From owner-freebsd-questions  Thu Sep  3 07:16:00 1998
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id HAA20418
          for freebsd-questions-outgoing; Thu, 3 Sep 1998 07:16:00 -0700 (PDT)
          (envelope-from owner-freebsd-questions@FreeBSD.ORG)
Received: from plains.NoDak.edu (plains.NoDak.edu [134.129.111.64])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id HAA20413
          for <questions@FreeBSD.ORG>; Thu, 3 Sep 1998 07:15:51 -0700 (PDT)
          (envelope-from tinguely@plains.NoDak.edu)
Received: (from tinguely@localhost)
	by plains.NoDak.edu (8.8.8/8.8.8) id JAA30116;
	Thu, 3 Sep 1998 09:13:38 -0500 (CDT)
Date: Thu, 3 Sep 1998 09:13:38 -0500 (CDT)
From: Mark Tinguely <tinguely@plains.NoDak.edu>
Message-Id: <199809031413.JAA30116@plains.NoDak.edu>
To: 09533893@mail4.dlsu.edu.ph, questions@FreeBSD.ORG
Subject: Re: BPF
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

according to the kernel sources for BPF, you read size must equal the 
packet buffer size (change 500 to 4096). I would think you need to
place the interface into promiscuous mode if you want to access
non-local packets, I also think you need to place a filter (even
if the filter says that you want everything).

you may wish to look at pcap(3) and tcpdump(8) for programming help.

--mark.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message