Subject: Re: Conditionalize expensive BPF operation
To: Martin Husemann <>
From: None <>
List: tech-net
Date: 05/01/2001 12:15:27
>What I would do for a packet passed down to this interface is:
>  - M_PREPEND() some space, or copyup all contents to a buffer
>  - fill in a faked ethernet header (hopefully identical to the one
>    later added in ether_output
>  - add the encapsulation info in front of the ethernet header
>  - pass this to bpf

	for bpf on pppoe interface, i guess we should not prepend ethernet
	header.  my understanding is that:
	- pppoe interface should prepend ppp header and pass it to bpf
	- if you want to look at ether header, run tcpdump on ethernet
	am i wrong?