From owner-freebsd-ipfw@FreeBSD.ORG  Thu Oct  9 14:05:35 2003
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CF26016A4B3
	for <ipfw@freebsd.org>; Thu,  9 Oct 2003 14:05:35 -0700 (PDT)
Received: from xorpc.icir.org (xorpc.icir.org [192.150.187.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 315B043F75
	for <ipfw@freebsd.org>; Thu,  9 Oct 2003 14:05:35 -0700 (PDT)
	(envelope-from rizzo@xorpc.icir.org)
Received: from xorpc.icir.org (localhost [127.0.0.1])
	by xorpc.icir.org (8.12.9p1/8.12.3) with ESMTP id h99L5Osd020887;
	Thu, 9 Oct 2003 14:05:24 -0700 (PDT)
	(envelope-from rizzo@xorpc.icir.org)
Received: (from rizzo@localhost)
	by xorpc.icir.org (8.12.9p1/8.12.3/Submit) id h99L5NWw020886;
	Thu, 9 Oct 2003 14:05:23 -0700 (PDT)
	(envelope-from rizzo)
Date: Thu, 9 Oct 2003 14:05:23 -0700
From: Luigi Rizzo <rizzo@icir.org>
To: Valentine Zaretsky <zaretsky@apex.dp.ua>
Message-ID: <20031009140523.C19092@xorpc.icir.org>
References: <3F847F8A.9030300@apex.dp.ua>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <3F847F8A.9030300@apex.dp.ua>;
	from zaretsky@apex.dp.ua on Thu, Oct 09, 2003 at 12:20:10AM +0300
cc: ipfw@freebsd.org
Subject: Re: Limiting data size in tee rules
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Oct 2003 21:05:35 -0000

On Thu, Oct 09, 2003 at 12:20:10AM +0300, Valentine Zaretsky wrote:
> Hi!
> 
> In some applications there is no need to send the whole packet to 
> divert-socket (e.g. traffic accounting, where information contained in 
> headers is enough) and it might be useful to have a setting for the 
> length of data buffer that will be diverted from each matching packet.

for those cases, you might want to use the patches i posted some
time ago, which send packets that match a 'log' rule
to a bpf listener.

This would also enable you to set the 'snaplen' at runtime, and
use the vast amount of bpf-based tools instead to have to write
your own.

	cheers
	luigi