[Guy Harris <guy@xxxxxxxxxxxx>]

On Sun, Feb 01, 2004 at 11:24:27AM -0800, Richard Sharpe wrote:
> I can see that it might be possible under UNIX to use select or poll and 
> to open up several /dev/bpfN devices,

Or, rather, several live-capture pcap_t's, whether they're implemented
with /dev/bpfN or PF_PACKET sockets or DLPI devices or....

Also, see my comments on the problems with "select()" and "poll()" on
BPF devices.

> Another possible approach might be to modify the Berkeley Packet Filter 
> code to allow capture on multiple interfaces with the same filter 
> applying.

That works only if either

	1) that's done with a synthetic link-layer header, so that the
	   same BPF code can be made to work on multiple link-layer
	   types;

	2) you limit that mechanism to interfaces of the same type
	   (e.g., you don't get to capture on Ethernet and PPP links at
	   the same time);

	3) you supply multiple BPF programs for different link-layer
	   types.