>> it strikes me, though, that the ethernet layer strips off the ethernet
>> header before passing it up, so this piece of information is lost.  or
>> is it?
>
>Thats right. The reason is, that there are quite different hardware types 
>possible... implenetned in NetBSD, at least
>
>- Ethernet/FDDI (always 2*6bytes MAC and 2 bytes protocol type)
>- Token Ring (2*6bytes MAC + source routing chain + see above)
>- ARCnet (3, 6, or 10 byte header with 1 byte HW addresses)
>
>The inner ARCnet packet contains all of this, + length indications, so that
>it can be handled type independent. 

that part i knew, and the explanation is quite intuitive, though it's
still nice to know that i understand parts of this.  :)

>I guess a hardware layer (if_arcsubr.c, if_ethersubr.c etc.) could have an
>option to log inner address != outer address.

it'd then have to be handling some arp stuff in the link layer which
is probably not ideal.  arp being an upper layer and all...

>For the special case of Ethernet, you can quickly wire up a BPF filter to 
>log those events, if you need them *now*.

i kinda wanted them for the kernel, so that the arp layer could tell
you where the responses come from that it's rejecting.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."