1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $FreeBSD$ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd pseudo-device bpfilter 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOCSETIF 47ioctl. 48A given interface can be shared be multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50The total number of open 51files is limited to the value given in the kernel configuration; the 52example given in the 53.Sx SYNOPSIS 54above sets the limit to 16. 55.Pp 56A separate device file is required for each minor device. 57If a file is in use, the open will fail and 58.Va errno 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm bpf 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. 67Each descriptor that accepts the packet receives its own copy. 68.Pp 69Reads from these files return the next group of packets 70that have matched the filter. 71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm 74This size is returned by the 75.Dv BIOCGBLEN 76ioctl (see below), and 77can be set with 78.Dv BIOCSBLEN. 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length 83headers. Currently, only Ethernet, 84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm bpf . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm bpf 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP 100links are supported. 101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in <net/bpf.h>. All commands require 105these includes: 106.Bd -literal 107 #include <sys/types.h> 108 #include <sys/time.h> 109 #include <sys/ioctl.h> 110 #include <net/bpf.h> 111.Ed 112.Pp 113Additionally, 114.Dv BIOCGETIF 115and 116.Dv BIOCSETIF 117require 118.Aq Pa sys/socket.h 119and 120.Aq Pa net/if.h . 121 122In addition to 123.Dv FIONREAD 124and 125.Dv SIOCGIFADDR , 126the following commands may be applied to any open 127.Nm 128file. 129The (third) argument to 130.Xr ioctl 2 131should be a pointer to the type indicated. 132 133.Bl -tag -width BIOCGRTIMEOUT 134.It Dv BIOCGBLEN 135.Pq Li u_int 136Returns the required buffer length for reads on 137.Nm 138files. 139.It Dv BIOCSBLEN 140.Pq Li u_int 141Sets the buffer length for reads on 142.Nm 143files. The buffer must be set before the file is attached to an interface 144with 145.Dv BIOCSETIF . 146If the requested buffer size cannot be accommodated, the closest 147allowable size will be set and returned in the argument. 148A read call will result in 149.Er EIO 150if it is passed a buffer that is not this size. 151.It Dv BIOCGDLT 152.Pq Li u_int 153Returns the type of the data link layer underlying the attached interface. 154.Er EINVAL 155is returned if no interface has been specified. 156The device types, prefixed with 157.Dq Li DLT_ , 158are defined in 159.Aq Pa net/bpf.h . 160.It Dv BIOCPROMISC 161Forces the interface into promiscuous mode. 162All packets, not just those destined for the local host, are processed. 163Since more than one file can be listening on a given interface, 164a listener that opened its interface non-promiscuously may receive 165packets promiscuously. This problem can be remedied with an 166appropriate filter. 167.It Dv BIOCFLUSH 168Flushes the buffer of incoming packets, 169and resets the statistics that are returned by BIOCGSTATS. 170.It Dv BIOCGETIF 171.Pq Li "struct ifreq" 172Returns the name of the hardware interface that the file is listening on. 173The name is returned in the if_name field of 174the 175.Li ifreq 176structure. 177All other fields are undefined. 178.It Dv BIOCSETIF 179.Pq Li "struct ifreq" 180Sets the hardware interface associate with the file. This 181command must be performed before any packets can be read. 182The device is indicated by name using the 183.Li if_name 184field of the 185.Li ifreq 186structure. 187Additionally, performs the actions of 188.Dv BIOCFLUSH . 189.It Dv BIOCSRTIMEOUT 190.It Dv BIOCGRTIMEOUT 191.Pq Li "struct timeval" 192Set or get the read timeout parameter. 193The argument 194specifies the length of time to wait before timing 195out on a read request. 196This parameter is initialized to zero by 197.Xr open 2 , 198indicating no timeout. 