> | my only query is what to do about if_ppp.  i'll look into changing it to
> | be DLT_PPP rather than DLT_NULL.
> 
> ppp is tricky. Is that the only interface that calls bpf_attach with 0 as
> the third argument?

no, if_xb.c (something specific to the alpha) is the other one.  i'll mail
a few people who have committed to the driver offlist to determine what to do
about it.

Matthew