Then inside "validate_packet" code avoid processing unusefull pkt.

For some probe the pcap filter defined at compile time (with pkt's flag matching) can avoid this, but for other like udp probe this can't be done.

Why not reduce always calls to "validate packet" only to received usefull pkt?

This patch get pcap_filter CALCULATED AT RUNTIME to exclude:
- pkt generated from first scan host ip (to be improved for include source-ip range....)
- pkt received on multicast ip address (to check if can be improved avoiding promisc mode)

Feel free to comment..
MP