199.It Dv BIOCGSTATS 200.Pq Li "struct bpf_stat" 201Returns the following structure of packet statistics: 202.Bd -literal 203struct bpf_stat { 204 u_int bs_recv; /* number of packets received */ 205 u_int bs_drop; /* number of packets dropped */ 206}; 207.Ed 208.Pp 209The fields are: 210.Bl -hang -offset indent 211.It Li bs_recv 212the number of packets received by the descriptor since opened or reset 213(including any buffered since the last read call); 214and 215.It Li bs_drop 216the number of packets which were accepted by the filter but dropped by the 217kernel because of buffer overflows 218(i.e., the application's reads aren't keeping up with the packet traffic). 219.El 220.It Dv BIOCIMMEDIATE 221.Pq Li u_int 222Enable or disable ``immediate mode'', based on the truth value of the argument. 223When immediate mode is enabled, reads return immediately upon packet 224reception. Otherwise, a read will block until either the kernel buffer 225becomes full or a timeout occurs. 226This is useful for programs like 227.Xr rarpd 8 228which must respond to messages in real time. 229The default for a new file is off. 230.It Dv BIOCSETF 231.Pq Li "struct bpf_program" 232Sets the filter program used by the kernel to discard uninteresting 233packets. An array of instructions and its length is passed in using 234the following structure: 235.Bd -literal 236struct bpf_program { 237 int bf_len; 238 struct bpf_insn *bf_insns; 239}; 240.Ed 241 242The filter program is pointed to by the 243.Li bf_insns 244field while its length in units of 245.Sq Li struct bpf_insn 246is given by the 247.Li bf_len 248field. 249Also, the actions of 250.Dv BIOCFLUSH are performed. 251See section 252.Sx "FILTER MACHINE" 253for an explanation of the filter language. 254.It Dv BIOCVERSION 255.Pq Li "struct bpf_version" 256Returns the major and minor version numbers of the filter language currently 257recognized by the kernel. Before installing a filter, applications must check 258that the current version is compatible with the running kernel. Version 259numbers are compatible if the major numbers match and the application minor 260is less than or equal to the kernel minor. The kernel version number is 261returned in the following structure: 262.Bd -literal 263struct bpf_version { 264 u_short bv_major; 265 u_short bv_minor; 266}; 267.Ed 268.Pp 269The current version numbers are given by 270.Dv BPF_MAJOR_VERSION 271and 272.Dv BPF_MINOR_VERSION 273from 274.Aq Pa net/bpf.h . 275An incompatible filter 276may result in undefined behavior (most likely, an error returned by 277.Fn ioctl 278or haphazard packet matching). 279.Sh BPF HEADER 280The following structure is prepended to each packet returned by 281.Xr read 2 : 282.Bd -literal 283struct bpf_hdr { 284 struct timeval bh_tstamp; /* time stamp */ 285 u_long bh_caplen; /* length of captured portion */ 286 u_long bh_datalen; /* original length of packet */ 287 u_short bh_hdrlen; /* length of bpf header (this struct 288 plus alignment padding */ 289}; 290.Ed 291.Pp 292The fields, whose values are stored in host order, and are: 293.Pp 294.Bl -tag -compact -width bh_datalen 295.It Li bh_tstamp 296The time at which the packet was processed by the packet filter. 297.It Li bh_caplen 298The length of the captured portion of the packet. This is the minimum of 299the truncation amount specified by the filter and the length of the packet. 300.It Li bh_datalen 301The length of the packet off the wire. 302This value is independent of the truncation amount specified by the filter. 303.It Li bh_hdrlen 304The length of the 305.Nm 306header, which may not be equal to 307.\" XXX - not really a function call 308.Fn sizeof "struct bpf_hdr" . 309.El 310.Pp 311The 312.Li bh_hdrlen 313field exists to account for 314padding between the header and the link level protocol. 315The purpose here is to guarantee proper alignment of the packet 316data structures, which is required on alignment sensitive 317architectures and improves performance on many other architectures. 