gif(4) and bpf(4)

[Jeremie Le Hen]

> Try tcpdump -L -i gif0 on the affected system and post what you get. You
> might need to install the port if the base system tcpdump doesn't
> have the -L option.
> 
> If you get a list of encapsulations back, try using them with the -y
> option,,e.g.:
> 	tcpdump -y null -i gif0

I need indeed tcpdump port.  But unfortunately, it did not work.
Here is the typescript:

%%%
  yoda:root# ping  192.168.4.13 >/dev/null 2>&1  &
  [1] 53373
  yoda:root# /usr/local/sbin/tcpdump -L -i gif0
  Data link types (use option -y to set):
    NULL (BSD loopback)
  yoda:root# /usr/local/sbin/tcpdump -y null -i gif0
  tcpdump: data link type null
  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on gif0, link-type NULL (BSD loopback), capture size 96 bytes
  ^C
  0 packets captured
  0 packets received by filter
  0 packets dropped by kernel
  yoda:root# /usr/local/sbin/tcpdump -ni ep0 esp
  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on ep0, link-type EN10MB (Ethernet), capture size 96 bytes
  15:59:24.708405 IP xx.xx.xx.xx > yy.yy.yy.yy: ESP(spi=0x0c988eaf,seq=0x1f3)
  15:59:24.746374 IP yy.yy.yy.yy > xx.xx.xx.xx: ESP(spi=0x0cb31758,seq=0x1f0)
  15:59:25.728390 IP xx.xx.xx.xx > yy.yy.yy.yy: ESP(spi=0x0c988eaf,seq=0x1f4)
  15:59:25.766083 IP yy.yy.yy.yy > xx.xx.xx.xx: ESP(spi=0x0cb31758,seq=0x1f1)
  ^C
  4 packets captured
  83 packets received by filter
  0 packets dropped by kernel
%%%

Does any one have other ideas ?  It seems the code was partly written
by sam@, brooks@ and shin at .

Best regards,
-- 
Jeremie Le Hen
jeremie at le-hen.org