Subject: Re: Conditionalize expensive BPF operation
To: Andrew Brown <>
From: None <>
List: tech-net
Date: 05/02/2001 00:13:08
>>>  - M_PREPEND() some space, or copyup all contents to a buffer
>>>  - fill in a faked ethernet header (hopefully identical to the one
>>>    later added in ether_output
>>>  - add the encapsulation info in front of the ethernet header
>>>  - pass this to bpf
>>	for bpf on pppoe interface, i guess we should not prepend ethernet
>>	header.  my understanding is that:
>>	- pppoe interface should prepend ppp header and pass it to bpf
>>	- if you want to look at ether header, run tcpdump on ethernet
>>	  interface
>>	am i wrong?
>that sounds reasonable to me.  if someone wants just the ppp encap
>header, then they can tcpdump the ppp interface.
>gre/gif works the same way, yes?

	yes.  gif interface uses DLT_NULL (af # only), and if you want to see
	encapsulating (outer) header, tap on real ethernet interface.