Streamline / News: Recent posts

Streamline 1.7.0 released

The focus of this release was on increasing robustness, not feature-set. I fixed longstanding architectural bugs and cleaned up the sourcecode, to make it easier for new people to contribute. As I changed some interfaces the release will change minor number: from 1.6.x to 1.7.0.

As always, have a look at the subversion log for more detailed changes, at read more

Posted by Willem de Bruijn 2007-05-07

Streamline 1.6.3 released

Today we released version 1.6.3 of Streamline, a stream-based network subsystem for Linux.

This first release in over a half year has been thorougly stress-tested, so it should be more stable. New features include support for named and unnamed pipes, the full POSIX file IO interface, a write-after-read optimization similar to splicing, a method for catching HTTP GET requests and self-resizing (based on load) ringbuffer designs. Please read the changelog for more details.

Posted by Willem de Bruijn 2007-02-02

Streamline 1.6.2 released

today we released a bugfix edition of streamline, a flexible network stack for Linux. This version adds support for libpcap-based applications and autoconfiguration of optional features. But mostly it fixes numerous bugs related to userspace/kernelspace communication

Posted by Willem de Bruijn 2006-06-05

Streamline 1.6.1 released

This new version of streamline fixes some bugs, fixes the GUI and the big-endian (ARM) targets and adds support for solaris.

Posted by Willem de Bruijn 2006-05-30

Streamline 1.6 released

Today marks the first release of Streamline (formerly FFPF) in 3 months' time. For this release we fixed all outstanding application bugs, re-enabled kernelspace processing and replaced the controlplane with a version that is ready for distributed operation.

Posted by Willem de Bruijn 2006-05-15

FFPF becomes Streamline

Today the Fairly Fast Packet Filter (FFPF) gets a new name. FFPF started as a packet filter system, somewhat similar to BPF. With the addition of stream reassembly and non-filtering functions such as rewriting the software no longer fits its original name. That, and noone seemed to be able to remember it anyway. Therefore we renamed FFPF to something simple: Streamline. Versions continue from where we left them. The next Streamline version will be 1.6

Posted by Willem de Bruijn 2006-05-15

progress update

it has been a while since we released 1.5.0 and as the next version will be at least a week, but probably more like 3 away, I decided to write this small update.

with the help of some guinea pigs at the office we managed to find and squash quite a few simple bugs in version 1.5.0. Unfortunately, I fixed these issues in the same cvs commit in which I broke the controlplane. If I had been smarter a would have been out by last week. My apologies.... read more

Posted by Willem de Bruijn 2006-03-16

FFPF 1.5.0 released

Today marks the first major update to the Fairly Fast Packet Filter (FFPF) in two years. The most fundamental additions are TCP stream reassembly and accompanying continuous stream handling (as opposed to only per-packet).

Additionally, the framework has been overhauled to squash hard-to-reach bugs, allow more complex processing and increase performance. Read the Changelog for other changes.

Posted by Willem de Bruijn 2006-02-20

FFPF 1.3.5 released

Today we released a bugfix update to the stable line (1.3) of the fairly fast packet filter, a high-performance packet filtering subsystem for Linux. This fix enables support for recent kernels and fixes two huge memory leaks.

Posted by Willem de Bruijn 2006-02-12

FFPF 1.5b1: the 'ho ho ho' release available

today we released the 2nd and last beta of the Fairly Fast Packet Filters's 1.5 branch. FFPF is a stream-based networking subsystem for Linux that spans from hardware to userspace to offer high-speeds and versatile interfaces. This update makes 1.5 functionally as complete as 1.4, adds a new command-line application, multiple buffers and probably many bugs :) happy holidays!

Posted by Willem de Bruijn 2005-12-25

new documentation online

today I added some additional documentation to the FFPF website. Under the "research" tab you can find slides from a few talks, a new techreport, and html versions of the existing content.

Posted by Willem de Bruijn 2005-12-05

ffp 1.5 beta 0 released

today we've put online the first milestone to release 1.5 of the fairly fast packet filter, a high-performance datastream processing framework for Linux. Changes to the core are too many to mention here. Visit for the release notes.

