From mboxrd@z Thu Jan 1 00:00:00 1970 From: jamal Subject: Re: libpcap and tc filters Date: Tue, 05 Jul 2011 09:56:53 -0400 Message-ID: <1309874213.1765.45.camel@mojatatu> References: <1309777908.26180.1.camel@mojatatu> <1309784740.26180.21.camel@mojatatu> <1309788416.26180.63.camel@mojatatu> <1309863403.1765.0.camel@mojatatu> <1309870021.1765.41.camel@mojatatu> Reply-To: jhs@mojatatu.com Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org To: Adam Katz Return-path: Received: from mail-qy0-f174.google.com ([209.85.216.174]:53141 "EHLO mail-qy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752036Ab1GEN46 (ORCPT ); Tue, 5 Jul 2011 09:56:58 -0400 Received: by qyk29 with SMTP id 29so1501186qyk.19 for ; Tue, 05 Jul 2011 06:56:57 -0700 (PDT) In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Tue, 2011-07-05 at 16:07 +0300, Adam Katz wrote: > second, I just took at the libpcap source code and it seems it's using > the same ETH_P_ALL option when binding to an interface. So based on > what you're saying, the same solution of patching libpcap and > replacing ETH_P_ALL with ETH_P_IP should also make these rules work > with traffic sent using pure libpcap or any libpcap - based > application. ETH_P_ALL makes sense if you are unsure it is going to be IP. So i would change/optimize apps only for IP if they are intended to deal with IP only (same for ARP etc). In your case, it seems it is tcp only - which runs on top of IP. So it makes sense to do it for that specific use case etc. cheers, jamal