Subject: Re: tcpflow vs. lo0 on 2.0_BETA
To: None <cjs@cynic.net>
From: Jun-ichiro itojun Hagino <itojun@itojun.org>
List: tech-net
Date: 08/20/2004 12:45:08
> On Thu, 19 Aug 2004, Jun-ichiro itojun Hagino wrote:
> 
> > > I'm having a lot of trouble with the pkgsrc tcpflow on NetBSD 2.0_BETA
> > > when sniffing lo0. It works fine on my ethernet card, but with lo0 I
> > > just get this (with -v):
> >
> > 	check if tcpflow supports non-ethernet interface.  my guess is that
> > 	tcpflow supports ethernet frames, and not bpf encoding for lo0
> > 	(4-byte address family).
> 
> I shoulda looked at the source right off.
> 
> Could it be we have to define DLT_NULL_BROKEN? Or there's a bug with this
> in NetBSD? See the code fragment below, from the begining of dlheader.c.

	remove ntohl() in DLT_NULL_BROKEN block, then it should run happily.
	(DLT_NULL header is host-order integer in netbsd)

itojun