>>>  - M_PREPEND() some space, or copyup all contents to a buffer
>>>  - fill in a faked ethernet header (hopefully identical to the one
>>>    later added in ether_output
>>>  - add the encapsulation info in front of the ethernet header
>>>  - pass this to bpf
>>	for bpf on pppoe interface, i guess we should not prepend ethernet
>>	header.  my understanding is that:
>>	- pppoe interface should prepend ppp header and pass it to bpf
>>	- if you want to look at ether header, run tcpdump on ethernet
>>	  interface
>>	am i wrong?
>that sounds reasonable to me.  if someone wants just the ppp encap
>header, then they can tcpdump the ppp interface.
>gre/gif works the same way, yes?

	yes.  gif interface uses DLT_NULL (af # only), and if you want to see
	encapsulating (outer) header, tap on real ethernet interface.

itojun