>>>>> "Guy" == Guy Harris <[EMAIL PROTECTED]> writes:
Guy> At this point, the two things I think should go into it before we do a
Guy> release are
Guy> 1) a new DLT_LINUX_COOKED (or whatever) link-layer type, for use
Guy> when using PF_PACKET/SOCK_DGRAM rather than
Guy> PF_PACKET/SOCK_RAW - it'd provide a link-layer header that
Guy> includes an Ethernet type and, perhaps the one link-layer
Guy> address you get, plus a flag indicating whether it's the
Guy> sender or recipient link-layer address (the flag should *NOT*
Guy> be a #define from a Linux header - the code to handle it
Guy> should compile and run on non-Linux systems, so that captures
Guy> done on Linux systems can be read on non-Linux systems);
At this point, where are we with this?
Is there another volunteer to attempt to work on the BPF code for this?
Guy> so the BPF code run in userland would be different from the BPF code
Guy> handed to the kernel.
Ick. Anyway that this might change in the kernel at some point?
Guy> This might have to be done by, for example, generating BPF code under
Guy> the assumption that it's intended for userland, and fixing it up before
Guy> handing it to the kernel; as the attempt to hand it to may fail if, for
Guy> example, socket filters aren't supported by the kernel, either a copy
Guy> would have to be made of the filter and that copy fixed up, or the
Guy> fixed-up copy would have to be unfixed if the attempt to hand it to the
Guy> kernel failed.
This is an interesting way to do it.
Again, any volunteers?
Guy> It Might Be Nice to have the BPF compiler generate code, for Token
Perhaps someone with token ring hardware.
I haven't touched one in 8 years...
Guy> none of the existing Token Ringified versions of libpcap do it,
Guy> as far as I know, so it wouldn't be a regression;
Guy> so I wouldn't delay an 0.6/3.6 release for it.
okay.
] Train travel features AC outlets with no take-off restrictions|gigabit is no[
] Michael Richardson, Solidum Systems Oh where, oh where has|problem with[
] [EMAIL PROTECTED] www.solidum.com the little fishy gone?|PAX.port 1100[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
