From: Guy Harris <guy@alum.mit.edu>
To: Ani Sinha <ani@aristanetworks.com>
Cc: netdev@vger.kernel.org,
Francesco Ruggeri <fruggeri@aristanetworks.com>,
tcpdump-workers@lists.tcpdump.org
Subject: Re: [tcpdump-workers] vlan tagged packets and libpcap breakage
Date: Wed, 31 Oct 2012 17:50:45 -0700 [thread overview]
Message-ID: <B23C28F0-4005-4970-984D-3BAD063EA513@alum.mit.edu> (raw)
In-Reply-To: <CAOxq_8O8Vkm5Napp_h6HVj6C=EH2gd_PQJJ1N5d_VQZrRZFYNQ@mail.gmail.com>
On Oct 31, 2012, at 3:35 PM, Ani Sinha <ani@aristanetworks.com> wrote:
> yes but if the packet is passed to the filter within libpcap (when we
> are not using the kernel filter) before the reinsertion,
...that would be a bug.
Currently, that bug doesn't exist in the recvfrom() code path, but *does* appear to exist in the tpacket code path - and that code path also runs the filter before the SLL header is constructed. That should be fixed.
Yes, it means constructing the SLL header and inserting the tags blah blah blah on packets that might not pass the filter, but in most cases the filtering should be done in the kernel, not userland, when doing a live capture, and in those cases where the filtering can't done in the kernel, you're already somewhat hosed by the fact that the packets are being copied to the buffer and wakeups are being delivered before the packets are being filtered.
next prev parent reply other threads:[~2012-11-01 1:02 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAOxq_8Nd8VP3MaNBfUt9v82nmGDpxZz5_5QMdsruET1tjwuQPw@mail.gmail.com>
[not found] ` <3246.1351717319@obiwan.sandelman.ca>
2012-10-31 21:50 ` [tcpdump-workers] vlan tagged packets and libpcap breakage Ani Sinha
2012-10-31 22:20 ` Guy Harris
2012-10-31 22:35 ` Ani Sinha
2012-11-01 0:50 ` Guy Harris [this message]
2012-11-01 1:22 ` [tcpdump-workers] " Ani Sinha
2012-12-06 21:20 ` Ani Sinha
2012-11-02 16:13 ` Bill Fenner
2012-11-13 22:41 ` Ani Sinha
2012-11-13 22:42 ` [tcpdump-workers] " Ani Sinha
2012-11-14 18:58 ` Michael Richardson
2012-10-31 22:42 ` [tcpdump-workers] " Michael Richardson
2012-12-12 21:53 ` Ani Sinha
2012-12-12 22:16 ` Ani Sinha
2012-12-13 8:35 ` [tcpdump-workers] " Daniel Borkmann
2012-12-13 17:34 ` Ani Sinha
2012-12-13 21:49 ` Daniel Borkmann
2012-12-13 22:07 ` Ani Sinha
2012-12-17 9:50 ` David Laight
2012-12-17 10:35 ` Guy Harris
2012-12-17 11:08 ` Daniel Borkmann
2012-12-17 19:49 ` [tcpdump-workers] " Ani Sinha
2012-11-16 6:51 ` Eric W. Biederman
2012-11-17 22:14 ` Michael Richardson
2012-11-17 23:16 ` Daniel Borkmann
2012-11-17 23:37 ` Eric W. Biederman
2012-11-17 23:33 ` Eric W. Biederman
2012-12-06 21:22 ` Ani Sinha
2012-12-06 22:19 ` Eric W. Biederman
2012-12-06 22:40 ` Ani Sinha
2012-12-07 0:55 ` Ani Sinha
2012-12-07 1:03 ` [tcpdump-workers] " Eric W. Biederman
2012-12-07 1:28 ` Ani Sinha
2012-12-07 1:31 ` Ani Sinha
2012-12-07 1:41 ` Eric W. Biederman
2012-12-07 1:59 ` Michael Richardson
2012-12-11 0:11 ` [tcpdump-workers] " Ani Sinha
2012-12-11 22:36 ` Ani Sinha
2012-12-11 23:04 ` Eric Dumazet
2012-12-12 0:46 ` Ani Sinha
2012-12-12 0:50 ` [tcpdump-workers] " Ani Sinha
2012-12-11 23:12 ` Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=B23C28F0-4005-4970-984D-3BAD063EA513@alum.mit.edu \
--to=guy@alum.mit.edu \
--cc=ani@aristanetworks.com \
--cc=fruggeri@aristanetworks.com \
--cc=netdev@vger.kernel.org \
--cc=tcpdump-workers@lists.tcpdump.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).