> You might try putting a printf/kprintf in the driver where the driver
> enters/exits promiscuous mode such that it gets logged to the console
> and/or syslog, and if you do it right, you should be able to get some
> process accounting information on which PID is throwing the interface
> into promiscuous mode.

If you're compiling bpf out of the kernel whats the difference
between someone undo'ing your patch at the same time they
put bpf back?  All you get is another tripwire that someone
will step over.

>  ______________ ___   ________ _____WHO: Greywolf (unto death)