318The packet filter insures that the 319.Li bpf_hdr 320and the network layer 321header will be word aligned. Suitable precautions 322must be taken when accessing the link layer protocol fields on alignment 323restricted machines. (This isn't a problem on an Ethernet, since 324the type field is a short falling on an even offset, 325and the addresses are probably accessed in a bytewise fashion). 326.Pp 327Additionally, individual packets are padded so that each starts 328on a word boundary. This requires that an application 329has some knowledge of how to get from packet to packet. 330The macro 331.Dv BPF_WORDALIGN 332is defined in 333.Aq Pa net/bpf.h 334to facilitate 335this process. It rounds up its argument 336to the nearest word aligned value (where a word is 337.Dv BPF_ALIGNMENT 338bytes wide). 339.Pp 340For example, if 341.Sq Li p 342points to the start of a packet, this expression 343will advance it to the next packet: 344.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 345.Pp 346For the alignment mechanisms to work properly, the 347buffer passed to 348.Xr read 2 349must itself be word aligned. 350The 351.Xr malloc 3 352function 353will always return an aligned buffer. 354.Sh FILTER MACHINE 355A filter program is an array of instructions, with all branches forwardly 356directed, terminated by a 357.Em return 358instruction. 359Each instruction performs some action on the pseudo-machine state, 360which consists of an accumulator, index register, scratch memory store, 361and implicit program counter. 362 363The following structure defines the instruction format: 364.Bd -literal 365struct bpf_insn { 366 u_short code; 367 u_char jt; 368 u_char jf; 369 u_long k; 370}; 371.Ed 372 373The 374.Li k 375field is used in different ways by different instructions, 376and the 377.Li jt 378and 379.Li jf 380fields are used as offsets 381by the branch instructions. 382The opcodes are encoded in a semi-hierarchical fashion. 383There are eight classes of instructions: 384.Dv BPF_LD , 385.Dv BPF_LDX , 386.Dv BPF_ST , 387.Dv BPF_STX , 388.Dv BPF_ALU , 389.Dv BPF_JMP , 390.Dv BPF_RET , 391and 392.Dv BPF_MISC . 393Various other mode and 394operator bits are or'd into the class to give the actual instructions. 395The classes and modes are defined in 396.Aq Pa net/bpf.h . 397 398Below are the semantics for each defined 399.Nm 400instruction. 401We use the convention that A is the accumulator, X is the index register, 402P[] packet data, and M[] scratch memory store. 403P[i:n] gives the data at byte offset ``i'' in the packet, 404interpreted as a word (n=4), 405unsigned halfword (n=2), or unsigned byte (n=1). 406M[i] gives the i'th word in the scratch memory store, which is only 407addressed in word units. The memory store is indexed from 0 to 408.Dv BPF_MEMWORDS 409- 1. 410.Li k , 411.Li jt , 412and 413.Li jf 414are the corresponding fields in the 415instruction definition. ``len'' refers to the length of the packet. 416.Pp 417.Bl -tag -width BPF_STXx -compact 418.It Dv BPF_LD 419These instructions copy a value into the accumulator. The type of the 420source operand is specified by an ``addressing mode'' and can be 421a constant 422.Pq Dv BPF_IMM , 423packet data at a fixed offset 424.Pq Dv BPF_ABS , 425packet data at a variable offset 426.Pq Dv BPF_IND , 427the packet length 428.Pq Dv BPF_LEN , 429or a word in the scratch memory store 430.Pq Dv BPF_MEM . 431For 432.Dv BPF_IND 433and 434.Dv BPF_ABS, 435the data size must be specified as a word 436.Pq Dv BPF_W , 437halfword 438.Pq Dv BPF_H , 439or byte 440.Pq Dv BPF_B . 441The semantics of all the recognized 442.Dv BPF_LD 443instructions follow. 444.Pp 445.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 446.It Li BPF_LD+BPF_W+BPF_ABS 447A <- P[k:4] 448.It Li BPF_LD+BPF_H+BPF_ABS 449A <- P[k:2] 450.It Li BPF_LD+BPF_B+BPF_ABS 451A <- P[k:1] 452.It Li BPF_LD+BPF_W+BPF_IND 453A <- P[X+k:4] 454.It Li BPF_LD+BPF_H+BPF_IND 455A <- P[X+k:2] 456.It Li BPF_LD+BPF_B+BPF_IND 457A <- P[X+k:1] 458.It Li BPF_LD+BPF_W+BPF_LEN 459A <- len 460.It Li BPF_LD+BPF_IMM 461A <- k 462.It Li BPF_LD+BPF_MEM 463A <- M[k] 464.El 465 466.It Dv BPF_LDX 467These instructions load a value into the index register. Note that 468the addressing modes are more restrictive than those of the accumulator loads, 469but they include 470.Dv BPF_MSH , 471a hack for efficiently loading the IP header length. 