Subject: Re: /dev/tap and tcpdump don't go together very well? [conclusion & diff]
To: Anders Hjalmarsson <email@example.com>
From: Rhialto <firstname.lastname@example.org>
Date: 04/12/2007 22:38:42
On Wed 11 Apr 2007 at 23:51:55 +0200, Anders Hjalmarsson wrote:
> This patch is based on something Manuel Bouyer posted some years ago, but
> fixed so that two bpf-using programs on the same host can communicate,
> e.g. simh-vax and mopd.
Yes, that is nice. I assume though that a bpf reader will get its own
packets back though (if they pass the filter).
I wonder, by the way, why this patch is adding code in ether_output() in
if_ethersubr.c. I was thinking to add some code (much like this) in
bpf_write() in bpf.c, near the call to (*ifp->if_output)(). That would
only inspect packets injected into bpf, not all outgoing packets to all
___ Olaf 'Rhialto' Seibert -- You author it, and I'll reader it.
\X/ rhialto/at/xs4all.nl -- Cetero censeo "authored" delendum esse.