[apparent violent agreement elided]
>...
>Andrew, please dont take this the wrong way, but have you ever
>tried to use this monstrosity?

which?  bpf (yes) or PF_PACKET (no)?  a "raw" bpf or libpcap?

i've also written code that used SOCK_RAW stuff, but never used the
tap(4) device under freebsd.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."