1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $FreeBSD$ 24.\" 25.Dd February 26, 2007 26.Dt BPF 4 27.Os 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd device bpf 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOCSETIF 47ioctl. 48A given interface can be shared by multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50.Pp 51A separate device file is required for each minor device. 52If a file is in use, the open will fail and 53.Va errno 54will be set to 55.Er EBUSY . 56.Pp 57Associated with each open instance of a 58.Nm 59file is a user-settable packet filter. 60Whenever a packet is received by an interface, 61all file descriptors listening on that interface apply their filter. 62Each descriptor that accepts the packet receives its own copy. 63.Pp 64Reads from these files return the next group of packets 65that have matched the filter. 66To improve performance, the buffer passed to read must be 67the same size as the buffers used internally by 68.Nm . 69This size is returned by the 70.Dv BIOCGBLEN 71ioctl (see below), and 72can be set with 73.Dv BIOCSBLEN . 74Note that an individual packet larger than this size is necessarily 75truncated. 76.Pp 77The packet filter will support any link level protocol that has fixed length 78headers. 79Currently, only Ethernet, 80.Tn SLIP , 81and 82.Tn PPP 83drivers have been modified to interact with 84.Nm . 85.Pp 86Since packet data is in network byte order, applications should use the 87.Xr byteorder 3 88macros to extract multi-byte values. 89.Pp 90A packet can be sent out on the network by writing to a 91.Nm 92file descriptor. 93The writes are unbuffered, meaning only one packet can be processed per write. 94Currently, only writes to Ethernets and 95.Tn SLIP 96links are supported. 97.Sh IOCTLS 98The 99.Xr ioctl 2 100command codes below are defined in 101.In net/bpf.h . 102All commands require 103these includes: 104.Bd -literal 105 #include <sys/types.h> 106 #include <sys/time.h> 107 #include <sys/ioctl.h> 108 #include <net/bpf.h> 109.Ed 110.Pp 111Additionally, 112.Dv BIOCGETIF 113and 114.Dv BIOCSETIF 115require 116.In sys/socket.h 117and 118.In net/if.h . 119.Pp 120In addition to 121.Dv FIONREAD 122and 123.Dv SIOCGIFADDR , 124the following commands may be applied to any open 125.Nm 126file. 127The (third) argument to 128.Xr ioctl 2 129should be a pointer to the type indicated. 130.Bl -tag -width BIOCGRTIMEOUT 131.It Dv BIOCGBLEN 132.Pq Li u_int 133Returns the required buffer length for reads on 134.Nm 135files. 136.It Dv BIOCSBLEN 137.Pq Li u_int 138Sets the buffer length for reads on 139.Nm 140files. 141The buffer must be set before the file is attached to an interface 142with 143.Dv BIOCSETIF . 144If the requested buffer size cannot be accommodated, the closest 145allowable size will be set and returned in the argument. 146A read call will result in 147.Er EIO 148if it is passed a buffer that is not this size. 149.It Dv BIOCGDLT 150.Pq Li u_int 151Returns the type of the data link layer underlying the attached interface. 152.Er EINVAL 153is returned if no interface has been specified. 154The device types, prefixed with 155.Dq Li DLT_ , 156are defined in 157.In net/bpf.h . 158.It Dv BIOCPROMISC 159Forces the interface into promiscuous mode. 160All packets, not just those destined for the local host, are processed. 161Since more than one file can be listening on a given interface, 162a listener that opened its interface non-promiscuously may receive 163packets promiscuously. 164This problem can be remedied with an appropriate filter. 165.It Dv BIOCFLUSH 166Flushes the buffer of incoming packets, 167and resets the statistics that are returned by BIOCGSTATS. 168.It Dv BIOCGETIF 169.Pq Li "struct ifreq" 170Returns the name of the hardware interface that the file is listening on. 171The name is returned in the ifr_name field of 172the 173.Li ifreq 174structure. 