i'll leave this rfe deliberately vague as i don't have
too great a preference as to how this is implemented.
what my customer would like (& what would be extremely
useful for troubleshooting purposes) is the ability to
'snoop' (in some way) loopback ip traffic
the sort of thing that springs to mind would be some sort
of /dev/lo pseudo device that supports dlpi (or at least
the subset that snoop uses). the ability to snoop all ip
traffic via this (as opposed to just that intended for
loopback) would also be cool as a timesaver on multihomed
m/cs & also for diagnosing disparities between what ip
sees/sends & what the data links (/dev/le etc) see
maybe there could be a way of switching this capability
on/off (could be automatic whenever anything snoops it)
so it doesn't cause a hit in performance under normal
operation