>>  - M_PREPEND() some space, or copyup all contents to a buffer
>>  - fill in a faked ethernet header (hopefully identical to the one
>>    later added in ether_output
>>  - add the encapsulation info in front of the ethernet header
>>  - pass this to bpf
>
>	for bpf on pppoe interface, i guess we should not prepend ethernet
>	header.  my understanding is that:
>	- pppoe interface should prepend ppp header and pass it to bpf
>	- if you want to look at ether header, run tcpdump on ethernet
>	  interface
>	am i wrong?

that sounds reasonable to me.  if someone wants just the ppp encap
header, then they can tcpdump the ppp interface.

gre/gif works the same way, yes?

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."