175All other fields are undefined. 176.It Dv BIOCSETIF 177.Pq Li "struct ifreq" 178Sets the hardware interface associate with the file. 179This 180command must be performed before any packets can be read. 181The device is indicated by name using the 182.Li ifr_name 183field of the 184.Li ifreq 185structure. 186Additionally, performs the actions of 187.Dv BIOCFLUSH . 188.It Dv BIOCSRTIMEOUT 189.It Dv BIOCGRTIMEOUT 190.Pq Li "struct timeval" 191Set or get the read timeout parameter. 192The argument 193specifies the length of time to wait before timing 194out on a read request. 195This parameter is initialized to zero by 196.Xr open 2 , 197indicating no timeout. 198.It Dv BIOCGSTATS 199.Pq Li "struct bpf_stat" 200Returns the following structure of packet statistics: 201.Bd -literal 202struct bpf_stat { 203 u_int bs_recv; /* number of packets received */ 204 u_int bs_drop; /* number of packets dropped */ 205}; 206.Ed 207.Pp 208The fields are: 209.Bl -hang -offset indent 210.It Li bs_recv 211the number of packets received by the descriptor since opened or reset 212(including any buffered since the last read call); 213and 214.It Li bs_drop 215the number of packets which were accepted by the filter but dropped by the 216kernel because of buffer overflows 217(i.e., the application's reads are not keeping up with the packet traffic). 218.El 219.It Dv BIOCIMMEDIATE 220.Pq Li u_int 221Enable or disable 222.Dq immediate mode , 223based on the truth value of the argument. 224When immediate mode is enabled, reads return immediately upon packet 225reception. 226Otherwise, a read will block until either the kernel buffer 227becomes full or a timeout occurs. 228This is useful for programs like 229.Xr rarpd 8 230which must respond to messages in real time. 231The default for a new file is off. 232.It Dv BIOCSETF 233.Pq Li "struct bpf_program" 234Sets the read filter program used by the kernel to discard uninteresting 235packets. 236An array of instructions and its length is passed in using 237the following structure: 238.Bd -literal 239struct bpf_program { 240 int bf_len; 241 struct bpf_insn *bf_insns; 242}; 243.Ed 244.Pp 245The filter program is pointed to by the 246.Li bf_insns 247field while its length in units of 248.Sq Li struct bpf_insn 249is given by the 250.Li bf_len 251field. 252Also, the actions of 253.Dv BIOCFLUSH 254are performed. 255See section 256.Sx "FILTER MACHINE" 257for an explanation of the filter language. 258.It Dv BIOCSETWF 259.Pq Li "struct bpf_program" 260Sets the write filter program used by the kernel to control what type of 261packets can be written to the interface. 262See the 263.Dv BIOCSETF 264command for more 265information on the 266.Nm 267filter program. 268.It Dv BIOCVERSION 269.Pq Li "struct bpf_version" 270Returns the major and minor version numbers of the filter language currently 271recognized by the kernel. 272Before installing a filter, applications must check 273that the current version is compatible with the running kernel. 274Version numbers are compatible if the major numbers match and the application minor 275is less than or equal to the kernel minor. 276The kernel version number is returned in the following structure: 277.Bd -literal 278struct bpf_version { 279 u_short bv_major; 280 u_short bv_minor; 281}; 282.Ed 283.Pp 284The current version numbers are given by 285.Dv BPF_MAJOR_VERSION 286and 287.Dv BPF_MINOR_VERSION 288from 289.In net/bpf.h . 290An incompatible filter 291may result in undefined behavior (most likely, an error returned by 292.Fn ioctl 293or haphazard packet matching). 294.It Dv BIOCSHDRCMPLT 295.It Dv BIOCGHDRCMPLT 296.Pq Li u_int 297Set or get the status of the 298.Dq header complete 299flag. 300Set to zero if the link level source address should be filled in automatically 301by the interface output routine. 