On Mon, 2007-08-13 at 10:23 +0100, Andy Green wrote: > Wow impressive amount of ioctl calls going into the bit bucket there... I think there's only a single ioctl being killed, but all the stuff from ieee80211_common.h which is good too. Less crappy userspace interface :) > I will try to use your direct BPF programming and also dispense with > libpcap tonight, thanks for that. There's one gotcha with BPF: the program counter is always increasing so you can't have loops, and if you say "jump by 1 instruction" then another one is added too. But if you just copy the post-processing code you won't have to deal with that :) If you need any help writing a filter for the MAC address you use as the special one or something let me know. I'd probably use a 4-byte and a 2-byte word load and compare to constants; just remember that multi-byte word loads do network/host byte order swapping so you'll have to use the LE32/LE16 macros for the constants. This was, incidentally, the reason I didn't use pcap, I couldn't figure out if it could handle little-endian loads like my first few instructions do. johannes
Attachment:
signature.asc
Description: This is a digitally signed message part
