On Sat, Feb 27, 2016 at 08:18:41PM +0100, 6bone%6bone.informatik.uni-leipzig.de@localhost wrote: > 5015 1 tcpdump 1456559035.621583576 CALL read(3,0x7f7ff7b16000,0x80000) FD 3 is a BPF instance? Joerg