302Set to one if the link level source 303address will be written, as provided, to the wire. 304This flag is initialized to zero by default. 305.It Dv BIOCSSEESENT 306.It Dv BIOCGSEESENT 307.Pq Li u_int 308These commands are obsolete but left for compatibility. 309Use 310.Dv BIOCSDIRECTION 311and 312.Dv BIOCGDIRECTION 313instead. 314Set or get the flag determining whether locally generated packets on the 315interface should be returned by BPF. 316Set to zero to see only incoming packets on the interface. 317Set to one to see packets originating locally and remotely on the interface. 318This flag is initialized to one by default. 319.It Dv BIOCSDIRECTION 320.It Dv BIOCGDIRECTION 321.Pq Li u_int 322Set or get the setting determining whether incoming, outgoing, or all packets 323on the interface should be returned by BPF. 324Set to 325.Dv BPF_D_IN 326to see only incoming packets on the interface. 327Set to 328.Dv BPF_D_INOUT 329to see packets originating locally and remotely on the interface. 330Set to 331.Dv BPF_D_OUT 332to see only outgoing packets on the interface. 333This setting is initialized to 334.Dv BPF_D_INOUT 335by default. 336.It Dv BIOCFEEDBACK 337.Pq Li u_int 338Set packet feedback mode. 339This allows injected packets to be fed back as input to the interface when 340output via the interface is successful. 341When 342.Dv BPF_D_INOUT 343direction is set, injected outgoing packet is not returned by BPF to avoid 344duplication. This flag is initialized to zero by default. 345.It Dv BIOCLOCK 346Set the locked flag on the 347.Nm 348descriptor. 349This prevents the execution of 350ioctl commands which could change the underlying operating parameters of 351the device. 352.El 353.Sh BPF HEADER 354The following structure is prepended to each packet returned by 355.Xr read 2 : 356.Bd -literal 357struct bpf_hdr { 358 struct timeval bh_tstamp; /* time stamp */ 359 u_long bh_caplen; /* length of captured portion */ 360 u_long bh_datalen; /* original length of packet */ 361 u_short bh_hdrlen; /* length of bpf header (this struct 362 plus alignment padding */ 363}; 364.Ed 365.Pp 366The fields, whose values are stored in host order, and are: 367.Pp 368.Bl -tag -compact -width bh_datalen 369.It Li bh_tstamp 370The time at which the packet was processed by the packet filter. 371.It Li bh_caplen 372The length of the captured portion of the packet. 373This is the minimum of 374the truncation amount specified by the filter and the length of the packet. 375.It Li bh_datalen 376The length of the packet off the wire. 377This value is independent of the truncation amount specified by the filter. 378.It Li bh_hdrlen 379The length of the 380.Nm 381header, which may not be equal to 382.\" XXX - not really a function call 383.Fn sizeof "struct bpf_hdr" . 384.El 385.Pp 386The 387.Li bh_hdrlen 388field exists to account for 389padding between the header and the link level protocol. 390The purpose here is to guarantee proper alignment of the packet 391data structures, which is required on alignment sensitive 392architectures and improves performance on many other architectures. 393The packet filter insures that the 394.Li bpf_hdr 395and the network layer 396header will be word aligned. 397Suitable precautions 398must be taken when accessing the link layer protocol fields on alignment 399restricted machines. 400(This is not a problem on an Ethernet, since 401the type field is a short falling on an even offset, 402and the addresses are probably accessed in a bytewise fashion). 403.Pp 404Additionally, individual packets are padded so that each starts 405on a word boundary. 406This requires that an application 407has some knowledge of how to get from packet to packet. 