Subject: Re: mbuf and network question...
To: Ignatios Souvatzis <firstname.lastname@example.org>
From: Andrew Brown <email@example.com>
Date: 08/18/2000 17:26:20
>> it strikes me, though, that the ethernet layer strips off the ethernet
>> header before passing it up, so this piece of information is lost. or
>> is it?
>Thats right. The reason is, that there are quite different hardware types
>possible... implenetned in NetBSD, at least
>- Ethernet/FDDI (always 2*6bytes MAC and 2 bytes protocol type)
>- Token Ring (2*6bytes MAC + source routing chain + see above)
>- ARCnet (3, 6, or 10 byte header with 1 byte HW addresses)
>The inner ARCnet packet contains all of this, + length indications, so that
>it can be handled type independent.
that part i knew, and the explanation is quite intuitive, though it's
still nice to know that i understand parts of this. :)
>I guess a hardware layer (if_arcsubr.c, if_ethersubr.c etc.) could have an
>option to log inner address != outer address.
it'd then have to be handling some arp stuff in the link layer which
is probably not ideal. arp being an upper layer and all...
>For the special case of Ethernet, you can quickly wire up a BPF filter to
>log those events, if you need them *now*.
i kinda wanted them for the kernel, so that the arp layer could tell
you where the responses come from that it's rejecting.
|-----< "CODE WARRIOR" >-----|
firstname.lastname@example.org * "ah! i see you have the internet
email@example.com (Andrew Brown) that goes *ping*!"
firstname.lastname@example.org * "information is power -- share the wealth."