Manual Pages  — NG_ETHER

Three hooks are supported: lower, upper, and orphans. The hook name divert may be used as an alias for lower, and is provided for backward compatibility. In reality, the two names represent the same hook.

The lower hook is a connection to the raw Ethernet device. When connected, all incoming packets are forwarded to this hook, instead of being passed to the kernel for upper layer processing. Writing to this hook results in a raw Ethernet frame being transmitted by the device. Normal outgoing packets are not affected by lower being connected.

The upper hook is a connection to the upper protocol layers. When connected, all outgoing packets are forwarded to this hook, instead of being transmitted by the device. Writing to this hook results in a raw Ethernet frame being received by the kernel just as if it had come in over the wire. Normal incoming packets are not affected by upper being connected.

The orphans hook is equivalent to lower, except that only unrecognized packets (that would otherwise be discarded) are written to the hook, while other normal incoming traffic is unaffected. Unrecognized packets written to upper will be forwarded back out to orphans if connected.

In all cases, frames are raw Ethernet frames with the standard 14 byte Ethernet header (but no checksum).

When no hooks are connected, upper and lower are in effect connected together, so that packets flow normally upwards and downwards.

These commands insert an ng_tee(4) node between the lower and upper protocol layers, which can be used for tracing packet flow, statistics, etc.:

ngctl mkpeer fxp0: tee lower right
ngctl connect fxp0: lower upper left