Posted by Willem de Bruijn 2005-11-19

FFPF 1.4b released, next will be 1.5

today we've released the latest version of our network monitoring framework, Fairly Fast Packet Filter (FFPF). This latest version, 1.4, adds new processing functions, an easier API with examples, a GUI toolkit with examples, support for userspace processing, IXP2x00 support, and many more features.

unfortunately, there's also a snag: A big bad bug that is closely related to the FFPF APIs has kept back distribution. We've finally decided to open op the code regardless. What this means is that we will release 1.4 as everlasting beta. In the next version we will have to rewrite the APIs making it 1.5 (or 2). There will be no 1.4.1

Posted by Willem de Bruijn 2005-11-01

where's 1.4?

about a month ago I promised the new version of FFPF would be out `very soon now'. The good news is that it will; very soon now. The bad news is that I can't give any promises regarding the deadline.

Basically, it is as follows: we have everything implemented, only exporting of data to the application is very ugly. A master student is working on this (paid), so it will be finished, in which case we can stabilize the API. That version will be 1.4.0, as usual there will only be bugfixes afterwards.... read more

Posted by Willem de Bruijn 2005-05-31

ffpf newsflash: en-route to 1.4

the fairly fast packet filter has made some exiting advances in the last few months. After a shamefully long radiosilence we can now tell you what will be part of the next major release (1.4).

For end-users

1. a new front-end with a more expressive input language.
2. a graphical user interface that handles the task of constructing input request for you.
3. a clear separation between front-end (parser) and back-end (the packet filtering)... read more

Posted by Willem de Bruijn 2005-04-26

fairly fast packet filter 1.3.4: 'santa cruz' released

today we've released what we consider the most stable version yet of the fairly fast packet filter. Version 1.3.4 sports zarroo new features, but plenty of bugfixes, stabilization updates and build process improvements.

As noted in the changelog, we still have some open issues regarding building FFPF. Please help us make 1.3.5 even better by sending in your feedback reports: succes stories and failure logs.

Posted by Willem de Bruijn 2004-12-04

FFPF 1.3.3 released

Today we released version 1.3.3 of FFPF, a network monitoring framework for linux. This new release removes two bugs in the build script: a missing makefile and a warning on systems with older kernel headerfiles

Posted by Willem de Bruijn 2004-11-13

FFPF 1.3.2 released: bugfix and pcap build script

Following on the heels of our 1.3.1 bugfix release, here is the 1.3.2 release of FFPF, a network monitoring framework for linux. Changes are (1) the addition of a script that automatically builds libpcap and tcpdump with FFPF as back-end instead of LSF and (2) removal of code that lead to deprecated warnings.

Posted by Willem de Bruijn 2004-10-28

1.3.1 (bugfix) released

today we've released version 1.3.1 of the fairly fast packet filter, a network monitoring framework for linux. This release fixes a number of nasty bugs that kept FFPF from compiling on clean machines.

Posted by Willem de Bruijn 2004-10-25

FFPF 1.3 developer reference documentation online

As we updated the sourcecode to FFPF last week, we have now also updated and greatly improved the developer documentation. All sourcecode is documented in doxygen style.

A lot of background information can be found in the header files, while more specific reference info is attached to each structure and function.

Posted by Willem de Bruijn 2004-07-18

long overdue stable FFPF release (1.3)

The Fairly Fast Packet Filter (FFPF) is a packet filtering environment for Linux. This latest version, 1.3, is a complete rewrite of the codebase. The most important new feature is that users can connect filters (such as bpf, a stringsearch or packetcounter) in a graphlike structure. FFPF is both an API as well as a command-line utility. It can also be used as a more versatile and efficient drop in replacement for linux's libpcap backend.... read more

Posted by Willem de Bruijn 2004-07-15

linux kernel compatibility toolkit released

The LKCT contains various datastructures and routines that I created while
programming on the Fairly Fast Packet Filter (FFPF), an application that both has to
be able to run in kernel- and userspace.

During development I found certain what I feel are generic tools missing in kernelspace.
These tools first became part of FFPF, but later on I decided to repackage them and
move them out of the main tree. This is the result.... read more

Posted by Willem de Bruijn 2004-04-05

first release

FFPF version 1.1, our first sourceforge release, was distributed yesterday. The current version of this framework for network monitoring under Linux supports libpcap and is considered stable enough for initial testing by developers and administrators.

FFPF 1.1 and subsequent versions can be downloaded as raw sourcecode, or together with an installer that (optionally) builds and installs additional libraries and programs, such as a patched libpcap.... read more

Posted by Willem de Bruijn 2004-03-12