Subject: Re: /dev/tap and tcpdump don't go together very well? [conclusion & diff]
To: Anders Hjalmarsson <>
From: Rhialto <>
List: current-users
Date: 04/12/2007 22:38:42
On Wed 11 Apr 2007 at 23:51:55 +0200, Anders Hjalmarsson wrote:
> This patch is based on something Manuel Bouyer posted some years ago, but
> fixed so that two bpf-using programs on the same host can communicate,
> e.g. simh-vax and mopd.

Yes, that is nice. I assume though that a bpf reader will get its own
packets back though (if they pass the filter).

I wonder, by the way, why this patch is adding code in ether_output() in
if_ethersubr.c. I was thinking to add some code (much like this) in
bpf_write() in bpf.c, near the call to (*ifp->if_output)(). That would
only inspect packets injected into bpf, not all outgoing packets to all

___ Olaf 'Rhialto' Seibert      -- You author it, and I'll reader it.
\X/ rhialto/at/        -- Cetero censeo "authored" delendum esse.