From owner-freebsd-isp  Mon Oct  7 10:52:28 1996
Return-Path: owner-isp
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id KAA14050
          for isp-outgoing; Mon, 7 Oct 1996 10:52:28 -0700 (PDT)
Received: from www.trifecta.com ([206.245.150.3])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id KAA14041
          for <freebsd-isp@freebsd.org>; Mon, 7 Oct 1996 10:52:26 -0700 (PDT)
Received: (from dev@localhost) by www.trifecta.com (8.7.5/8.6.12) id NAA11551; Mon, 7 Oct 1996 13:52:54 -0400 (EDT)
Date: Mon, 7 Oct 1996 13:52:54 -0400 (EDT)
From: Dev Chanchani <dev@trifecta.com>
To: freebsd-isp@freebsd.org
Subject: BPF
Message-ID: <Pine.BSF.3.91.961007135109.11531A-100000@www.trifecta.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-isp@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

I was doing some tinkering with the /dev/bpf device.

My understanding is that reading from the bpf device gives you a raw dump 
of the data over the network.

You will have a bpf header (18 bytes?)
Then I need to know the ip_offset for packets comming
in over the ed1 network interface so I can start calculating
how much traffic is going to what address based on the ip header.

Any help would be appreciated.