Implementation Status
Two subsystems
- System call and Packet detection engines (SDE, PDE)
System call runtime system
- in-kernel implementation
- portable runtime implementation underway
Packet runtime system
- uses Berkeley Packet Filter derived code
- in-kernel implementation planned