408The macro 409.Dv BPF_WORDALIGN 410is defined in 411.In net/bpf.h 412to facilitate 413this process. 414It rounds up its argument to the nearest word aligned value (where a word is 415.Dv BPF_ALIGNMENT 416bytes wide). 417.Pp 418For example, if 419.Sq Li p 420points to the start of a packet, this expression 421will advance it to the next packet: 422.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 423.Pp 424For the alignment mechanisms to work properly, the 425buffer passed to 426.Xr read 2 427must itself be word aligned. 428The 429.Xr malloc 3 430function 431will always return an aligned buffer. 432.Sh FILTER MACHINE 433A filter program is an array of instructions, with all branches forwardly 434directed, terminated by a 435.Em return 436instruction. 437Each instruction performs some action on the pseudo-machine state, 438which consists of an accumulator, index register, scratch memory store, 439and implicit program counter. 440.Pp 441The following structure defines the instruction format: 442.Bd -literal 443struct bpf_insn { 444 u_short code; 445 u_char jt; 446 u_char jf; 447 u_long k; 448}; 449.Ed 450.Pp 451The 452.Li k 453field is used in different ways by different instructions, 454and the 455.Li jt 456and 457.Li jf 458fields are used as offsets 459by the branch instructions. 460The opcodes are encoded in a semi-hierarchical fashion. 461There are eight classes of instructions: 462.Dv BPF_LD , 463.Dv BPF_LDX , 464.Dv BPF_ST , 465.Dv BPF_STX , 466.Dv BPF_ALU , 467.Dv BPF_JMP , 468.Dv BPF_RET , 469and 470.Dv BPF_MISC . 471Various other mode and 472operator bits are or'd into the class to give the actual instructions. 473The classes and modes are defined in 474.In net/bpf.h . 475.Pp 476Below are the semantics for each defined 477.Nm 478instruction. 479We use the convention that A is the accumulator, X is the index register, 480P[] packet data, and M[] scratch memory store. 481P[i:n] gives the data at byte offset 482.Dq i 483in the packet, 484interpreted as a word (n=4), 485unsigned halfword (n=2), or unsigned byte (n=1). 486M[i] gives the i'th word in the scratch memory store, which is only 487addressed in word units. 488The memory store is indexed from 0 to 489.Dv BPF_MEMWORDS 490- 1. 491.Li k , 492.Li jt , 493and 494.Li jf 495are the corresponding fields in the 496instruction definition. 497.Dq len 498refers to the length of the packet. 499.Pp 500.Bl -tag -width BPF_STXx 501.It Dv BPF_LD 502These instructions copy a value into the accumulator. 503The type of the source operand is specified by an 504.Dq addressing mode 505and can be a constant 506.Pq Dv BPF_IMM , 507packet data at a fixed offset 508.Pq Dv BPF_ABS , 509packet data at a variable offset 510.Pq Dv BPF_IND , 511the packet length 512.Pq Dv BPF_LEN , 513or a word in the scratch memory store 514.Pq Dv BPF_MEM . 515For 516.Dv BPF_IND 517and 518.Dv BPF_ABS , 519the data size must be specified as a word 520.Pq Dv BPF_W , 521halfword 522.Pq Dv BPF_H , 523or byte 524.Pq Dv BPF_B . 525The semantics of all the recognized 526.Dv BPF_LD 527instructions follow. 528.Pp 529.Bd -literal 530BPF_LD+BPF_W+BPF_ABS A <- P[k:4] 531BPF_LD+BPF_H+BPF_ABS A <- P[k:2] 532BPF_LD+BPF_B+BPF_ABS A <- P[k:1] 533BPF_LD+BPF_W+BPF_IND A <- P[X+k:4] 534BPF_LD+BPF_H+BPF_IND A <- P[X+k:2] 535BPF_LD+BPF_B+BPF_IND A <- P[X+k:1] 536BPF_LD+BPF_W+BPF_LEN A <- len 537BPF_LD+BPF_IMM A <- k 538BPF_LD+BPF_MEM A <- M[k] 539.Ed 540.It Dv BPF_LDX 541These instructions load a value into the index register. 542Note that 543the addressing modes are more restrictive than those of the accumulator loads, 544but they include 545.Dv BPF_MSH , 546a hack for efficiently loading the IP header length. 