Subject: Re: Conditionalize expensive BPF operation
To: Martin Husemann <martin@duskware.de>
From: None <itojun@iijlab.net>
List: tech-net
Date: 05/01/2001 12:15:27
>What I would do for a packet passed down to this interface is:
> - M_PREPEND() some space, or copyup all contents to a buffer
> - fill in a faked ethernet header (hopefully identical to the one
> later added in ether_output
> - add the encapsulation info in front of the ethernet header
> - pass this to bpf
for bpf on pppoe interface, i guess we should not prepend ethernet
header. my understanding is that:
- pppoe interface should prepend ppp header and pass it to bpf
- if you want to look at ether header, run tcpdump on ethernet
interface
am i wrong?
itojun