> guess which fucking way it goes for every packet given that the call
> from each network card driver will result with "buflen = 0".  I presume
> this hack is here so that the code works for both drivers and when you
> do "tcpdump -r".

Be careful.  Last I checked, a non-trivial number of kernel drivers
use bpf_tap, which hands bpf a (base, length) pair.

> anyway, now that I've grumbled, I'll probably set about fixing this up
> in one way or another.  for starters, I'd like to see different damn
> prototypes for kernel/non-kernel

How about different *function names* in that case, too..

					- Bill