On Thu, 2009-07-30 at 16:24 -0700, Darren Reed wrote: > > > Well, libpcap is a potential consumer (see discussion on > > > tcpdump-workers.) > > > Importantly, the header from ipobs_hook_type_t gives the direction a > > > packet > > > is going in as a property that you can write a filter on - not > > > something you > > > can do with raw mac packets in BPF. So from that perspective, this > > > pseudo > > > header has unique value in its current form. I doubt that was intended > > > to be > > > true as a design feature but all the same, something to think about. > > > > Okay, I see what you're saying. If we need a Public definition for > > "packet direction", then perhaps it can be defined outside of the > > context of an IP observability "hook", though. > > Yup, that's a perfectly reasonable approach too. > > Outside of the IP observability hooks, does anything come to > mind about where else such a distinction would be made?
Yes, in in the ipnet header itself, which is distinct and separate from the ipobs hooks. Ideally, though, the concept of packet direction could be conveyed for all packets of all types using BPF using some kind of ancillary information rather than a link-specific header. Does BPF allow for something like that? For some reason, I thought that it did that on other OSs... -Seb
