How to filter packets with BPF in a C++ program when they're not read from a live capture or pcap/pcap-ng file?

Hello,

I am using a DPDK application. I have a pointer to a packet and trying to match it against a BPF filter using:

// Initialized before looking at the packet pcap_open_dead(DLT_EN10MB, 65535); pcap_compile(...)

// when I have a packet, I call
pcap_offline_filter(...)

The packets are always VLAN encapsulated. Whenever the filter is "vlan", I match all the packets.

Other than that, it is not able to filter any other type (e.g., ip, arp).

Can anyone help me out figuring what might be the problem?

Thanks, Sumit

Comments

And for more information on the vlan primitive, refer to the pcap-filter man page.

cmaynard ( 2021-01-29 22:20:04 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

1 Answer