On Jun 9, 2004, at 1:58 PM, Rick Jones wrote:
On the surface I wouldn't think so - simply attaching to a PPA I don't think means traffic could arrive - however, if one has attached, and then binds to a SAP, then traffic could indeed start arriving. (Il-informed guesstimation, and hopefully I'm recalling the correct distinction between attach and bind)
Well, we *are* doing an info request after binding, so perhaps it might happen then.
I'm not sure why we're doing that; it dates back to libpcap 0.4. Do you know of any reason why the "dl_mac_type" from an info request before binding to a SAP might be different from the "dl_mac_type" from a request after binding to a SAP?
I cannot think of one - of course, DLPI being what it is...
I thought though that the SAP selected was rather, um, obscure? I suppose one thing to consider would be to have some sort of bugcatcher in the code that displayed the entire contents of the unexpected message - say simply in hex. Then one could determin if it matches the bound SAP.
rick jones - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
