Re: /dev/tap and tcpdump don't go together very well?

[Rhialto <rhialto%falu.nl@localhost>]

On Sun 08 Apr 2007 at 16:21:48 +0200, Rhialto wrote:
> BPF sees packets that come in from the wire and optionally (default
> on; BIOCSSEESENT; apparently undocumented) the packets that the host
> sends to the wire.

This seems to be documented now in bpf(4).

> Packets injected into BPF are sent to the wire only, not to the host.

FreeBSD now apparently has an ioctl for this:

     BIOCFEEDBACK    (u_int) Set packet feedback mode.  This allows injected
                     packets to be fed back as input to the interface when
                     output via the interface is successful.  When BPF_D_INOUT
                     direction is set, injected outgoing packet is not
                     returned by BPF to avoid duplication. This flag is ini-
                     tialized to zero by default.

-Olaf.
-- 
___ Olaf 'Rhialto' Seibert    -- You author it, and I'll reader it.
\X/ rhialto/at/xs4all.nl      -- Cetero censeo "authored" delendum esse.