1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.Dd January 16, 1996 24.Dt BPF 4 25.Os BSD 4.4 26.Sh NAME 27.Nm bpf 28.Nd Berkeley Packet Filter 29.Sh SYNOPSIS 30.Cd pseudo-device bpfilter 31.Sh DESCRIPTION 32The Berkeley Packet Filter 33provides a raw interface to data link layers in a protocol 34independent fashion. 35All packets on the network, even those destined for other hosts, 36are accessible through this mechanism. 37.Pp 38The packet filter appears as a character special device, 39.Pa /dev/bpf0 , 40.Pa /dev/bpf1 , 41etc. 42After opening the device, the file descriptor must be bound to a 43specific network interface with the 44.Dv BIOSETIF 45ioctl. 46A given interface can be shared be multiple listeners, and the filter 47underlying each descriptor will see an identical packet stream. 48The total number of open 49files is limited to the value given in the kernel configuration; the 50example given in the 51.Sx SYNOPSIS 52above sets the limit to 16. 53.Pp 54A separate device file is required for each minor device. 55If a file is in use, the open will fail and 56.Va errno 57will be set to 58.Er EBUSY . 59.Pp 60Associated with each open instance of a 61.Nm bpf 62file is a user-settable packet filter. 63Whenever a packet is received by an interface, 64all file descriptors listening on that interface apply their filter. 65Each descriptor that accepts the packet receives its own copy. 66.Pp 67Reads from these files return the next group of packets 68that have matched the filter. 69To improve performance, the buffer passed to read must be 70the same size as the buffers used internally by 71.Nm 72This size is returned by the 73.Dv BIOCGBLEN 74ioctl (see below), and 75can be set with 76.Dv BIOCSBLEN. 77Note that an individual packet larger than this size is necessarily 78truncated. 79.Pp 80The packet filter will support any link level protocol that has fixed length 81headers. Currently, only Ethernet, 82.Tn SLIP , 83and 84.Tn PPP 85drivers have been modified to interact with 86.Nm bpf . 87.Pp 88Since packet data is in network byte order, applications should use the 89.Xr byteorder 3 90macros to extract multi-byte values. 91.Pp 92A packet can be sent out on the network by writing to a 93.Nm bpf 94file descriptor. The writes are unbuffered, meaning only one 95packet can be processed per write. 96Currently, only writes to Ethernets and 97.Tn SLIP 98links are supported. 99.Sh IOCTLS 100The 101.Xr ioctl 2 102command codes below are defined in <net/bpf.h>. All commands require 103these includes: 104.Bd -literal 105 #include <sys/types.h> 106 #include <sys/time.h> 107 #include <sys/ioctl.h> 108 #include <net/bpf.h> 109.Ed 110.Pp 111Additionally, 112.Dv BIOCGETIF 113and 114.Dv BIOCSETIF 115require 116.Aq Pa net/if.h . 117 118In addition to 119.Dv FIONREAD 120and 121.Dv SIOCGIFADDR , 122the following commands may be applied to any open 123.Nm 124file. 125The (third) argument to 126.Xr ioctl 2 127should be a pointer to the type indicated. 128 129.Bl -tag -width BIOCGRTIMEOUT 130.It Dv BIOCGBLEN 131.Pq Li u_int 132Returns the required buffer length for reads on 133.Nm 134files. 135.It Dv BIOCSBLEN 136.Pq Li u_int 137Sets the buffer length for reads on 138.Nm 139files. The buffer must be set before the file is attached to an interface 140with 141.Dv BIOCSETIF . 142If the requested buffer size cannot be accommodated, the closest 143allowable size will be set and returned in the argument. 144A read call will result in 145.Er EIO 146if it is passed a buffer that is not this size. 147.It Dv BIOCGDLT 148.Pq Li u_int 149Returns the type of the data link layer underlying the attached interface. 150.Er EINVAL 151is returned if no interface has been specified. 152The device types, prefixed with 153.Dq Li DLT_ , 154are defined in 155.Aq Pa net/bpf.h . 156.It Dv BIOCPROMISC 157Forces the interface into promiscuous mode. 158All packets, not just those destined for the local host, are processed. 159Since more than one file can be listening on a given interface, 160a listener that opened its interface non-promiscuously may receive 161packets promiscuously. This problem can be remedied with an 162appropriate filter. 163.It Dv BIOCFLUSH 164Flushes the buffer of incoming packets, 165and resets the statistics that are returned by BIOCGSTATS. 166.It Dv BIOCGETIF 167.Pq Li "struct ifreq" 168Returns the name of the hardware interface that the file is listening on. 169The name is returned in the if_name field of 170the 171.Li ifreq 172structure. 173All other fields are undefined. 174.It Dv BIOCSETIF 175.Pq Li "struct ifreq" 176Sets the hardware interface associate with the file. This 177command must be performed before any packets can be read. 178The device is indicated by name using the 179.Li if_name 180field of the 181.Li ifreq 182structure. 183Additionally, performs the actions of 184.Dv BIOCFLUSH . 185.It Dv BIOCSRTIMEOUT 186.It Dv BIOCGRTIMEOUT 187.Pq Li "struct timeval" 188Set or get the read timeout parameter. 189The argument 190specifies the length of time to wait before timing 191out on a read request. 192This parameter is initialized to zero by 193.Xr open 2 , 194indicating no timeout. 195.It Dv BIOCGSTATS 196.Pq Li "struct bpf_stat" 197Returns the following structure of packet statistics: 198.Bd -literal 199struct bpf_stat { 200 u_int bs_recv; 201 u_int bs_drop; 202}; 203.Ed 204 205The fields are: 206.Bl -hang -offset indent 207.It Li bs_recv 208the number of packets received by the descriptor since opened or reset 209(including any buffered since the last read call); 210and 211.It Li bs_drop 212the number of packets which were accepted by the filter but dropped by the 213kernel because of buffer overflows 214(i.e., the application's reads aren't keeping up with the packet traffic). 215.El 216.It Dv BIOCIMMEDIATE 217.Pq Li u_int 218Enable or disable ``immediate mode'', based on the truth value of the argument. 219When immediate mode is enabled, reads return immediately upon packet 220reception. Otherwise, a read will block until either the kernel buffer 221becomes full or a timeout occurs. 222This is useful for programs like 223.Xr rarpd 8 224which must respond to messages in real time. 225The default for a new file is off. 226.It Dv BIOCSETF 227.Pq Li "struct bpf_program" 228Sets the filter program used by the kernel to discard uninteresting 229packets. An array of instructions and its length is passed in using 230the following structure: 231.Bd -literal 232struct bpf_program { 233 int bf_len; 234 struct bpf_insn *bf_insns; 235}; 236.Ed 237 238The filter program is pointed to by the 239.Li bf_insns 240field while its length in units of 241.Sq Li struct bpf_insn 242is given by the 243.Li bf_len 244field. 245Also, the actions of 246.Dv BIOCFLUSH are performed. 247See section 248.Sx "FILTER MACHINE" 249for an explanation of the filter language. 250.It Dv BIOCVERSION 251.Pq Li "struct bpf_version" 252Returns the major and minor version numbers of the filter language currently 253recognized by the kernel. Before installing a filter, applications must check 254that the current version is compatible with the running kernel. Version 255numbers are compatible if the major numbers match and the application minor 256is less than or equal to the kernel minor. The kernel version number is 257returned in the following structure: 258.Bd -literal 259struct bpf_version { 260 u_short bv_major; 261 u_short bv_minor; 262}; 263.Ed 264 265The current version numbers are given by 266.Dv BPF_MAJOR_VERSION 267and 268.Dv BPF_MINOR_VERSION 269from 270.Aq Pa net/bpf.h . 271An incompatible filter 272may result in undefined behavior (most likely, an error returned by 273.Fn ioctl 274or haphazard packet matching). 275.Sh BPF HEADER 276The following structure is prepended to each packet returned by 277.Xr read 2 : 278.Bd -literal 279struct bpf_hdr { 280 struct timeval bh_tstamp; 281 u_long bh_caplen; 282 u_long bh_datalen; 283 u_short bh_hdrlen; 284}; 285.Ed 286.Pp 287The fields, whose values are stored in host order, and are: 288.Pp 289.Bl -tag -compact -width bh_datalen 290.It Li bh_tstamp 291The time at which the packet was processed by the packet filter. 292.It Li bh_caplen 293The length of the captured portion of the packet. This is the minimum of 294the truncation amount specified by the filter and the length of the packet. 295.It Li bh_datalen 296The length of the packet off the wire. 297This value is independent of the truncation amount specified by the filter. 