In some email I received from Guy Harris, sie wrote:
>
> On Mar 24, 2004, at 7:08 AM, Michael Richardson wrote:
>
> > okay, but there is more than just in/out.
> >
> > enum pcap1_probe {
> > INBOUND =1,
> > OUTBOUND =2,
> > FORWARD =3,
> > PREENCAP =4, /* IPsec ? */
> > POSTDECAP=5,
> > };
>
> ....and perhaps, on at least some systems, for inbound packets, supply
> "received unicast/received broadcast/received multicast/received
> promiscuously" indications (Digital UNIX has broadcast, multicast, and
> promiscuous bits - presumably if none are set it's received unicast or
> it's outbound), IRIX has a "received promiscuously" flag, and Linux
> supplies a unicast/broadcast/multicast/promiscuous/outgoing value. We
> might do that with "received unknown", "received unicast", "received
> broadcast", "received multicast", "received promiscuously", and "sent"
> flags (if none are set, the direction is unknown).
BSD also has M_BCAST and M_MCAST flags on mbufs.
Do I feel some desire for bpf.c to change, as well ?
Darren
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]
