search for: bpf_internal_load_pointer_neg_help

...nd he is probably going to just point this out more clearly in the > man pages. Right, what you can also try to do is to add SKF_LL_OFF or SKF_NET_OFF offset to you load offsets in the K constant. It would require to use something like bpf_asm to write your filters by hand. F.e. if you look at bpf_internal_load_pointer_neg_helper() helper function in the kernel, they check for SKF_NET_OFF/SKF_LL_OFF and then use K relative to skb_network_header(skb) or skb_mac_header(skb), respectively. This should resolve your use-case. The problem is that with libpcap, the filters are generated for tcpdump specifically, and tcpdump doe...