[email protected] (Frank Kardel) writes:
>I just tripped over:
> pass in final pcap-filter "ip multicast or ip6 multicast"
>flawlessly compiles ... but:
> pass in final pcap-filter "ip broadcast"
>gives in "npf validate"
>/etc/npf.conf:xx:9: invalid pcap-filter(7) syntax
>although man 7 pcap-filter says otherwise and tcpdump gladly accepts ip
>broadcast.
from libpcap:
case Q_IP:
/*
* We treat a netmask of PCAP_NETMASK_UNKNOWN (0xffffffff)
* as an indication that we don't know the netmask, and fail
* in that case.
*/
if (cstate->netmask == PCAP_NETMASK_UNKNOWN)
bpf_error(cstate, "netmask not known, so 'ip broadcast'
not supported");
npfctl compiles the filter expression with PCAP_NETMASK_UNKNOWN, there
is no netmask it could apply.
--
--
Michael van Elst
Internet: [email protected]
"A potential Snark may lurk in every tree."
