[PATCH] BPF to support directions and more

[Jung-uk Kim]

On Thursday 15 February 2007 04:17 am, Yar Tikhiy wrote:
> On Wed, Feb 14, 2007 at 06:05:15PM -0500, Jung-uk Kim wrote:
> > I was playing with some BPF ideas for few days and I added two
> > new features.  SEESENT flag is extended to see only outgoing
> > packets, which is analogous to libpcap's PCAP_D_OUT direction. 
> > Thus SEESENT is now called DIRECTION.
>
> Any plans to teach BPF to report the direction a packet goes in?
> In some cases it can be unobvious whether it's incoming or
> outgoing.

No, not at the moment.  You can work around it by using the patch 
though.  Capture incoming packets with BPF_D_IN and outgoing packets 
with BPF_D_OUT.  If you want to merge them back, you can use mergecap 
utility from Wireshark.

Jung-uk Kim