Packet Filter Hooks
Beginning with the Solaris Express, Developer Edition 2/07 release, packet filter hooks replace
the pfil module to enable Solaris IP filter. In previous Solaris releases, configuration
of the pfil module was required as an additional step to set up
Solaris IP Filter. This extra configuration requirement increased the risk of errors that
would cause Solaris IP Filter to work improperly. The insertion of the pfil
STREAMS module between IP and the device driver also caused performance degradation. Lastly, the
pfil module could not perform packet interception between zones.
The use of packet filter hooks streamlines the procedure to enable Solaris IP
Filter. Through these hooks, Solaris IP Filter uses pre-routing (input) and post-routing (output)
filter taps to control packet flow into and out of the Solaris system.
Packet filter hooks eliminate the need for the pfil module. Thus the following
components that are associated with the module are also removed.
For tasks associated with enabling Solaris IP Filter, see Chapter 26, Solaris IP Filter (Tasks).