298.It Li bh_hdrlen 299The length of the 300.Nm 301header, which may not be equal to 302.\" XXX - not really a function call 303.Fn sizeof "struct bpf_hdr" . 304.El 305.Pp 306The 307.Li bh_hdrlen 308field exists to account for 309padding between the header and the link level protocol. 310The purpose here is to guarantee proper alignment of the packet 311data structures, which is required on alignment sensitive 312architectures and and improves performance on many other architectures. 313The packet filter insures that the 314.Li bpf_hdr 315and the network layer 316header will be word aligned. Suitable precautions 317must be taken when accessing the link layer protocol fields on alignment 318restricted machines. (This isn't a problem on an Ethernet, since 319the type field is a short falling on an even offset, 320and the addresses are probably accessed in a bytewise fashion). 321.Pp 322Additionally, individual packets are padded so that each starts 323on a word boundary. This requires that an application 324has some knowledge of how to get from packet to packet. 325The macro 326.Dv BPF_WORDALIGN 327is defined in 328.Aq Pa net/bpf.h 329to facilitate 330this process. It rounds up its argument 331to the nearest word aligned value (where a word is 332.Dv BPF_ALIGNMENT 333bytes wide). 334.Pp 335For example, if 336.Sq Li p 337points to the start of a packet, this expression 338will advance it to the next packet: 339.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 340.Pp 341For the alignment mechanisms to work properly, the 342buffer passed to 343.Xr read 2 344must itself be word aligned. 345The 346.Xr malloc 3 347function 348will always return an aligned buffer. 349.Sh FILTER MACHINE 350A filter program is an array of instructions, with all branches forwardly 351directed, terminated by a 352.Em return 353instruction. 354Each instruction performs some action on the pseudo-machine state, 355which consists of an accumulator, index register, scratch memory store, 356and implicit program counter. 357 358The following structure defines the instruction format: 359.Bd -literal 360struct bpf_insn { 361 u_short code; 362 u_char jt; 363 u_char jf; 364 long k; 365}; 366.Ed 367 368The 369.Li k 370field is used in different ways by different instructions, 371and the 372.Li jt 373and 374.Li jf 375fields are used as offsets 376by the branch instructions. 377The opcodes are encoded in a semi-hierarchical fashion. 378There are eight classes of instructions: 379.Dv BPF_LD , 380.Dv BPF_LDX , 381.Dv BPF_ST , 382.Dv BPF_STX , 383.Dv BPF_ALU , 384.Dv BPF_JMP , 385.Dv BPF_RET , 386and 387.Dv BPF_MISC . 388Various other mode and 389operator bits are or'd into the class to give the actual instructions. 390The classes and modes are defined in 391.Aq Pa net/bpf.h . 392 393Below are the semantics for each defined 394.Nm 395instruction. 396We use the convention that A is the accumulator, X is the index register, 397P[] packet data, and M[] scratch memory store. 398P[i:n] gives the data at byte offset ``i'' in the packet, 399interpreted as a word (n=4), 400unsigned halfword (n=2), or unsigned byte (n=1). 401M[i] gives the i'th word in the scratch memory store, which is only 402addressed in word units. The memory store is indexed from 0 to 403.Dv BPF_MEMWORDS 404- 1. 405.Li k , 406.Li jt , 407and 408.Li jf 409are the corresponding fields in the 410instruction definition. ``len'' refers to the length of the packet. 411.Pp 412.Bl -tag -width BPF_STXx -compact 413.It Dv BPF_LD 414These instructions copy a value into the accumulator. The type of the 415source operand is specified by an ``addressing mode'' and can be 416a constant 417.Pq Dv BPF_IMM , 418packet data at a fixed offset 419.Pq Dv BPF_ABS , 420packet data at a variable offset 421.Pq Dv BPF_IND , 422the packet length 423.Pq Dv BPF_LEN , 424or a word in the scratch memory store 425.Pq Dv BPF_MEM . 426For 427.Dv BPF_IND 428and 429.Dv BPF_ABS, 430the data size must be specified as a word 431.Pq Dv BPF_W , 432halfword 433.Pq Dv BPF_H , 434or byte 435.Pq Dv BPF_B . 436The semantics of all the recognized 437.Dv BPF_LD 438instructions follow. 439.Pp 440.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 441.It Li BPF_LD+BPF_W+BPF_ABS 442A <- P[k:4] 443.It Li BPF_LD+BPF_H+BPF_ABS 444A <- P[k:2] 445.It Li BPF_LD+BPF_B+BPF_ABS 446A <- P[k:1] 447.It Li BPF_LD+BPF_W+BPF_IND 448A <- P[X+k:4] 449.It Li BPF_LD+BPF_H+BPF_IND 450A <- P[X+k:2] 451.It Li BPF_LD+BPF_B+BPF_IND 452A <- P[X+k:1] 453.It Li BPF_LD+BPF_W+BPF_LEN 454A <- len 455.It Li BPF_LD+BPF_IMM 456A <- k 457.It Li BPF_LD+BPF_MEM 458A <- M[k] 459.El 460 461.It Dv BPF_LDX 462These instructions load a value into the index register. Note that 463the addressing modes are more restrictive than those of the accumulator loads, 464but they include 465.Dv BPF_MSH , 466a hack for efficiently loading the IP header length. 467 468.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 469.It Li BPF_LDX+BPF_W+BPF_IMM 470X <- k 471.It Li BPF_LDX+BPF_W+BPF_MEM 472X <- M[k] 473.It Li BPF_LDX+BPF_W+BPF_LEN 474X <- len 475.It Li BPF_LDX+BPF_B+BPF_MSH 476X <- 4*(P[k:1]&0xf) 477.El 478 479.It Dv BPF_ST 480This instruction stores the accumulator into the scratch memory. 481We do not need an addressing mode since there is only one possibility 482for the destination. 483 484.Bl -tag -width "BPF_ST" -compact 485.It Li BPF_ST 486M[k] <- A 487.El 488 489.It Dv BPF_STX 490This instruction stores the index register in the scratch memory store. 491 492.Bl -tag -width "BPF_STX" -compact 493.It Li BPF_STX 494M[k] <- X 495.El 496 497.It Dv BPF_ALU 498The alu instructions perform operations between the accumulator and 499index register or constant, and store the result back in the accumulator. 500For binary operations, a source mode is required 501.Po 502.Dv BPF_K 503or 504.Dv BPF_X 505.Pc . 506 507.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 508.It Li BPF_ALU+BPF_ADD+BPF_K 509A <- A + k 510.It Li BPF_ALU+BPF_SUB+BPF_K 511A <- A - k 512.It Li BPF_ALU+BPF_MUL+BPF_K 513A <- A * k 514.It Li BPF_ALU+BPF_DIV+BPF_K 515A <- A / k 516.It Li BPF_ALU+BPF_AND+BPF_K 517A <- A & k 518.It Li BPF_ALU+BPF_OR+BPF_K 519A <- A | k 520.It Li BPF_ALU+BPF_LSH+BPF_K 521A <- A << k 522.It Li BPF_ALU+BPF_RSH+BPF_K 523A <- A >> k 524.It Li BPF_ALU+BPF_ADD+BPF_X 525A <- A + X 526.It Li BPF_ALU+BPF_SUB+BPF_X 527A <- A - X 528.It Li BPF_ALU+BPF_MUL+BPF_X 529A <- A * X 530.It Li BPF_ALU+BPF_DIV+BPF_X 531A <- A / X 532.It Li BPF_ALU+BPF_AND+BPF_X 533A <- A & X 534.It Li BPF_ALU+BPF_OR+BPF_X 535A <- A | X 536.It Li BPF_ALU+BPF_LSH+BPF_X 537A <- A << X 538.It Li BPF_ALU+BPF_RSH+BPF_X 539A <- A >> X 540.It Li BPF_ALU+BPF_NEG 541A <- -A 542.El 543 544.It Dv BPF_JMP 545The jump instructions alter flow of control. Conditional jumps 546compare the accumulator against a constant 547.Pq Dv BPF_K 548or the index register 549.Pq Dv BPF_X . 550If the result is true (or non-zero), 551the true branch is taken, otherwise the false branch is taken. 552Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 553However, the jump always 554.Pq Dv BPF_JA 555opcode uses the 32 bit 556.Li k 557field as the offset, allowing arbitrarily distant destinations. 558All conditionals use unsigned comparison conventions. 559 560.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 561.It Li BPF_JMP+BPF_JA 562pc += k 563.It Li BPF_JMP+BPF_JGT+BPF_K 564pc += (A > k) ? jt : jf 565.It Li BPF_JMP+BPF_JGE+BPF_K 566pc += (A >= k) ? jt : jf 567.It Li BPF_JMP+BPF_JEQ+BPF_K 568pc += (A == k) ? jt : jf 569.It Li BPF_JMP+BPF_JSET+BPF_K 570pc += (A & k) ? jt : jf 571.It Li BPF_JMP+BPF_JGT+BPF_X 572pc += (A > X) ? jt : jf 573.It Li BPF_JMP+BPF_JGE+BPF_X 574pc += (A >= X) ? jt : jf 575.It Li BPF_JMP+BPF_JEQ+BPF_X 576pc += (A == X) ? jt : jf 577.It Li BPF_JMP+BPF_JSET+BPF_X 578pc += (A & X) ? jt : jf 579.El 580 581.It Dv BPF_RET 582The return instructions terminate the filter program and specify the amount 583of packet to accept (i.e., they return the truncation amount). A return 584value of zero indicates that the packet should be ignored. 585The return value is either a constant 586.Pq Dv BPF_K 587or the accumulator 588.Pq Dv BPF_A . 589 590.Bl -tag -width "BPF_RET+BPF_K" -compact 591.It Li BPF_RET+BPF_A 592accept A bytes 593.It Li BPF_RET+BPF_K 594accept k bytes 595.El 596 597.It Dv BPF_MISC 598The miscellaneous category was created for anything that doesn't 599fit into the above classes, and for any new instructions that might need to 600be added. Currently, these are the register transfer instructions 601that copy the index register to the accumulator or vice versa. 602 603.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 604.It Li BPF_MISC+BPF_TAX 605X <- A 606.It Li BPF_MISC+BPF_TXA 607A <- X 608.El 609.Pp 610The 611.Nm 612interface provides the following macros to facilitate 613array initializers: 614.Fn BPF_STMT opcode operand 615and 616.Fn BPF_JUMP opcode operand true_offset false_offset . 617.Pp 618.Sh EXAMPLES 619The following filter is taken from the Reverse ARP Daemon. It accepts 620only Reverse ARP requests. 621.Bd -literal 622struct bpf_insn insns[] = { 623 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 624 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 625 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 626 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 627 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 628 sizeof(struct ether_header)), 629 BPF_STMT(BPF_RET+BPF_K, 0), 630}; 631.Ed 632.Pp 633This filter accepts only IP packets between host 128.3.112.15 and 634128.3.112.35. 635.Bd -literal 636struct bpf_insn insns[] = { 637 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 638 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 639 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 26), 640 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 641 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 642 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 643 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 644 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 645 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 646 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 647 BPF_STMT(BPF_RET+BPF_K, 0), 648}; 649.Ed 650.Pp 651Finally, this filter returns only TCP finger packets. We must parse 652the IP header to reach the TCP header. The 653.Dv BPF_JSET 654instruction 655checks that the IP fragment offset is 0 so we are sure 656that we have a TCP header. 657.Bd -literal 658struct bpf_insn insns[] = { 659 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 660 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 661 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 662 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 663 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 664 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 665 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 666 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 667 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 668 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 669 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 670 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 671 BPF_STMT(BPF_RET+BPF_K, 0), 672}; 673.Ed 674.Sh SEE ALSO 675.Xr tcpdump 1 , 676.Xr ioctl 2 677.Rs 678.%A McCanne, S. 679.%A Jacobson V. 680.%T "An efficient, extensible, and portable network monitor" 681.Re 682.Sh FILES 683.Bl -tag -compact -width /dev/bpfXXX 684.It Pa /dev/bpf Ns Sy n 685the packet filter device 686.El 687.Sh BUGS 688The read buffer must be of a fixed size (returned by the 689.Dv BIOCGBLEN 690ioctl). 691.Pp 692A file that does not request promiscuous mode may receive promiscuously 693received packets as a side effect of another file requesting this 694mode on the same hardware interface. This could be fixed in the kernel 695with additional processing overhead. However, we favor the model where 696all files must assume that the interface is promiscuous, and if 697so desired, must utilize a filter to reject foreign packets. 698.Pp 699Data link protocols with variable length headers are not currently supported. 700.Sh HISTORY 701.Pp 702The Enet packet filter was created in 1980 by Mike Accetta and 703Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 704Stanford, ported the code to BSD and continued its development from 7051983 on. Since then, it has evolved into the Ultrix Packet Filter 706at 707.Tn DEC , 708a 709.Tn STREAMS 710.Tn NIT 711module under 712.Tn SunOS 4.1 , 713and 714.Tn BPF . 715.Sh AUTHORS 716.Pp 717Steven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in 718Summer 1990. Much of the design is due to Van Jacobson. 719