Subject: Re: Conditionalize expensive BPF operation
To: None <>
From: Andrew Brown <>
List: tech-net
Date: 05/01/2001 09:44:17
>>  - M_PREPEND() some space, or copyup all contents to a buffer
>>  - fill in a faked ethernet header (hopefully identical to the one
>>    later added in ether_output
>>  - add the encapsulation info in front of the ethernet header
>>  - pass this to bpf
>	for bpf on pppoe interface, i guess we should not prepend ethernet
>	header.  my understanding is that:
>	- pppoe interface should prepend ppp header and pass it to bpf
>	- if you want to look at ether header, run tcpdump on ethernet
>	  interface
>	am i wrong?

that sounds reasonable to me.  if someone wants just the ppp encap
header, then they can tcpdump the ppp interface.

gre/gif works the same way, yes?

|-----< "CODE WARRIOR" >-----|             * "ah!  i see you have the internet (Andrew Brown)                that goes *ping*!"       * "information is power -- share the wealth."