Re: cBPF socket filters failing - inexplicably?

[Tom Cook]

On Fri, Jan 15, 2021 at 2:16 PM Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
[snip]
> > My wild guess is that as soon as socket got created:
> > socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
> > the packets were already queued to it.
> > So later setsockopt() is too late to filter.
> >
> > Eric, thoughts?
>
> Exactly, this is what happens.

I understand.  Thanks for the explanation.

> I do not know how tcpdump and other programs deal with this.
>
> Maybe by setting a small buffer size, or draining the queue.

libpcap has its own cBPF implementation which it applies after it
receives the packets from the queue.

Thanks again,
Tom Cook