The ether netgraph node type allows Ethernet interfaces to interact with the netgraph(4) networking subsystem. Once the ng_ether module is loaded into the kernel, a node is automatically created for each Ethernet interface in the system. Each node will attempt to name itself with the same name as the associated interface.
Three hooks are supported: lower, upper, and orphans. The hook name divert may be used as an alias for lower, and is provided for backward compatibility. In reality, the two names represent the same hook.
The lower hook is a connection to the raw Ethernet device. When connected, all incoming packets are forwarded to this hook, instead of being passed to the kernel for upper layer processing. Writing to this hook results in a raw Ethernet frame being transmitted by the device. Normal outgoing packets are not affected by lower being connected.
The upper hook is a connection to the upper protocol layers. When connected, all outgoing packets are forwarded to this hook, instead of being transmitted by the device. Writing to this hook results in a raw Ethernet frame being received by the kernel just as if it had come in over the wire. Normal incoming packets are not affected by upper being connected.
The orphans hook is equivalent to lower, except that only unrecognized packets (that would otherwise be discarded) are written to the hook, while other normal incoming traffic is unaffected. Unrecognized packets written to upper will be forwarded back out to orphans if connected.
In all cases, frames are raw Ethernet frames with the standard 14 byte Ethernet header (but no checksum).
When no hooks are connected, upper and lower are in effect connected together, so that packets flow normally upwards and downwards.
This node type supports the following hooks: