>>>>> "Bill" == Bill Studenmund <[EMAIL PROTECTED]> writes: Bill> So my suggestion is for 802.11 interfaces (and any others that have Bill> multiple frame types) to not send any packets to bpf by default. Instead, Bill> it sends bpf packet types that bpf has asked for. Each driver keeps a mask Bill> of types it supports (and identifiers for said bits, like bit 1 is 802.11, Bill> bit 2 is 802.3, ...), and hands bpf packets bpf has a listener for.
This sounds reasonable. Note, from what I understand, the same problem occurs for a number of other interface types: 1) GigE, which has to do 802.3 and not EthernetII if you want jumbo frames. 2) CiscoHDLC type stuff. 3) Ethernet over ATM types. 4) any of the above with VLANs. ] ON HUMILITY: to err is human. To moo, bovine. | firewalls [ ] Michael Richardson, Sandelman Software Works, Ottawa, ON |net architect[ ] [EMAIL PROTECTED] http://www.sandelman.ottawa.on.ca/ |device driver[ ] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [ - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe