Subject: Re: [tcpdump-workers] vlan tagged packets and libpcap breakage

From: [email-masked] (Eric W. Biederman)
Date: Sat, 17 Nov 2012 15:37:40 -0800

Daniel Borkmann <[email-masked]> writes:

> Speaking of netsniff-ng where we don't reconstruct VLAN headers, users
> have reported that depending on the NIC/driver resp. ethtool setting,
> they can come in stripped or not (in the pf_packet's rx_ring buffer).
> However, I assume VLAN AUXDATA is always consistent (and so the
> BPF/BPF JIT filtering).

Yes it was a mess before we added software stripping of the vlan headers
a year ago.

Eric