Running tcpdump with no -i arg finds a good interface to listen on
by default on many machines, but on my laptop it finds pflog0 before
urtwn0. Can we skip pflog interfaces like loopbacks?
I had a version that looked up the interface in the egress group but
this is much simpler since pflog0 is usually the only other up
interface that isn't important.
Index: lib/libpcap/inet.c
===================================================================
RCS file: /cvs/src/lib/libpcap/inet.c,v
retrieving revision 1.19
diff -u -p -u -p -r1.19 inet.c
--- lib/libpcap/inet.c 26 Mar 2006 20:58:50 -0000 1.19
+++ lib/libpcap/inet.c 8 Aug 2013 05:10:19 -0000
@@ -141,6 +141,8 @@ pcap_lookupdev(errbuf)
continue;
if (ISLOOPBACK(ifa->ifa_name, ifa->ifa_flags))
continue;
+ if (!strncmp(ifa->ifa_name, "pflog", 5))
+ continue;
for (cp = ifa->ifa_name; !isdigit(*cp); ++cp)
continue;
n = atoi(cp);