On Thu, Aug 08, 2013 at 12:12:39AM -0500, joshua stein wrote: > Running tcpdump with no -i arg finds a good interface to listen on > by default on many machines, but on my laptop it finds pflog0 before > urtwn0. Can we skip pflog interfaces like loopbacks?
I got reminded of this diff while working on libpcap recently. The behavior you described annoys me as well, and I agree with your change. :) OK lteo@ > I had a version that looked up the interface in the egress group but > this is much simpler since pflog0 is usually the only other up > interface that isn't important. > > > Index: lib/libpcap/inet.c > =================================================================== > RCS file: /cvs/src/lib/libpcap/inet.c,v > retrieving revision 1.19 > diff -u -p -u -p -r1.19 inet.c > --- lib/libpcap/inet.c 26 Mar 2006 20:58:50 -0000 1.19 > +++ lib/libpcap/inet.c 8 Aug 2013 05:10:19 -0000 > @@ -141,6 +141,8 @@ pcap_lookupdev(errbuf) > continue; > if (ISLOOPBACK(ifa->ifa_name, ifa->ifa_flags)) > continue; > + if (!strncmp(ifa->ifa_name, "pflog", 5)) > + continue; > for (cp = ifa->ifa_name; !isdigit(*cp); ++cp) > continue; > n = atoi(cp); >
