> Looks fine to me. Why don't you change bcopy -> memcpy, then int
> to uint32_t consistently and send-pr it. The only question is what
> is the effect on if_faith.c where you are actually changing the
> current behavior.

i'll do that.

just to be clear, the behaviour of if_faith (as seen by a user process
writing to a bpf socket) does not change.  internally, the faith output
function changes, but the user api does not.

my only query is what to do about if_ppp.  i'll look into changing it to
be DLT_PPP rather than DLT_NULL.

Thanks for your feedback

Matthew