Hi I am interested in writing an NKE which will attach to every network interface using "dlil_attach_interface_filter" . In order to attach to the interface I am planing on listing to the dlil_event. How can I be sure that between the time I received the event that the interface was attached and the time I have set up the interface filter, an input/output data frame had not been communicated through the interface without passing through the filter. I know that with linux you can setup a bpf filter that will catchup all interfaces, AFAIK this is not possible on darwin. Thanks Guy _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.