different version has been committed upstream in the libpcap vendor branch.
This will allow people to experiment with zero-copy bpf(4) without requiring
external patches.
Note to enable this functionality:
sysctl net.bpf.zerocopy_enable=1
By default, libpcap will use the legacy buffering method unless this sysctl
variable is set to 1.
For the details about zero-copy bpf(4) implementation see svn change r177548.
Requested by: many
Discussed with: sam
In collaboration with: rwatson
- BIOCGDIRECTION and BIOCSDIRECTION get or set the setting determining
whether incoming, outgoing, or all packets on the interface should be
returned by BPF. Set to BPF_D_IN to see only incoming packets on the
interface. Set to BPF_D_INOUT to see packets originating locally and
remotely on the interface. Set to BPF_D_OUT to see only outgoing
packets on the interface. This setting is initialized to BPF_D_INOUT
by default. BIOCGSEESENT and BIOCSSEESENT are obsoleted by these but
kept for backward compatibility.
- BIOCFEEDBACK sets packet feedback mode. This allows injected packets
to be fed back as input to the interface when output via the interface is
successful. When BPF_D_INOUT direction is set, injected outgoing packet
is not returned by BPF to avoid duplication. This flag is initialized to
zero by default.
Note that libpcap has been modified to support BPF_D_OUT direction for
pcap_setdirection(3) and PCAP_D_OUT direction is functional now.
Reviewed by: rwatson
pcap should not fall back to its own implementations in the absence of
HAVE_SNPRINTF and HAVE_VSNPRINTF defines when compiled and installed
as part of the world. This should fix builds of pflogd and packages
depending on the base system libpcap.
Reported by: Andrzej Tobola
tcpdump -y ieee802_11 will work in the basic senses, including the
code compilation for filters (where you may specify "link[]" to refer
to parts of the 802.11 header, as well as treat it like a normal
Ethernet header). Previously, it was just too far off to do anything
useful for us.
* While I'm here, fix some compile problems that will result from lex
and yacc namespace polution when linking with -lpcap. The namespace
is now "pcapyy*" instead of "yy*", and it tests fine with world and
some external applications that may or may not use "yy*".
scanner/parser. FreeBSD recently made 'flex' its default implementation
of 'lex'. One of the incompatibilities of 'flex' vs. 'lex' is that
if you longjmp() out of the scanner, you must call yyrestart()
before doing another scan (as documented in flex(1)). So add an
invocation to yyrestart() in lex_init(). This change should be
backwards compatible with the original 'lex'.
PR: bin/24116
