BPF on Solaris?

[Ted Lemon]

On Sep 13, 2005, at 12:57 PM, David W. Hankins wrote:
> I was under the impression that wasn't a reliable mark of wether
> or not the client broadcast the packet to the segment from which
> it was received.

If the client sends a broadcast, the destination address you receive  
should be 255.255.255.255.   So you don't know what subnet the client  
is on, but you do know that it sent a broadcast.   You can determine  
to which network the client is attached by looking at the interface  
ID, which I think you can get from Solaris' socket API with a recvmsg 
() option.

> Particularly since ISC dhcrelay made precisely that mistake until
> recent repairs.

DHCP relay agents should never receive unicast packets from  
clients.   If they are receiving them, it's *because* you are using  
BPF, so you're bypassing the kernel's "is this for me?" check.