[strongSwan-dev] farp plugin bpf filter

[Martin Willi]

Hi Sven,

> If I replace the JUMP with your NOP-JUMP, the gateway response to the
> arp request. The arp request has a length of 60 (and not 28) bytes if I
> interpret the wireshark dump right (see attachment).

Maybe your kernel passes up the Ethernet trailer, too. Try the attached
patch, it accepts larger packets, but trims the trailer.

> Is there a simple way to find out which value BPF_LEN has?

I don't think so, unless you pass the complete packet to userspace.

Regards
Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Accept-ARP-requests-with-an-ethernet-trailer-but-tri.patch
Type: text/x-patch
Size: 1066 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/dev/attachments/20100602/9882762d/attachment.bin>