> > So given that bpf_mtap() is already an explicit interface for mbufs,
> > why do we need bpf_mtap2() ?  The prototype you gave did not seem to
> > suggest it was a big advantage to have.
> 
> It just hide any possible hacks within bpf.  Within bpf code, you can
> safely use fake mbuf or anything useful since you know that the caller
> of the bpf module only refer the limited members of mbufs.

oops. "you know about the callee", i should say.

Atsushi Onoe