I have a NKE which I got the callbacks working for packet capture using
the functions in the Struct dlil_if_flt_str.
What I am looking at is the filter_if_input and filter_if_output.
I see that in the filter_if_input call back there is a param of char
**frame_ptr. My questions are, is this param, frame_ptr, the complete Ethernet fram,
and if so how could I look at the contents? If it is a buf of char, but it does
not give a length, in the passed in values, it must be of some struct form, or
there should be some way to cast it to some struct to be able to see it’s contents. Does any one know what the structure
is?
Also in filter_if_output I also notice there is NO frame_ptr type
parameter, can some explain why?
And finally I guess I would be interested in the mbuf_ptr parameters of
both functions if I what to trap and/or alter any of the packets coming or
going from the stack, yes/no?
Thanks for everyone’s help and input
Carl