-----BEGIN PGP SIGNED MESSAGE-----
>>>>> "Guy" == Guy Harris <[EMAIL PROTECTED]> writes:
Guy> On Mar 24, 2004, at 7:08 AM, Michael Richardson wrote:
>> okay, but there is more than just in/out.
>>
>> enum pcap1_probe {
>> INBOUND =1,
>> OUTBOUND =2,
>> FORWARD =3,
>> PREENCAP =4, /* IPsec ? */
>> POSTDECAP=5,
>> };
Guy> ...and perhaps, on at least some systems, for inbound packets, supply
Guy> "received unicast/received broadcast/received multicast/received
Guy> promiscuously" indications (Digital UNIX has broadcast, multicast, and
Guy> promiscuous bits - presumably if none are set it's received
Guy> unicast or it's outbound), IRIX has a "received promiscuously"
Guy> flag, and Linux supplies a
I think that these may be bits, and certainly are orthogonal to the
probe point. So, we need some kind of additional flags.
Do these need to be in every packet? Maybe it is just meta-data that
needs to be added at the beginning, perhaps along with the filter code.
- --
] ON HUMILITY: to err is human. To moo, bovine. | firewalls [
] Michael Richardson, Xelerance Corporation, Ottawa, ON |net architect[
] [EMAIL PROTECTED] http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys
iQCVAwUBQGZWDYqHRg3pndX9AQEsywP/VzTE9rvDSs2jCfeVa+q1PtY+3m2qj0Mf
GD2p0FQBbaq9HE3ytIPm7amLC43SDSsB0W3PtbJOxoUhepny1pPalkj8nz7KB1fn
5ZA+itU/clGPmFZNazapHWoxTpW5vDUd9pm+LIMUnMYFe/Nbn2A4Pe+9gz6k4oOO
u0Vs5EEy3J8=
=c6Fk
-----END PGP SIGNATURE-----
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
