Running tcpdump with no -i arg finds a good interface to listen on
by default on many machines, but on my laptop it finds pflog0 before
urtwn0.  Can we skip pflog interfaces like loopbacks?

I had a version that looked up the interface in the egress group but
this is much simpler since pflog0 is usually the only other up
interface that isn't important.


Index: lib/libpcap/inet.c
===================================================================
RCS file: /cvs/src/lib/libpcap/inet.c,v
retrieving revision 1.19
diff -u -p -u -p -r1.19 inet.c
--- lib/libpcap/inet.c  26 Mar 2006 20:58:50 -0000      1.19
+++ lib/libpcap/inet.c  8 Aug 2013 05:10:19 -0000
@@ -141,6 +141,8 @@ pcap_lookupdev(errbuf)
                        continue;
                if (ISLOOPBACK(ifa->ifa_name, ifa->ifa_flags))
                        continue;
+               if (!strncmp(ifa->ifa_name, "pflog", 5))
+                       continue;
                for (cp = ifa->ifa_name; !isdigit(*cp); ++cp)
                        continue;
                n = atoi(cp);

Reply via email to