From owner-freebsd-net@FreeBSD.ORG  Tue Jun  7 20:56:44 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 95D7C16A41C
	for <freebsd-net@freebsd.org>; Tue,  7 Jun 2005 20:56:44 +0000 (GMT)
	(envelope-from mjl@luckie.org.nz)
Received: from grunt14.ihug.co.nz (grunt14.ihug.co.nz [203.109.254.61])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 35A5043D1F
	for <freebsd-net@freebsd.org>; Tue,  7 Jun 2005 20:56:43 +0000 (GMT)
	(envelope-from mjl@luckie.org.nz)
Received: from 203-173-150-184.bliink.ihug.co.nz (lycra.luckie.org.nz)
	[203.173.150.184] 
	by grunt14.ihug.co.nz with esmtp (Exim 3.35 #1 (Debian))
	id 1Dfl7q-0006gz-00; Wed, 08 Jun 2005 08:56:42 +1200
Received: from 203-173-146-91.bliink.ihug.co.nz ([203.173.146.91]
	helo=[192.168.1.6])
	by lycra.luckie.org.nz with esmtpsa (TLSv1:AES256-SHA:256)
	(Exim 4.51 (FreeBSD))
	id 1Dfl6r-00043M-G8; Wed, 08 Jun 2005 08:55:41 +1200
Message-ID: <42A60A03.2000101@luckie.org.nz>
Date: Wed, 08 Jun 2005 08:56:35 +1200
From: Matthew Luckie <mjl@luckie.org.nz>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050530
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Charles Swiger <cswiger@mac.com>
References: <4295A6CA.8080409@luckie.org.nz>
	<20050606081637.GA73886@lycra.luckie.org.nz>
	<20050606120851.GD734@empiric.icir.org>
	<20050606204008.GA91353@lycra.luckie.org.nz>
	<20050607101927.GA99034@lycra.luckie.org.nz>
	<20050607112340.GC812@empiric.icir.org>
	<42A5FB72.4010603@luckie.org.nz>
	<43393A5D-A13B-4385-A6E3-EDD21343277A@mac.com>
In-Reply-To: <43393A5D-A13B-4385-A6E3-EDD21343277A@mac.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-net@freebsd.org
Subject: Re: bpf writes on tun device
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Jun 2005 20:56:44 -0000

>> this was the behaviour expected of most DLT_NULL bpf devices  already 
>> (passing a 32bit int when writing).  It is important to  note that the 
>> behaviour of BPF writers does not change in these  cases, and my patch 
>> is merely a bug fix.
> 
> Agreed.  When you use BPF or PCAP to capture packets, for the  DTL_NULL 
> case there is a 4-byte offset between where PCAP says the  packet starts 
> and where the actual raw IP packet starts.
> 
> If you want BPF/PCAP to return packets without the 4-byte offset, the  
> associated datalink type is actually called DLT_RAW.  Note that the  
> behavior of DLT_NULL is useful in practice, since you can find out  what 
> the "ether type" of the packet was per <net/ethernet.h>:

unless i'm mistaken, the 4 byte field is actually the address family of 
the packet.  so AF_INET, AF_INET6, etc.  the ethertype thing is for 
DLT_EN10MB devices.

Matthew