tcpdump mailing list archives
Re: Does libpcap/tcpdump support "SKF_AD_QUEUE" instruction ?
From: Guy Harris <guy () alum mit edu>
Date: Thu, 11 Nov 2010 19:37:55 -0800
On Nov 11, 2010, at 6:55 PM, Jon Zhou wrote:
Does libpcap/tcpdump support "SKF_AD_QUEUE" instruction and BPF filter?
I presume you mean "does libpcap support generating the SKF_AD_QUEUE special packet offset in BPF filter programs?" If so, the answer is "no"; there's probably no reason why there couldn't be a keyword in the libpcap filter language ("queue {N}" or something such as that) to support it, although, of course, filters with that keyword would be rejected if either 1) you're trying to do a live capture on anything other than a Linux PF_PACKET socket or 2) you're trying to read a savefile. pcap_compile() is, of course, not the only way to get a BPF program; a library or application could, for example, generate the filter program by hand, which wouldn't be too bad if you weren't trying to filter on arbitrary expressions.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Does libpcap/tcpdump support "SKF_AD_QUEUE" instruction ? Jon Zhou (Nov 11)
- Re: Does libpcap/tcpdump support "SKF_AD_QUEUE" instruction ? Guy Harris (Nov 11)
- Re: Does libpcap/tcpdump support "SKF_AD_QUEUE" Jon Zhou (Nov 22)
- Re: Does libpcap/tcpdump support "SKF_AD_QUEUE" instruction ? Guy Harris (Nov 11)