bpf kernel module

[Erik Trulsson]

On Sun, Nov 12, 2006 at 05:29:23PM +0200, Vlad GURDIGA wrote:
> On 12/11/06, Lowell Gilbert <freebsd-questions-local at be-well.ilk.org> wrote:
> >"Vlad GURDIGA" <gurdiga at gmail.com> writes:
> >
> >> I'm trying to keep very close touch with 6.1_STABLE cvsupping sources
> >> once a week or even more often. I'm thinking of removing as much as
> >> possible devices from the kernel loading them from /boot/loader.conf
> >> instead, so I could rebuild and install them without a whole
> >> kernel/world rebuild and reboot when sources change. I'm not sure this
> >> is a correct way, any piece of advice regarding this would be highly
> >> appreciated. :)
> >>
> >> So, I've successfully done that with sound and network card drivers,
> >> but did not succeed with removing bpf from the kernel. Booting a
> >> kernel with no bpf support, and with
> >> ng_bpf_load="YES" in my loader.conf, the pflogd fails to start with this 
> >error:
> >>
> >> Nov 11 20:22:33 uxterm pflogd[10251]: Failed to initialize: (no
> >> devices found) /dev/bpf0: No such file or directory
> >> Nov 11 20:22:33 uxterm pflogd[10251]: Exiting, init failure
> >>
> >> And, tcpdump also fails saying that "no suitable device found". Of
> >> course there is no /dev/bpf0.
> >>
> >> Is there any way to have the bpf0 device without booting a kernel with
> >> bpf device included?
> >
> >The kernel module *should* work.  I suspect that there is an error
> >message when it tries to load the module and fails.  You could check
> >for that error message, or try to load the module by hand and see if
> >you get a clue to the problem.
> >
> 
> Here is how I did: commented out the "device bpf" line in the kernel,
> built and installed the kernel, and added ng_bpf_load="YES" in
> loader.conf. I guess this is the module for the bpf (is this correct?
> I'm not 100% sure). So, booting with the new kernel, and the module
> being loaded from the loader.conf, the pflogd fails to start with this
> error:

ng_bpf(4) and bpf(4) are *not* the same thing. ng_bpf is a netgraph
interface to bpf.

For some reason bpf(4) does not seem to be available as a module, so
if you want to use it then it has to be included in your kernel config.
 


> 
> Nov 11 20:22:33 uxterm pflogd[10251]: Failed to initialize: (no
> devices found) /dev/bpf0: No such file or directory
> Nov 11 20:22:33 uxterm pflogd[10251]: Exiting, init failure
> 
> And, tcpdump also fails saying that "no suitable device found". Of
> course there is no /dev/bpf0.
> 
> Unfortunately, I do not have enough experience to figure out how to
> load this device at runtime. Is there any solution to this situation?

No, it does not seem to be possible to load bpf at runtime.


-- 
<Insert your favourite quote here.>
Erik Trulsson
ertr1013 at student.uu.se