Peter Memishian wrote:
> > > FWIW, snoop -I lo0 will
> > > allow one to see just IP packets flowing over 127.0.0.1 (or whatever
> > > addresses are configured on the lo0 IP interface).
> >
> > Thanks. So,
> >
> > snoop -I lo0 shows no traffic
> > snoop -d lo0 shows the traffic
> > snoop -I e1000g0 shows the traffic
> > snoop -d e1000g0 show no traffic
> >
> > Is that what's expected?
>
> Yes, since it's being looped-back inside IP.
FWIW I find the above confusing; explaining it by referring to the
implementation isn't likely to help the administrator understand it.
From the implementation perspective, since of the cases except 'snoop
-d e1000g0' is looped back internally in IP, thus it seems like we would
have had the option to make things more uniform.
Erik
