On Wed, Oct 31, 2012 at 5:50 PM, Guy Harris [off-list ref] wrote:

On Oct 31, 2012, at 3:35 PM, Ani Sinha [off-list ref] wrote:

quoted

yes but if the packet is passed to the filter within libpcap (when we
are not using the kernel filter) before the reinsertion,

...that would be a bug.

Currently, that bug doesn't exist in the recvfrom() code path, but *does* appear to exist in the tpacket code path - and that code path also runs the filter before the SLL header is constructed.  That should be fixed.

yes, agreed.