ether: a frame addressed to somebody else is not ours

fw asks the card for promiscuous mode and then hands the protected
stack every IP frame that arrives on it, whoever it was for.  On a
switched network that is mostly nothing; on anything else it is the
neighbours' traffic, judged against the rules, counted in stats, and
entered in the flow table as conversations that were never ours.  A
flow created that way outlives the packet that made it and will let
traffic past that no rule was asked about.

Promiscuous is still needed.  The stack behind fw joins multicast
groups on a pkt interface, which has no way to tell a card about them,
so without it the groups would never be received at all.  What it costs
is the filter ethermux would otherwise have applied:

	if(!tome && !multi && !f->prom)
		continue;

Frames addressed to this card, plus broadcast and multicast, would have
arrived for nothing.  So etherin puts that test back itself: the
destination is ours, or it is a group address, or the frame is not ours
to look at.

No test.  This is on the wire side of card mode, and the suite can take
a spare card but cannot make a neighbour send to it.  Reproducing it
needs a second machine on the same segment, which is on the list of
things never tested and stays there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions