Subject: Re: bpf breakage
To: David Young <dyoung@pobox.com>
From: None <itojun@iijlab.net>
List: tech-net
Date: 07/03/2004 12:43:49
>On Sat, Jul 03, 2004 at 10:40:54AM +0900, itojun@iijlab.net wrote:
>> due to this change in sys/net/bpf.c (bpf_measure -> m_length),
>> bpf on many interfaces (which prepends address family by integer)
>> is broken. the length will become off by 4, and you'll see
>> "truncated-ip" message from tcpdump. please back it out.
>>
>> my guess is the culprit is "optimize m_length" (2nd paragraph from the
>> bottom).
>
>On which interfaces is it broken, Itojun? Why do those interfaces
>assemble packets with incorrect m_pkthdr.len?
i got a breakage report on ppp interface (but the originator mentioned
that he would like to remain anonymous, so i don't cc: him).
# i've forwarded those to you privately.
some of the interfaces (like loopback) prepends 4byte mbuf (address
family is set inside) on bpf_mtap. in such case, m_pkthdr.len
will not be useful.
itojun