>Number:         8052
>Category:       lib
>Synopsis:       wrong behaviour of packet filtering over PPP interfaces
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    lib-bug-people (Library Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 23 19:50:01 1999
>Last-Modified:
>Originator:     Paulo A. P. Pires
>Organization:
	Familia Pires
>Release:        NetBSD-current 1999/07/20
>Environment:
System: NetBSD mateus.ppires.org 1.4G NetBSD 1.4G (MATEUS-19990720) #0: Wed Jul 21 00:44:28 EST 1999 Pappires@mateus.ppires.org:/usr/src/sys/arch/i386/compile/MATEUS-19990720 i386
/usr/lib/libpcap.a
/usr/lib/libpcap.so
/usr/lib/libpcap.so.1
/usr/lib/libpcap.so.1.0
/usr/lib/libpcap_p.a
/usr/lib/libpcap_pic.a
IPF/NAT enabled.
ne1 installed as 0x300/10, modem is USR Sportster 33600 internal.
Tried with kernels with both IPv6 enabled and disabled, with same results.


>Description:
	Trying to use packet filters on PPP interfaces produces wrong
	results for any filtering expression other than default.  The
	problem doesn't seem to occur over ethernet interfaces ever,
	with similar expressions or even much more complex ones.

	This affects both tcpdump and pppd active/pass filters, so it
	makes me think that the problem is in libpcap (but perhaps it
	is in kernel bpf/ppp implementation?).

	This problem is prticularly annoying because it renders dial
	on demand PPP filtering unusable.

	This problem has been happening with my i386 machines since
	at least 1.4E (never noticed it until 1.4C).

>How-To-Repeat:
	# ping any_host_accross_ppp_link      (or any network app.)

	[switch to another tty]

	# tcpdump -n -i ppp0 host any_host_accross_ppp_link
	[ no packages will be shown ]

>Fix:
	Unknown.
>Audit-Trail:
>Unformatted: