1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $FreeBSD$ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd device bpf 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOCSETIF 47ioctl. 48A given interface can be shared be multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50The total number of open 51files is limited to the value given in the kernel configuration; the 52example given in the 53.Sx SYNOPSIS 54above sets the limit to 16. 55.Pp 56A separate device file is required for each minor device. 57If a file is in use, the open will fail and 58.Va errno 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. 67Each descriptor that accepts the packet receives its own copy. 68.Pp 69Reads from these files return the next group of packets 70that have matched the filter. 71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm . 74This size is returned by the 75.Dv BIOCGBLEN 76ioctl (see below), and 77can be set with 78.Dv BIOCSBLEN . 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length 83headers. Currently, only Ethernet, 84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP 100links are supported. 101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in 105.Aq Pa net/bpf.h . 106All commands require 107these includes: 108.Bd -literal 109 #include <sys/types.h> 110 #include <sys/time.h> 111 #include <sys/ioctl.h> 112 #include <net/bpf.h> 113.Ed 114.Pp 115Additionally, 116.Dv BIOCGETIF 117and 118.Dv BIOCSETIF 119require 120.Aq Pa sys/socket.h 121and 122.Aq Pa net/if.h . 123.Pp 124In addition to 125.Dv FIONREAD 126and 127.Dv SIOCGIFADDR , 128the following commands may be applied to any open 129.Nm 130file. 131The (third) argument to 132.Xr ioctl 2 133should be a pointer to the type indicated. 134.Bl -tag -width BIOCGRTIMEOUT 135.It Dv BIOCGBLEN 136.Pq Li u_int 137Returns the required buffer length for reads on 138.Nm 139files. 140.It Dv BIOCSBLEN 141.Pq Li u_int 142Sets the buffer length for reads on 143.Nm 144files. The buffer must be set before the file is attached to an interface 145with 146.Dv BIOCSETIF . 147If the requested buffer size cannot be accommodated, the closest 148allowable size will be set and returned in the argument. 149A read call will result in 150.Er EIO 151if it is passed a buffer that is not this size. 152.It Dv BIOCGDLT 153.Pq Li u_int 154Returns the type of the data link layer underlying the attached interface. 155.Er EINVAL 156is returned if no interface has been specified. 157The device types, prefixed with 158.Dq Li DLT_ , 159are defined in 160.Aq Pa net/bpf.h . 161.It Dv BIOCPROMISC 162Forces the interface into promiscuous mode. 163All packets, not just those destined for the local host, are processed. 164Since more than one file can be listening on a given interface, 165a listener that opened its interface non-promiscuously may receive 166packets promiscuously. This problem can be remedied with an 167appropriate filter. 168.It Dv BIOCFLUSH 169Flushes the buffer of incoming packets, 170and resets the statistics that are returned by BIOCGSTATS. 171.It Dv BIOCGETIF 172.Pq Li "struct ifreq" 173Returns the name of the hardware interface that the file is listening on. 174The name is returned in the ifr_name field of 175the 176.Li ifreq 177structure. 178All other fields are undefined. 179.It Dv BIOCSETIF 180.Pq Li "struct ifreq" 181Sets the hardware interface associate with the file. This 182command must be performed before any packets can be read. 183The device is indicated by name using the 184.Li ifr_name 185field of the 186.Li ifreq 187structure. 188Additionally, performs the actions of 189.Dv BIOCFLUSH . 190.It Dv BIOCSRTIMEOUT 191.It Dv BIOCGRTIMEOUT 192.Pq Li "struct timeval" 193Set or get the read timeout parameter. 194The argument 195specifies the length of time to wait before timing 196out on a read request. 197This parameter is initialized to zero by 198.Xr open 2 , 199indicating no timeout. 200.It Dv BIOCGSTATS 201.Pq Li "struct bpf_stat" 202Returns the following structure of packet statistics: 203.Bd -literal 204struct bpf_stat { 205 u_int bs_recv; /* number of packets received */ 206 u_int bs_drop; /* number of packets dropped */ 207}; 208.Ed 209.Pp 210The fields are: 211.Bl -hang -offset indent 212.It Li bs_recv 213the number of packets received by the descriptor since opened or reset 214(including any buffered since the last read call); 215and 216.It Li bs_drop 217the number of packets which were accepted by the filter but dropped by the 218kernel because of buffer overflows 219(i.e., the application's reads aren't keeping up with the packet traffic). 220.El 221.It Dv BIOCIMMEDIATE 222.Pq Li u_int 223Enable or disable 224.Dq immediate mode , 225based on the truth value of the argument. 226When immediate mode is enabled, reads return immediately upon packet 227reception. Otherwise, a read will block until either the kernel buffer 228becomes full or a timeout occurs. 229This is useful for programs like 230.Xr rarpd 8 231which must respond to messages in real time. 232The default for a new file is off. 233.It Dv BIOCSETF 234.Pq Li "struct bpf_program" 235Sets the filter program used by the kernel to discard uninteresting 236packets. An array of instructions and its length is passed in using 237the following structure: 238.Bd -literal 239struct bpf_program { 240 int bf_len; 241 struct bpf_insn *bf_insns; 242}; 243.Ed 244.Pp 245The filter program is pointed to by the 246.Li bf_insns 247field while its length in units of 248.Sq Li struct bpf_insn 249is given by the 250.Li bf_len 251field. 252Also, the actions of 253.Dv BIOCFLUSH 254are performed. 255See section 256.Sx "FILTER MACHINE" 257for an explanation of the filter language. 258.It Dv BIOCVERSION 259.Pq Li "struct bpf_version" 260Returns the major and minor version numbers of the filter language currently 261recognized by the kernel. Before installing a filter, applications must check 262that the current version is compatible with the running kernel. Version 263numbers are compatible if the major numbers match and the application minor 264is less than or equal to the kernel minor. The kernel version number is 265returned in the following structure: 266.Bd -literal 267struct bpf_version { 268 u_short bv_major; 269 u_short bv_minor; 270}; 271.Ed 272.Pp 273The current version numbers are given by 274.Dv BPF_MAJOR_VERSION 275and 276.Dv BPF_MINOR_VERSION 277from 278.Aq Pa net/bpf.h . 279An incompatible filter 280may result in undefined behavior (most likely, an error returned by 281.Fn ioctl 282or haphazard packet matching). 283.It Dv BIOCSHDRCMPLT 284.It Dv BIOCGHDRCMPLT 285.Pq Li u_int 286Set or get the status of the 287.Dq header complete 288flag. 289Set to zero if the link level source address should be filled in automatically 290by the interface output routine. Set to one if the link level source 291address will be written, as provided, to the wire. This flag is initialized 292to zero by default. 293.It Dv BIOCSSEESENT 294.It Dv BIOCGSEESENT 295.Pq Li u_int 296Set or get the flag determining whether locally generated packets on the 297interface should be returned by BPF. Set to zero to see only incoming 298packets on the interface. Set to one to see packets originating 299locally and remotely on the interface. This flag is initialized to one by 300default. 301.El 302.Sh BPF HEADER 303The following structure is prepended to each packet returned by 304.Xr read 2 : 305.Bd -literal 306struct bpf_hdr { 307 struct timeval bh_tstamp; /* time stamp */ 308 u_long bh_caplen; /* length of captured portion */ 309 u_long bh_datalen; /* original length of packet */ 310 u_short bh_hdrlen; /* length of bpf header (this struct 311 plus alignment padding */ 312}; 313.Ed 314.Pp 315The fields, whose values are stored in host order, and are: 316.Pp 317.Bl -tag -compact -width bh_datalen 318.It Li bh_tstamp 319The time at which the packet was processed by the packet filter. 320.It Li bh_caplen 321The length of the captured portion of the packet. This is the minimum of 322the truncation amount specified by the filter and the length of the packet. 323.It Li bh_datalen 324The length of the packet off the wire. 325This value is independent of the truncation amount specified by the filter. 326.It Li bh_hdrlen 327The length of the 328.Nm 329header, which may not be equal to 330.\" XXX - not really a function call 331.Fn sizeof "struct bpf_hdr" . 332.El 333.Pp 334The 335.Li bh_hdrlen 336field exists to account for 337padding between the header and the link level protocol. 338The purpose here is to guarantee proper alignment of the packet 339data structures, which is required on alignment sensitive 340architectures and improves performance on many other architectures. 341The packet filter insures that the 342.Li bpf_hdr 343and the network layer 344header will be word aligned. Suitable precautions 345must be taken when accessing the link layer protocol fields on alignment 346restricted machines. (This isn't a problem on an Ethernet, since 347the type field is a short falling on an even offset, 348and the addresses are probably accessed in a bytewise fashion). 349.Pp 350Additionally, individual packets are padded so that each starts 351on a word boundary. This requires that an application 352has some knowledge of how to get from packet to packet. 353The macro 354.Dv BPF_WORDALIGN 355is defined in 356.Aq Pa net/bpf.h 357to facilitate 358this process. It rounds up its argument 359to the nearest word aligned value (where a word is 360.Dv BPF_ALIGNMENT 361bytes wide). 362.Pp 363For example, if 364.Sq Li p 365points to the start of a packet, this expression 366will advance it to the next packet: 367.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 368.Pp 369For the alignment mechanisms to work properly, the 370buffer passed to 371.Xr read 2 372must itself be word aligned. 373The 374.Xr malloc 3 375function 376will always return an aligned buffer. 377.Sh FILTER MACHINE 378A filter program is an array of instructions, with all branches forwardly 379directed, terminated by a 380.Em return 381instruction. 382Each instruction performs some action on the pseudo-machine state, 383which consists of an accumulator, index register, scratch memory store, 384and implicit program counter. 385.Pp 386The following structure defines the instruction format: 387.Bd -literal 388struct bpf_insn { 389 u_short code; 390 u_char jt; 391 u_char jf; 392 u_long k; 393}; 394.Ed 395.Pp 396The 397.Li k 398field is used in different ways by different instructions, 399and the 400.Li jt 401and 402.Li jf 403fields are used as offsets 404by the branch instructions. 405The opcodes are encoded in a semi-hierarchical fashion. 406There are eight classes of instructions: 407.Dv BPF_LD , 408.Dv BPF_LDX , 409.Dv BPF_ST , 410.Dv BPF_STX , 411.Dv BPF_ALU , 412.Dv BPF_JMP , 413.Dv BPF_RET , 414and 415.Dv BPF_MISC . 416Various other mode and 417operator bits are or'd into the class to give the actual instructions. 418The classes and modes are defined in 419.Aq Pa net/bpf.h . 420.Pp 421Below are the semantics for each defined 422.Nm 423instruction. 424We use the convention that A is the accumulator, X is the index register, 425P[] packet data, and M[] scratch memory store. 426P[i:n] gives the data at byte offset 427.Dq i 428in the packet, 429interpreted as a word (n=4), 430unsigned halfword (n=2), or unsigned byte (n=1). 431M[i] gives the i'th word in the scratch memory store, which is only 432addressed in word units. The memory store is indexed from 0 to 433.Dv BPF_MEMWORDS 434- 1. 435.Li k , 436.Li jt , 437and 438.Li jf 439are the corresponding fields in the 440instruction definition. 441.Dq len 442refers to the length of the packet. 443.Pp 444.Bl -tag -width BPF_STXx 445.It Dv BPF_LD 446These instructions copy a value into the accumulator. The type of the 447source operand is specified by an 448.Dq addressing mode 449and can be a constant 450.Pq Dv BPF_IMM , 451packet data at a fixed offset 452.Pq Dv BPF_ABS , 453packet data at a variable offset 454.Pq Dv BPF_IND , 455the packet length 456.Pq Dv BPF_LEN , 457or a word in the scratch memory store 458.Pq Dv BPF_MEM . 459For 460.Dv BPF_IND 461and 462.Dv BPF_ABS , 463the data size must be specified as a word 464.Pq Dv BPF_W , 465halfword 466.Pq Dv BPF_H , 467or byte 468.Pq Dv BPF_B . 469The semantics of all the recognized 470.Dv BPF_LD 471instructions follow. 472.Pp 473.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 474.It Li BPF_LD+BPF_W+BPF_ABS 475A <- P[k:4] 476.It Li BPF_LD+BPF_H+BPF_ABS 477A <- P[k:2] 478.It Li BPF_LD+BPF_B+BPF_ABS 479A <- P[k:1] 480.It Li BPF_LD+BPF_W+BPF_IND 481A <- P[X+k:4] 482.It Li BPF_LD+BPF_H+BPF_IND 483A <- P[X+k:2] 484.It Li BPF_LD+BPF_B+BPF_IND 485A <- P[X+k:1] 486.It Li BPF_LD+BPF_W+BPF_LEN 487A <- len 488.It Li BPF_LD+BPF_IMM 489A <- k 490.It Li BPF_LD+BPF_MEM 491A <- M[k] 492.El 493.It Dv BPF_LDX 494These instructions load a value into the index register. Note that 495the addressing modes are more restrictive than those of the accumulator loads, 496but they include 497.Dv BPF_MSH , 498a hack for efficiently loading the IP header length. 499.Pp 500.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 501.It Li BPF_LDX+BPF_W+BPF_IMM 502X <- k 503.It Li BPF_LDX+BPF_W+BPF_MEM 504X <- M[k] 505.It Li BPF_LDX+BPF_W+BPF_LEN 506X <- len 507.It Li BPF_LDX+BPF_B+BPF_MSH 508X <- 4*(P[k:1]&0xf) 509.El 510.It Dv BPF_ST 511This instruction stores the accumulator into the scratch memory. 512We do not need an addressing mode since there is only one possibility 513for the destination. 514.Pp 515.Bl -tag -width "BPF_ST" -compact 516.It Li BPF_ST 517M[k] <- A 518.El 519.It Dv BPF_STX 520This instruction stores the index register in the scratch memory store. 521.Pp 522.Bl -tag -width "BPF_STX" -compact 523.It Li BPF_STX 524M[k] <- X 525.El 526.It Dv BPF_ALU 527The alu instructions perform operations between the accumulator and 528index register or constant, and store the result back in the accumulator. 529For binary operations, a source mode is required 530.Po 531.Dv BPF_K 532or 533.Dv BPF_X 534.Pc . 535.Pp 536.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 537.It Li BPF_ALU+BPF_ADD+BPF_K 538A <- A + k 539.It Li BPF_ALU+BPF_SUB+BPF_K 540A <- A - k 541.It Li BPF_ALU+BPF_MUL+BPF_K 542A <- A * k 543.It Li BPF_ALU+BPF_DIV+BPF_K 544A <- A / k 545.It Li BPF_ALU+BPF_AND+BPF_K 546A <- A & k 547.It Li BPF_ALU+BPF_OR+BPF_K 548A <- A | k 549.It Li BPF_ALU+BPF_LSH+BPF_K 550A <- A << k 551.It Li BPF_ALU+BPF_RSH+BPF_K 552A <- A >> k 553.It Li BPF_ALU+BPF_ADD+BPF_X 554A <- A + X 555.It Li BPF_ALU+BPF_SUB+BPF_X 556A <- A - X 557.It Li BPF_ALU+BPF_MUL+BPF_X 558A <- A * X 559.It Li BPF_ALU+BPF_DIV+BPF_X 560A <- A / X 561.It Li BPF_ALU+BPF_AND+BPF_X 562A <- A & X 563.It Li BPF_ALU+BPF_OR+BPF_X 564A <- A | X 565.It Li BPF_ALU+BPF_LSH+BPF_X 566A <- A << X 567.It Li BPF_ALU+BPF_RSH+BPF_X 568A <- A >> X 569.It Li BPF_ALU+BPF_NEG 570A <- -A 571.El 572.It Dv BPF_JMP 573The jump instructions alter flow of control. Conditional jumps 574compare the accumulator against a constant 575.Pq Dv BPF_K 576or the index register 577.Pq Dv BPF_X . 578If the result is true (or non-zero), 579the true branch is taken, otherwise the false branch is taken. 580Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 581However, the jump always 582.Pq Dv BPF_JA 583opcode uses the 32 bit 584.Li k 585field as the offset, allowing arbitrarily distant destinations. 586All conditionals use unsigned comparison conventions. 587.Pp 588.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 589.It Li BPF_JMP+BPF_JA 590pc += k 591.It Li BPF_JMP+BPF_JGT+BPF_K 592pc += (A > k) ? jt : jf 593.It Li BPF_JMP+BPF_JGE+BPF_K 594pc += (A >= k) ? jt : jf 595.It Li BPF_JMP+BPF_JEQ+BPF_K 596pc += (A == k) ? jt : jf 597.It Li BPF_JMP+BPF_JSET+BPF_K 598pc += (A & k) ? jt : jf 599.It Li BPF_JMP+BPF_JGT+BPF_X 600pc += (A > X) ? jt : jf 601.It Li BPF_JMP+BPF_JGE+BPF_X 602pc += (A >= X) ? jt : jf 603.It Li BPF_JMP+BPF_JEQ+BPF_X 604pc += (A == X) ? jt : jf 605.It Li BPF_JMP+BPF_JSET+BPF_X 606pc += (A & X) ? jt : jf 607.El 608.It Dv BPF_RET 609The return instructions terminate the filter program and specify the amount 610of packet to accept (i.e., they return the truncation amount). A return 611value of zero indicates that the packet should be ignored. 612The return value is either a constant 613.Pq Dv BPF_K 614or the accumulator 615.Pq Dv BPF_A . 616.Pp 617.Bl -tag -width "BPF_RET+BPF_K" -compact 618.It Li BPF_RET+BPF_A 619accept A bytes 620.It Li BPF_RET+BPF_K 621accept k bytes 622.El 623.It Dv BPF_MISC 624The miscellaneous category was created for anything that doesn't 625fit into the above classes, and for any new instructions that might need to 626be added. Currently, these are the register transfer instructions 627that copy the index register to the accumulator or vice versa. 628.Pp 629.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 630.It Li BPF_MISC+BPF_TAX 631X <- A 632.It Li BPF_MISC+BPF_TXA 633A <- X 634.El 635.El 636.Pp 637The 638.Nm 639interface provides the following macros to facilitate 640array initializers: 641.Fn BPF_STMT opcode operand 642and 643.Fn BPF_JUMP opcode operand true_offset false_offset . 644.Pp 645.Sh EXAMPLES 646The following filter is taken from the Reverse ARP Daemon. It accepts 647only Reverse ARP requests. 648.Bd -literal 649struct bpf_insn insns[] = { 650 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 651 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 652 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 653 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 654 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 655 sizeof(struct ether_header)), 656 BPF_STMT(BPF_RET+BPF_K, 0), 657}; 658.Ed 659.Pp 660This filter accepts only IP packets between host 128.3.112.15 and 661128.3.112.35. 662.Bd -literal 663struct bpf_insn insns[] = { 664 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 665 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 666 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 26), 667 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 668 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 669 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 670 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 671 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 672 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 673 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 674 BPF_STMT(BPF_RET+BPF_K, 0), 675}; 676.Ed 677.Pp 678Finally, this filter returns only TCP finger packets. We must parse 679the IP header to reach the TCP header. The 680.Dv BPF_JSET 681instruction 682checks that the IP fragment offset is 0 so we are sure 683that we have a TCP header. 684.Bd -literal 685struct bpf_insn insns[] = { 686 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 687 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 688 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 689 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 690 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 691 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 692 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 693 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 694 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 695 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 696 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 697 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 698 BPF_STMT(BPF_RET+BPF_K, 0), 699}; 700.Ed 701.Sh SEE ALSO 702.Xr tcpdump 1 , 703.Xr ioctl 2 , 704.Xr byteorder 3 , 705.Xr ng_bpf 4 706.Rs 707.%A McCanne, S. 708.%A Jacobson V. 709.%T "An efficient, extensible, and portable network monitor" 710.Re 711.Sh FILES 712.Bl -tag -compact -width /dev/bpfXXX 713.It Pa /dev/bpf Ns Sy n 714the packet filter device 715.El 716.Sh BUGS 717The read buffer must be of a fixed size (returned by the 718.Dv BIOCGBLEN 719ioctl). 720.Pp 721A file that does not request promiscuous mode may receive promiscuously 722received packets as a side effect of another file requesting this 723mode on the same hardware interface. This could be fixed in the kernel 724with additional processing overhead. However, we favor the model where 725all files must assume that the interface is promiscuous, and if 726so desired, must utilize a filter to reject foreign packets. 727.Pp 728Data link protocols with variable length headers are not currently supported. 729.Sh HISTORY 730.Pp 731The Enet packet filter was created in 1980 by Mike Accetta and 732Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 733Stanford, ported the code to BSD and continued its development from 7341983 on. Since then, it has evolved into the Ultrix Packet Filter 735at 736.Tn DEC , 737a 738.Tn STREAMS 739.Tn NIT 740module under 741.Tn SunOS 4.1 , 742and 743.Tn BPF . 744.Sh AUTHORS 745.An -nosplit 746.An Steven McCanne , 747of Lawrence Berkeley Laboratory, implemented BPF in 748Summer 1990. Much of the design is due to 749.An Van Jacobson . 750