I thought there would theoretically develop a firewall based on a bunch of daemons in Plan9 in the image and likeness of the FreeBSD Netgraph (by mounting each other file hooks provided by file server nodes (I made a similar analogy)). By good understanding, it will turn out badly - the package will go through the path of switching tasks as much as I put the nodes in its path. In the case of the FreeBSD Netgraph located in the kernel, this does not happen. Or, if you still pull packets out of the buffer (and tcp / ip is already a software buffer, that is, it can always be implemented, something like netgraph_iface) and transmit in blocks, then the negative effect I described will not be Is it theoretically possible to achieve quite acceptable results even in userspace?