> The author of PR 1693 suggests to not show these packets to BPF at all
> (that is, only bpf_mtap() them if they come from a IFF_LOOPBACK
> interface).
> 
> On the other hand, the author of PR 2973 suggests ways to show them
> correctly.

The latter was me.  In the mean time I've changed my mind to effectively
the former solution.  This is easier to implement and doesn't really loose
any information as the packet was already delivered to bpf.  The only
drawback is that duplex interfaces are seeing the packets twice while
simplex interfaces see it only once.

BTW, technically the current way of doing things in this case gets the
supposedly input packet (via the looutput) before the actual output packet
(through the interface output routine).  Should the problem be fixed in the
way described in my pr, this should probably be addressed, too.
--
ws@TooLs.DE     (Wolfgang Solfrank, TooLs GmbH) 	+49-228-985800