472 473.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 474.It Li BPF_LDX+BPF_W+BPF_IMM 475X <- k 476.It Li BPF_LDX+BPF_W+BPF_MEM 477X <- M[k] 478.It Li BPF_LDX+BPF_W+BPF_LEN 479X <- len 480.It Li BPF_LDX+BPF_B+BPF_MSH 481X <- 4*(P[k:1]&0xf) 482.El 483 484.It Dv BPF_ST 485This instruction stores the accumulator into the scratch memory. 486We do not need an addressing mode since there is only one possibility 487for the destination. 488 489.Bl -tag -width "BPF_ST" -compact 490.It Li BPF_ST 491M[k] <- A 492.El 493 494.It Dv BPF_STX 495This instruction stores the index register in the scratch memory store. 496 497.Bl -tag -width "BPF_STX" -compact 498.It Li BPF_STX 499M[k] <- X 500.El 501 502.It Dv BPF_ALU 503The alu instructions perform operations between the accumulator and 504index register or constant, and store the result back in the accumulator. 505For binary operations, a source mode is required 506.Po 507.Dv BPF_K 508or 509.Dv BPF_X 510.Pc . 511 512.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 513.It Li BPF_ALU+BPF_ADD+BPF_K 514A <- A + k 515.It Li BPF_ALU+BPF_SUB+BPF_K 516A <- A - k 517.It Li BPF_ALU+BPF_MUL+BPF_K 518A <- A * k 519.It Li BPF_ALU+BPF_DIV+BPF_K 520A <- A / k 521.It Li BPF_ALU+BPF_AND+BPF_K 522A <- A & k 523.It Li BPF_ALU+BPF_OR+BPF_K 524A <- A | k 525.It Li BPF_ALU+BPF_LSH+BPF_K 526A <- A << k 527.It Li BPF_ALU+BPF_RSH+BPF_K 528A <- A >> k 529.It Li BPF_ALU+BPF_ADD+BPF_X 530A <- A + X 531.It Li BPF_ALU+BPF_SUB+BPF_X 532A <- A - X 533.It Li BPF_ALU+BPF_MUL+BPF_X 534A <- A * X 535.It Li BPF_ALU+BPF_DIV+BPF_X 536A <- A / X 537.It Li BPF_ALU+BPF_AND+BPF_X 538A <- A & X 539.It Li BPF_ALU+BPF_OR+BPF_X 540A <- A | X 541.It Li BPF_ALU+BPF_LSH+BPF_X 542A <- A << X 543.It Li BPF_ALU+BPF_RSH+BPF_X 544A <- A >> X 545.It Li BPF_ALU+BPF_NEG 546A <- -A 547.El 548 549.It Dv BPF_JMP 550The jump instructions alter flow of control. Conditional jumps 551compare the accumulator against a constant 552.Pq Dv BPF_K 553or the index register 554.Pq Dv BPF_X . 555If the result is true (or non-zero), 556the true branch is taken, otherwise the false branch is taken. 557Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 558However, the jump always 559.Pq Dv BPF_JA 560opcode uses the 32 bit 561.Li k 562field as the offset, allowing arbitrarily distant destinations. 563All conditionals use unsigned comparison conventions. 564 565.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 566.It Li BPF_JMP+BPF_JA 567pc += k 568.It Li BPF_JMP+BPF_JGT+BPF_K 569pc += (A > k) ? jt : jf 570.It Li BPF_JMP+BPF_JGE+BPF_K 571pc += (A >= k) ? jt : jf 572.It Li BPF_JMP+BPF_JEQ+BPF_K 573pc += (A == k) ? jt : jf 574.It Li BPF_JMP+BPF_JSET+BPF_K 575pc += (A & k) ? jt : jf 576.It Li BPF_JMP+BPF_JGT+BPF_X 577pc += (A > X) ? jt : jf 578.It Li BPF_JMP+BPF_JGE+BPF_X 579pc += (A >= X) ? jt : jf 580.It Li BPF_JMP+BPF_JEQ+BPF_X 581pc += (A == X) ? jt : jf 582.It Li BPF_JMP+BPF_JSET+BPF_X 583pc += (A & X) ? jt : jf 584.El 585 586.It Dv BPF_RET 587The return instructions terminate the filter program and specify the amount 588of packet to accept (i.e., they return the truncation amount). A return 589value of zero indicates that the packet should be ignored. 590The return value is either a constant 591.Pq Dv BPF_K 592or the accumulator 593.Pq Dv BPF_A . 594 595.Bl -tag -width "BPF_RET+BPF_K" -compact 596.It Li BPF_RET+BPF_A 597accept A bytes 598.It Li BPF_RET+BPF_K 599accept k bytes 600.El 601 602.It Dv BPF_MISC 603The miscellaneous category was created for anything that doesn't 604fit into the above classes, and for any new instructions that might need to 605be added. Currently, these are the register transfer instructions 606that copy the index register to the accumulator or vice versa. 607 608.