In some mail from itojun@iijlab.net, sie said:
> 
> >> 	the best to perform bpf_mtap() is right before IF_ENQUEUE() in
> >> 	esp[46]_input().
> >
> >Is m_pkthdr.rcvif going to point to the correct interface at this point ?
> 
> 	rcvif should already be set by L2 logic (ether driver like
> 	sys/dev/pci/if_de.c, or ppp driver like sys/net/if_spppsubr.c).
> 	IPsec tunnel decapsulation does not (and should not) change it,
> 	so the value should be the correct value already.

That's good...I'll need to look at the output path too, just to make
sure it's valid there as well.

Darren