Red Bear OS
e185e03d88
observer: add BPF-style filter + output path capture
Capture filter supports tcpdump-like expressions:
echo tcp > /scheme/netcfg/capture/filter
echo udp port 53 > /scheme/netcfg/capture/filter
echo icmp > /scheme/netcfg/capture/filter
echo tcp port 80 > /scheme/netcfg/capture/filter
cat /scheme/netcfg/capture/filter → reads current filter
Filter matches IP header protocol field + TCP/UDP port fields.
Parses IPv4 and IPv6 headers. Non-IP packets captured always.
Output path capture: dispatch() now captures packets going
to devices (outbound locally-generated traffic).
Full capture coverage: input (forward_packets) + output (dispatch).