Introduce a new bd_seesent flag to the BPF descriptor, indicating whether or

not the current BPF device should report locally generated packets or not.
This allows sniffing applications to see only packets that are not generated
locally, which can be useful for debugging bridging problems, or other
situations where MAC addresses are not sufficient to identify locally
sourced packets.  Default to true for this flag, so as to provide existing
behavior by default.

Introduce two new ioctls, BIOCGSEESENT and BIOCSSEESENT, which may be used
to manipulate this flag from userland, given appropriate privilege.

Modify bpf.4 to document these two new ioctl arguments.

Reviewed by:	asmodai

1 files changed, 8 insertions, 0 deletions

diff --git a/share/man/man4/bpf.4 b/share/man/man4/bpf.4
index 88ffb6a..ff57584 100644
--- a/share/man/man4/bpf.4
+++ b/share/man/man4/bpf.4
@@ -290,6 +290,14 @@ Set to zero if the link level source address should be filled in automatically
 by the the interface output routine.  Set to one if the link level source
 address will be written, as provided, to the wire.  This flag is initialized
 to zero by default.
+.It Dv BIOCSSEESENT
+.It Dv BIOCGSEESENT
+.Pq Li u_int
+Set or get the flag determining whether locally generated packets on the
+interface should be returned by BPF.  Set to zero to see only incoming
+packets on the interface.  Set to one to see packets originating
+locally and remotely on the interface.  This flag is initialized to one by
+default.
 .Sh BPF HEADER
 The following structure is prepended to each packet returned by
 .Xr read 2 :