Wireshark · Wireshark-users: Re: [Wireshark-users] dumpcap and bpf assembler

[Richard Stearn <richard@xxxxxxxxxxxxxxxxxxxxxx>]

Sake Blok wrote:

Hi Sake

> I think I misunderstood you then. I thought you were looking for a
> way to write some assembly/machine code for the BPF pseudo processor.

You understood me perfectly.  That exactly what I wish to do.

> Which of course works only on the content of a packet (link layer
> data and upwards). I believe that anything the BPF engine can do can

In Linux there are some extensions to BPF that allow access to a few
Linux internal variables:

	https://www.kernel.org/doc/Documentation/networking/filter.txt

I just need to find or code a method of passing the assembler source
to the kernel within dumpcap.

--
Regards
	Richard