Subject: Re: Conditionalize expensive BPF operation
To: None <firstname.lastname@example.org>
From: Andrew Brown <email@example.com>
Date: 05/01/2001 09:44:17
>> - M_PREPEND() some space, or copyup all contents to a buffer
>> - fill in a faked ethernet header (hopefully identical to the one
>> later added in ether_output
>> - add the encapsulation info in front of the ethernet header
>> - pass this to bpf
> for bpf on pppoe interface, i guess we should not prepend ethernet
> header. my understanding is that:
> - pppoe interface should prepend ppp header and pass it to bpf
> - if you want to look at ether header, run tcpdump on ethernet
> am i wrong?
that sounds reasonable to me. if someone wants just the ppp encap
header, then they can tcpdump the ppp interface.
gre/gif works the same way, yes?
|-----< "CODE WARRIOR" >-----|
firstname.lastname@example.org * "ah! i see you have the internet
email@example.com (Andrew Brown) that goes *ping*!"
firstname.lastname@example.org * "information is power -- share the wealth."