547.Pp 548.Bd -literal 549BPF_LDX+BPF_W+BPF_IMM X <- k 550BPF_LDX+BPF_W+BPF_MEM X <- M[k] 551BPF_LDX+BPF_W+BPF_LEN X <- len 552BPF_LDX+BPF_B+BPF_MSH X <- 4*(P[k:1]&0xf) 553.Ed 554.It Dv BPF_ST 555This instruction stores the accumulator into the scratch memory. 556We do not need an addressing mode since there is only one possibility 557for the destination. 558.Pp 559.Bd -literal 560BPF_ST M[k] <- A 561.Ed 562.It Dv BPF_STX 563This instruction stores the index register in the scratch memory store. 564.Pp 565.Bd -literal 566BPF_STX M[k] <- X 567.Ed 568.It Dv BPF_ALU 569The alu instructions perform operations between the accumulator and 570index register or constant, and store the result back in the accumulator. 571For binary operations, a source mode is required 572.Dv ( BPF_K 573or 574.Dv BPF_X ) . 575.Pp 576.Bd -literal 577BPF_ALU+BPF_ADD+BPF_K A <- A + k 578BPF_ALU+BPF_SUB+BPF_K A <- A - k 579BPF_ALU+BPF_MUL+BPF_K A <- A * k 580BPF_ALU+BPF_DIV+BPF_K A <- A / k 581BPF_ALU+BPF_AND+BPF_K A <- A & k 582BPF_ALU+BPF_OR+BPF_K A <- A | k 583BPF_ALU+BPF_LSH+BPF_K A <- A << k 584BPF_ALU+BPF_RSH+BPF_K A <- A >> k 585BPF_ALU+BPF_ADD+BPF_X A <- A + X 586BPF_ALU+BPF_SUB+BPF_X A <- A - X 587BPF_ALU+BPF_MUL+BPF_X A <- A * X 588BPF_ALU+BPF_DIV+BPF_X A <- A / X 589BPF_ALU+BPF_AND+BPF_X A <- A & X 590BPF_ALU+BPF_OR+BPF_X A <- A | X 591BPF_ALU+BPF_LSH+BPF_X A <- A << X 592BPF_ALU+BPF_RSH+BPF_X A <- A >> X 593BPF_ALU+BPF_NEG A <- -A 594.Ed 595.It Dv BPF_JMP 596The jump instructions alter flow of control. 597Conditional jumps 598compare the accumulator against a constant 599.Pq Dv BPF_K 600or the index register 601.Pq Dv BPF_X . 602If the result is true (or non-zero), 603the true branch is taken, otherwise the false branch is taken. 604Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 605However, the jump always 606.Pq Dv BPF_JA 607opcode uses the 32 bit 608.Li k 609field as the offset, allowing arbitrarily distant destinations. 610All conditionals use unsigned comparison conventions. 611.Pp 612.Bd -literal 613BPF_JMP+BPF_JA pc += k 614BPF_JMP+BPF_JGT+BPF_K pc += (A > k) ? jt : jf 615BPF_JMP+BPF_JGE+BPF_K pc += (A >= k) ? jt : jf 616BPF_JMP+BPF_JEQ+BPF_K pc += (A == k) ? jt : jf 617BPF_JMP+BPF_JSET+BPF_K pc += (A & k) ? jt : jf 618BPF_JMP+BPF_JGT+BPF_X pc += (A > X) ? jt : jf 619BPF_JMP+BPF_JGE+BPF_X pc += (A >= X) ? jt : jf 620BPF_JMP+BPF_JEQ+BPF_X pc += (A == X) ? jt : jf 621BPF_JMP+BPF_JSET+BPF_X pc += (A & X) ? jt : jf 622.Ed 623.It Dv BPF_RET 624The return instructions terminate the filter program and specify the amount 625of packet to accept (i.e., they return the truncation amount). 626A return value of zero indicates that the packet should be ignored. 627The return value is either a constant 628.Pq Dv BPF_K 629or the accumulator 630.Pq Dv BPF_A . 631.Pp 632.Bd -literal 633BPF_RET+BPF_A accept A bytes 634BPF_RET+BPF_K accept k bytes 635.Ed 636.It Dv BPF_MISC 637The miscellaneous category was created for anything that does not 638fit into the above classes, and for any new instructions that might need to 639be added. 640Currently, these are the register transfer instructions 641that copy the index register to the accumulator or vice versa. 642.Pp 643.Bd -literal 644BPF_MISC+BPF_TAX X <- A 645BPF_MISC+BPF_TXA A <- X 646.Ed 647.El 648.Pp 649The 650.Nm 651interface provides the following macros to facilitate 652array initializers: 653.Fn BPF_STMT opcode operand 654and 655.Fn BPF_JUMP opcode operand true_offset false_offset . 656.Sh FILES 657.Bl -tag -compact -width /dev/bpfXXX 658.It Pa /dev/bpf Ns Sy n 659the packet filter device 660.El 661.Sh EXAMPLES 662The following filter is taken from the Reverse ARP Daemon. 663It accepts only Reverse ARP requests. 