--- Begin Message ---
On Oct 23, 2019, at 12:26 AM, Anders Broman <anders.bro...@ericsson.com> wrote:
> El mar., 22 oct. 2019 a las 15:08, Guy Harris (<ghar...@sonic.net>) escribió:
>>
>>> Does it allow receiving copies of packets that are also handed either to
>>> the kernel networking stack or to other AF_XDP sockets for regular input
>>> processing? That would be needed to allow it to be used for packet sniffing.
>>
>> I haven't looked into it yet, but I'll keep that in mind when I do.
>
> Is that needed for an interface used ONLY for sniffing? E.g connected to a
> span/mirror port or a tap? One of the interesting features here is packet
> filtering on the NIC.
No, but there's no API in libpcap to indicate that the code is using it for
passive sniffing on an interface used only for sniffing rather than for active
sniffing of the traffic on a live interface, so if AF_XDP works only for
passive sniffing there's no way to know whether it can be used or not.
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
