How LANeye works - Low CPU load.

Low CPU load - LANeye loads your CPU less than 1% (measured on a 2GHz machine). Even on heavily load Gigabit networks LANeye will not slow your computer down. This is due to the LANeye design, using a Service and a network driver with a BPF filter (Berkeley Packet Filter).

Earlier versions of LANeye was running the network card in promiscuous mode with a potential risk of overloading the CPU. This was changed starting with version 2.0 and have been improved even further in LANeye 2.3.

LANeye Service and BPF network structure

LANeye uses a BPF filter that runs in the kernel and prior to any network packet buffering. The BPF filters out the packets LANeye focused monitors. LANeye monitor the following packets:

All broadcast packets.
Directed ARP
Directed ICMP
Directed Name resoluting NetBT UDP

The BPF runs in the kernel on a pseudo machine and are written in assembler that makes the filter extremely fast. Running this filter at the source of the incoming network traffic adds no overhead from the higher-level NDIS layer and no overhead from the protocol stacks.

When sending blocking packets, LANeye benefits from this design and do not have to send network packets through the protocol stacks. As the picture shows LANeye can send network packets directly to the Link-Layer driver. In reality this gives LANeye priority over other network transactions when sending blocking packets.

BPF Foot note - BPF origin from the UNIX Enet packet filter by Mike Accetta and Rick Rashid at Carnegie Mellon University in 1980. Steve McCanne and Van Jacobson, both of Berkeley Laboratory implemented BPF in 1990. Thomas F Divine of Printing Communication Assoc. ported BPF pseudo-machine to Microsoft Windows Platform in 1997.