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 609.It Li BPF_MISC+BPF_TAX 610X <- A 611.It Li BPF_MISC+BPF_TXA 612A <- X 613.El 614.Pp 615The 616.Nm 617interface provides the following macros to facilitate 618array initializers: 619.Fn BPF_STMT opcode operand 620and 621.Fn BPF_JUMP opcode operand true_offset false_offset . 622.Pp 623.Sh EXAMPLES 624The following filter is taken from the Reverse ARP Daemon. It accepts 625only Reverse ARP requests. 626.Bd -literal 627struct bpf_insn insns[] = { 628 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 629 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 630 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 631 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 632 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 633 sizeof(struct ether_header)), 634 BPF_STMT(BPF_RET+BPF_K, 0), 635}; 636.Ed 637.Pp 638This filter accepts only IP packets between host 128.3.112.15 and 639128.3.112.35. 640.Bd -literal 641struct bpf_insn insns[] = { 642 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 643 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 644 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 26), 645 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 646 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 647 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 648 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 649 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 650 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 651 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 652 BPF_STMT(BPF_RET+BPF_K, 0), 653}; 654.Ed 655.Pp 656Finally, this filter returns only TCP finger packets. We must parse 657the IP header to reach the TCP header. The 658.Dv BPF_JSET 659instruction 660checks that the IP fragment offset is 0 so we are sure 661that we have a TCP header. 662.Bd -literal 663struct bpf_insn insns[] = { 664 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 665 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 666 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 667 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 668 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 669 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 670 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 671 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 672 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 673 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 674 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 675 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 676 BPF_STMT(BPF_RET+BPF_K, 0), 677}; 678.Ed 679.Sh SEE ALSO 680.Xr tcpdump 1 , 681.Xr ioctl 2 682.Rs 683.%A McCanne, S. 684.%A Jacobson V. 685.%T "An efficient, extensible, and portable network monitor" 686.Re 687.Sh FILES 688.Bl -tag -compact -width /dev/bpfXXX 689.It Pa /dev/bpf Ns Sy n 690the packet filter device 691.El 692.Sh BUGS 693The read buffer must be of a fixed size (returned by the 694.Dv BIOCGBLEN 695ioctl). 696.Pp 697A file that does not request promiscuous mode may receive promiscuously 698received packets as a side effect of another file requesting this 699mode on the same hardware interface. This could be fixed in the kernel 700with additional processing overhead. However, we favor the model where 701all files must assume that the interface is promiscuous, and if 702so desired, must utilize a filter to reject foreign packets. 703.Pp 704Data link protocols with variable length headers are not currently supported. 705.Sh HISTORY 706.Pp 707The Enet packet filter was created in 1980 by Mike Accetta and 708Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 709Stanford, ported the code to BSD and continued its development from 7101983 on. Since then, it has evolved into the Ultrix Packet Filter 711at 712.Tn DEC , 713a 714.Tn STREAMS 715.Tn NIT 716module under 717.Tn SunOS 4.1 , 718and 719.Tn BPF . 720.Sh AUTHORS 721.Pp 722Steven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in 723Summer 1990. Much of the design is due to Van Jacobson. 724