Subject: Re: Conditionalize expensive BPF operation
To: Andrew Brown <email@example.com>
From: None <firstname.lastname@example.org>
Date: 05/02/2001 00:13:08
>>> - M_PREPEND() some space, or copyup all contents to a buffer
>>> - fill in a faked ethernet header (hopefully identical to the one
>>> later added in ether_output
>>> - add the encapsulation info in front of the ethernet header
>>> - pass this to bpf
>> for bpf on pppoe interface, i guess we should not prepend ethernet
>> header. my understanding is that:
>> - pppoe interface should prepend ppp header and pass it to bpf
>> - if you want to look at ether header, run tcpdump on ethernet
>> am i wrong?
>that sounds reasonable to me. if someone wants just the ppp encap
>header, then they can tcpdump the ppp interface.
>gre/gif works the same way, yes?
yes. gif interface uses DLT_NULL (af # only), and if you want to see
encapsulating (outer) header, tap on real ethernet interface.