Subject: Re: tcpflow vs. lo0 on 2.0_BETA
To: None <cjs@cynic.net>
From: Jun-ichiro itojun Hagino <itojun@itojun.org>
List: tech-net
Date: 08/20/2004 12:45:08
> On Thu, 19 Aug 2004, Jun-ichiro itojun Hagino wrote:
>
> > > I'm having a lot of trouble with the pkgsrc tcpflow on NetBSD 2.0_BETA
> > > when sniffing lo0. It works fine on my ethernet card, but with lo0 I
> > > just get this (with -v):
> >
> > check if tcpflow supports non-ethernet interface. my guess is that
> > tcpflow supports ethernet frames, and not bpf encoding for lo0
> > (4-byte address family).
>
> I shoulda looked at the source right off.
>
> Could it be we have to define DLT_NULL_BROKEN? Or there's a bug with this
> in NetBSD? See the code fragment below, from the begining of dlheader.c.
remove ntohl() in DLT_NULL_BROKEN block, then it should run happily.
(DLT_NULL header is host-order integer in netbsd)
itojun