Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] dumpcap and bpf assembler

From: Richard Stearn <richard@xxxxxxxxxxxxxxxxxxxxxx>
Date: Thu, 28 May 2015 09:44:03 +0100
Sake Blok wrote:

Hi Sake

I think I misunderstood you then. I thought you were looking for a
> way to write some assembly/machine code for the BPF pseudo processor.

You understood me perfectly.  That exactly what I wish to do.

Which of course works only on the content of a packet (link layer
> data and upwards). I believe that anything the BPF engine can do can

In Linux there are some extensions to BPF that allow access to a few
Linux internal variables:

	https://www.kernel.org/doc/Documentation/networking/filter.txt

I just need to find or code a method of passing the assembler source
to the kernel within dumpcap.

--
Regards
	Richard