664.Bd -literal 665struct bpf_insn insns[] = { 666 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 667 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 668 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 669 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 670 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 671 sizeof(struct ether_header)), 672 BPF_STMT(BPF_RET+BPF_K, 0), 673}; 674.Ed 675.Pp 676This filter accepts only IP packets between host 128.3.112.15 and 677128.3.112.35. 678.Bd -literal 679struct bpf_insn insns[] = { 680 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 681 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 682 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 26), 683 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 684 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 685 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 686 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 687 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 688 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 689 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 690 BPF_STMT(BPF_RET+BPF_K, 0), 691}; 692.Ed 693.Pp 694Finally, this filter returns only TCP finger packets. 695We must parse the IP header to reach the TCP header. 696The 697.Dv BPF_JSET 698instruction 699checks that the IP fragment offset is 0 so we are sure 700that we have a TCP header. 701.Bd -literal 702struct bpf_insn insns[] = { 703 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 704 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 705 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 706 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 707 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 708 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 709 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 710 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 711 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 712 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 713 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 714 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 715 BPF_STMT(BPF_RET+BPF_K, 0), 716}; 717.Ed 718.Sh SEE ALSO 719.Xr tcpdump 1 , 720.Xr ioctl 2 , 721.Xr byteorder 3 , 722.Xr ng_bpf 4 , 723.Xr bpf 9 724.Rs 725.%A McCanne, S. 726.%A Jacobson V. 727.%T "An efficient, extensible, and portable network monitor" 728.Re 729.Sh HISTORY 730The Enet packet filter was created in 1980 by Mike Accetta and 731Rick Rashid at Carnegie-Mellon University. 732Jeffrey Mogul, at 733Stanford, ported the code to 734.Bx 735and continued its development from 7361983 on. 737Since then, it has evolved into the Ultrix Packet Filter at 738.Tn DEC , 739a 740.Tn STREAMS 741.Tn NIT 742module under 743.Tn SunOS 4.1 , 744and 745.Tn BPF . 746.Sh AUTHORS 747.An -nosplit 748.An Steven McCanne , 749of Lawrence Berkeley Laboratory, implemented BPF in 750Summer 1990. 751Much of the design is due to 752.An Van Jacobson . 753.Sh BUGS 754The read buffer must be of a fixed size (returned by the 755.Dv BIOCGBLEN 756ioctl). 757.Pp 758A file that does not request promiscuous mode may receive promiscuously 759received packets as a side effect of another file requesting this 760mode on the same hardware interface. 761This could be fixed in the kernel with additional processing overhead. 762However, we favor the model where 763all files must assume that the interface is promiscuous, and if 764so desired, must utilize a filter to reject foreign packets. 765.Pp 766Data link protocols with variable length headers are not currently supported. 767.Pp 768The 769.Dv SEESENT , 770.Dv DIRECTION , 771and 772.Dv FEEDBACK 773settings have been observed to work incorrectly on some interface 774types, including those with hardware loopback rather than software loopback, 775and point-to-point interfaces. 776They appear to function correctly on a 777broad range of Ethernet-style interfaces. 778