Subject: Re: Conditionalize expensive BPF operation
To: Martin Husemann <martin@duskware.de>
From: None <itojun@iijlab.net>
List: tech-net
Date: 05/01/2001 12:15:27
>What I would do for a packet passed down to this interface is:
>  - M_PREPEND() some space, or copyup all contents to a buffer
>  - fill in a faked ethernet header (hopefully identical to the one
>    later added in ether_output
>  - add the encapsulation info in front of the ethernet header
>  - pass this to bpf

	for bpf on pppoe interface, i guess we should not prepend ethernet
	header.  my understanding is that:
	- pppoe interface should prepend ppp header and pass it to bpf
	- if you want to look at ether header, run tcpdump on ethernet
	  interface
	am i wrong?

itojun