From owner-freebsd-net Wed Aug 29 14: 0:52 2001 Delivered-To: freebsd-net@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id E8E2537B406 for ; Wed, 29 Aug 2001 14:00:48 -0700 (PDT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.11.5/8.11.5) with SMTP id f7TL0gP73835; Wed, 29 Aug 2001 17:00:42 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Wed, 29 Aug 2001 17:00:42 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Mike Silbersack Cc: freebsd-net@freebsd.org Subject: Re: BPF question In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Depends on the SIMPLEX flag I believe, but for most ethernet interfaces, there's a software loopback. I actually take advantage of that to support the following BPF ioctl which I added: BIOCSSEESENT BIOCGSEESENT (u_int) Set or get the flag determining whether locally generated packets on the interface should be returned by BPF. Set to zero to see only incoming packets on the interface. Set to one to see packets originating locally and remotely on the interface. This flag is initialized to one by default. This is determined by checking that the mbuf pointer is non-NULL, indicating it originated in the interface code, rather than NULL, which signifies that it descended from a socket. Not 100% accurate with weird netgraph/etc cases, but sufficient for my needs, which permitted userland bridging using bpf. Robert N M Watson FreeBSD Core Team, TrustedBSD Project robert@fledge.watson.org NAI Labs, Safeport Network Services On Wed, 29 Aug 2001, Mike Silbersack wrote: > Silly question I could probably figure out myself, but thought it would be > quicker to ask here... > > When listening on an ethernet interface, are the packets you see from > yourself intercepted inside the network stack, or are you actually > sniffing them off the wire? I'm helping someone track down corrupted > packets he's seeing in tcpdump, and I'd like to know if I can locate where > the corruption may be occuring more exactly. > > Thanks, > > Mike "Silby" Silbersack > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message