RE: Question on SOCK_RAW, implement a bpf->other host tee

[d...@sandvine.com]

From: Don Bowman [mailto:d...@sandvine.com]
> I'm trying to implement a 'tee' which reads
> from bpf, and sends matching packets to
> another layer-2 adjacent host.
>

Sorry to follow up my own post, but...
More specifically, it appears the packet does
try and transmit, but the destination MAC is
(uninitialised?) somewhat random, different
on each packet, not legal.

I can capture it on the correct output interface
with tcpdump. The interface type is xl.

Shouldn't the stack ARP for the destination
in my 'sendto', and fill in the ether header?
The ether-source is filled in, presumably by
the driver.

_______________________________________________
freeb...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net...@freebsd.org"

[b...@spc.org]

On Sun, Jul 18, 2004 at 05:38:22PM -0400, Robert Watson wrote:
> > I have swapped the ip_len, ip_off fields.
>
> Are you sure you need to do this? I thought BPF/PCAP provided those
> fields in network byte order already, in which case you shouldn't need to
> touch these fields unless you need to adjust them.

I think Don is referring to the fact that IP_HDRINCL in our stack expects
to see these fields in host byte order (as per my update of the ip(4) manual
page quite recently). Raw socket stuff being different from bpf stuff.

BMS