From owner-freebsd-questions Thu Oct 10 14:17:14 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id OAA16232 for questions-outgoing; Thu, 10 Oct 1996 14:17:14 -0700 (PDT) Received: from broken.whitefang.com (broken.whitefang.com [199.173.153.182]) by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id OAA16213 for ; Thu, 10 Oct 1996 14:16:58 -0700 (PDT) Received: from localhost (shadows@localhost) by broken.whitefang.com (8.7.5/8.7.3) with SMTP id AAA04769 for ; Fri, 11 Oct 1996 00:18:47 +0300 (AST) X-Authentication-Warning: broken.whitefang.com: shadows owned process doing -bs Date: Fri, 11 Oct 1996 00:18:46 +0300 (AST) From: ShadowS Reply-To: shadows@whitefang.com To: questions@freebsd.org Subject: bpf filter and PPP Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-questions@freebsd.org X-Loop: FreeBSD.org Precedence: bulk I've been playing with bpf, and I noticed that under PPP I can receive both compressed and normal packets. Here's the instructions i used.. and both filtered out packets fine. struct bpf_insn inst[] = { BPF_STMT(BPF_LD+BPF_H+BPF_ABS,2), BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K,PPP_IP,1,0), BPF_STMT(BPF_RET+BPF_K,0), BPF_STMT(BPF_RET+BPF_K,500), struct bpf_insn inst[] = { BPF_STMT(BPF_LD+BPF_H+BPF_ABS,2), BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K,PPP_VJC_COMP ,1,0), BPF_STMT(BPF_RET+BPF_K,0), BPF_STMT(BPF_RET+BPF_K,500), now both returned the same amount of packets.. the return of 500 was just a hack to see if i got any. Another thing.. PPP packet headers vary in size, it depends on the way its negotiated so the protocol field may or may not be 1 byte (may be 2). This is confusing since the man page said "It can capture packets from interfaces which return a fixed header". I.e. Ethernet, but PPP is supported as well. anyone clear this up please? ------------------------------------------------------------------------------- ShadowS WhiteFang Unix Software Development Thamer Al-Herbish And Consultancy. shadows@whitefang.com shadows@kuwait.net Specialising in Custom Network Applications for Unix Systems. -------------------------------------------------------------------------------