Current-Users archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: NPF on 8.1 and pcap-filter expressions (Frank Kardel) writes:

>I just tripped over:
>   pass in final pcap-filter "ip multicast or ip6 multicast"

>flawlessly compiles ... but:
>   pass in final pcap-filter "ip broadcast"

>gives in "npf validate"
>/etc/npf.conf:xx:9: invalid pcap-filter(7) syntax

>although man 7 pcap-filter says otherwise and tcpdump gladly accepts ip 

from libpcap:

        case Q_IP:
                 * We treat a netmask of PCAP_NETMASK_UNKNOWN (0xffffffff)
                 * as an indication that we don't know the netmask, and fail
                 * in that case.
                if (cstate->netmask == PCAP_NETMASK_UNKNOWN)
                        bpf_error(cstate, "netmask not known, so 'ip broadcast'
not supported");

npfctl compiles the filter expression with PCAP_NETMASK_UNKNOWN, there
is no netmask it could apply.

                                Michael van Elst
                                "A potential Snark may lurk in every tree."

Home | Main Index | Thread Index | Old Index