Re: DLT type requested for OpenSolaris IPNET header

[Darren Reed <Darren.Reed () Sun COM>]

On 27/07/09 11:47 AM, Guy Harris wrote:
> On Jul 26, 2009, at 6:48 PM, Darren Reed wrote:
>
> > On 21/07/09 01:35 PM, Guy Harris wrote:
> >
> > > > dli_htype     - hook type (in, out, local)
> > >
> > > Presumably there are specific values for those (0, 1, and 2, or 
> > > whatever).
> >
> > Yes, 0 for inbound, 1 for outbound, 2 for local.
>
> So "inbound" means that the packet arrived from another machine on the 
> network,

Correct.

> "outbound" means the packet was sent to another machine on the 
> network, and

Correct.

> "local" means the packet came from another zone?  (Into which category 
> do packets sent to, for example, 127.0.0.1 on the same zone fall?)

"local" is machine local.
Between zones, using shared IP instances, or loopback traffic.
Both types of "traffic" share the same datapath.
"local" packets are seen after the "inbound" filter is applied to traffic
being "received" by loopback/zone.

So whereas it was not possible to sniff the loopback traffic on Solaris
before, it now will be.

I suppose now that I think about it, there are two "input" types - input and
"local". Is that likely to be a problem for directional filtering? I would
have to think more about what instructions that should generate.

Darren

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.