From owner-freebsd-net@FreeBSD.ORG  Sat Jul 17 19:00:37 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1D79816A4CE
	for <net@freebsd.org>; Sat, 17 Jul 2004 19:00:37 +0000 (GMT)
Received: from mail.sandvine.com (sandvine.com [199.243.201.138])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A24A243D46
	for <net@freebsd.org>; Sat, 17 Jul 2004 19:00:36 +0000 (GMT)
	(envelope-from don@sandvine.com)
Received: by mail.sandvine.com with Internet Mail Service (5.5.2657.72)
	id <PAC3QTDV>; Sat, 17 Jul 2004 15:00:27 -0400
Message-ID: <FE045D4D9F7AED4CBFF1B3B813C85337051D9365@mail.sandvine.com>
From: Don Bowman <don@sandvine.com>
To: Don Bowman <don@sandvine.com>,
	"'net@freebsd.org'" <net@freebsd.org>
Date: Sat, 17 Jul 2004 15:00:25 -0400
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2657.72)
Content-Type: text/plain;
	charset="iso-8859-1"
Subject: RE: Question on SOCK_RAW, implement a bpf->other host tee
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 17 Jul 2004 19:00:37 -0000

From: Don Bowman [mailto:don@sandvine.com]
> I'm trying to implement a 'tee' which reads
> from bpf, and sends matching packets to
> another layer-2 adjacent host.
> 

Sorry to follow up my own post, but...
More specifically, it appears the packet does
try and transmit, but the destination MAC is
(uninitialised?) somewhat random, different
on each packet, not legal.

I can capture it on the correct output interface
with tcpdump. The interface type is xl.

Shouldn't the stack ARP for the destination
in my 'sendto', and fill in the ether header?
The ether-source is filled in, presumably by
the driver.