Download raw body.
bpf filtering on arbitrary sockets
On 2025-10-30 16:03 +11, Damien Miller <djm@mindrot.org> wrote:
> What do you think? What would be a good daemon to try this against?
> I was thinking dhcpleased but that seems to use bpf for most of its
> sending, though that should IMO be converted to AF_FRAME now that we
> have it.
dhcpleased(8) cannot work with AF_FRAME because:
frame protocol family sockets are designed as an alternative to bpf(4)
for handling low data and packet rate communication protocols. Rather
than filtering every frame entering the system before the network stack,
like bpf(4), processing of the frame protocol family runs after the built
in protocol handlers in the kernel, thus avoiding the overhead. For this
reason, it is not possible to handle IPv4 or IPv6 packets with frame
protocol sockets because the kernel network stack consumes them before
the receive handling for frame sockets is run.
dhcp packets are IPv4/UDP.
--
In my defence, I have been left unsupervised.
bpf filtering on arbitrary sockets