Subject: Re: mbuf and network question...
To: Ignatios Souvatzis <>
From: Andrew Brown <>
List: tech-net
Date: 08/18/2000 17:26:20
>> it strikes me, though, that the ethernet layer strips off the ethernet
>> header before passing it up, so this piece of information is lost.  or
>> is it?
>Thats right. The reason is, that there are quite different hardware types 
>possible... implenetned in NetBSD, at least
>- Ethernet/FDDI (always 2*6bytes MAC and 2 bytes protocol type)
>- Token Ring (2*6bytes MAC + source routing chain + see above)
>- ARCnet (3, 6, or 10 byte header with 1 byte HW addresses)
>The inner ARCnet packet contains all of this, + length indications, so that
>it can be handled type independent. 

that part i knew, and the explanation is quite intuitive, though it's
still nice to know that i understand parts of this.  :)

>I guess a hardware layer (if_arcsubr.c, if_ethersubr.c etc.) could have an
>option to log inner address != outer address.

it'd then have to be handling some arp stuff in the link layer which
is probably not ideal.  arp being an upper layer and all...

>For the special case of Ethernet, you can quickly wire up a BPF filter to 
>log those events, if you need them *now*.

i kinda wanted them for the kernel, so that the arp layer could tell
you where the responses come from that it's rejecting.

|-----< "CODE WARRIOR" >-----|             * "ah!  i see you have the internet (Andrew Brown)                that goes *ping*!"       * "information is power -- share the wealth."