xref: /freebsd/share/man/man4/bpf.4 (revision 61afd5bb22d787b0641523e7b9b95c964d669bd5)
1.\" Copyright (c) 1990 The Regents of the University of California.
2.\" All rights reserved.
3.\"
4.\" Redistribution and use in source and binary forms, with or without
5.\" modification, are permitted provided that: (1) source code distributions
6.\" retain the above copyright notice and this paragraph in its entirety, (2)
7.\" distributions including binary code include the above copyright notice and
8.\" this paragraph in its entirety in the documentation or other materials
9.\" provided with the distribution, and (3) all advertising materials mentioning
10.\" features or use of this software display the following acknowledgement:
11.\" ``This product includes software developed by the University of California,
12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
13.\" the University nor the names of its contributors may be used to endorse
14.\" or promote products derived from this software without specific prior
15.\" written permission.
16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19.\"
20.\" This document is derived in part from the enet man page (enet.4)
21.\" distributed with 4.3BSD Unix.
22.\"
23.\"	$Id: bpf.4,v 1.5 1996/10/05 18:37:21 wosch Exp $
24.\"
25.Dd January 16, 1996
26.Dt BPF 4
27.Os BSD 4.4
28.Sh NAME
29.Nm bpf
30.Nd Berkeley Packet Filter
31.Sh SYNOPSIS
32.Cd pseudo-device bpfilter
33.Sh DESCRIPTION
34The Berkeley Packet Filter
35provides a raw interface to data link layers in a protocol
36independent fashion.
37All packets on the network, even those destined for other hosts,
38are accessible through this mechanism.
39.Pp
40The packet filter appears as a character special device,
41.Pa /dev/bpf0 ,
42.Pa /dev/bpf1 ,
43etc.
44After opening the device, the file descriptor must be bound to a
45specific network interface with the
46.Dv BIOSETIF
47ioctl.
48A given interface can be shared be multiple listeners, and the filter
49underlying each descriptor will see an identical packet stream.
50The total number of open
51files is limited to the value given in the kernel configuration; the
52example given in the
53.Sx SYNOPSIS
54above sets the limit to 16.
55.Pp
56A separate device file is required for each minor device.
57If a file is in use, the open will fail and
58.Va errno
59will be set to
60.Er EBUSY .
61.Pp
62Associated with each open instance of a
63.Nm bpf
64file is a user-settable packet filter.
65Whenever a packet is received by an interface,
66all file descriptors listening on that interface apply their filter.
67Each descriptor that accepts the packet receives its own copy.
68.Pp
69Reads from these files return the next group of packets
70that have matched the filter.
71To improve performance, the buffer passed to read must be
72the same size as the buffers used internally by
73.Nm
74This size is returned by the
75.Dv BIOCGBLEN
76ioctl (see below), and
77can be set with
78.Dv BIOCSBLEN.
79Note that an individual packet larger than this size is necessarily
80truncated.
81.Pp
82The packet filter will support any link level protocol that has fixed length
83headers.  Currently, only Ethernet,
84.Tn SLIP ,
85and
86.Tn PPP
87drivers have been modified to interact with
88.Nm bpf .
89.Pp
90Since packet data is in network byte order, applications should use the
91.Xr byteorder 3
92macros to extract multi-byte values.
93.Pp
94A packet can be sent out on the network by writing to a
95.Nm bpf
96file descriptor.  The writes are unbuffered, meaning only one
97packet can be processed per write.
98Currently, only writes to Ethernets and
99.Tn SLIP
100links are supported.
101.Sh IOCTLS
102The
103.Xr ioctl 2
104command codes below are defined in <net/bpf.h>.  All commands require
105these includes:
106.Bd -literal
107	#include <sys/types.h>
108	#include <sys/time.h>
109	#include <sys/ioctl.h>
110	#include <net/bpf.h>
111.Ed
112.Pp
113Additionally,
114.Dv BIOCGETIF
115and
116.Dv BIOCSETIF
117require
118.Aq Pa sys/socket.h
119and
120.Aq Pa net/if.h .
121
122In addition to
123.Dv FIONREAD
124and
125.Dv SIOCGIFADDR ,
126the following commands may be applied to any open
127.Nm
128file.
129The (third) argument to
130.Xr ioctl 2
131should be a pointer to the type indicated.
132
133.Bl -tag -width BIOCGRTIMEOUT
134.It Dv BIOCGBLEN
135.Pq Li u_int
136Returns the required buffer length for reads on
137.Nm
138files.
139.It Dv BIOCSBLEN
140.Pq Li u_int
141Sets the buffer length for reads on
142.Nm
143files.  The buffer must be set before the file is attached to an interface
144with
145.Dv BIOCSETIF .
146If the requested buffer size cannot be accommodated, the closest
147allowable size will be set and returned in the argument.
148A read call will result in
149.Er EIO
150if it is passed a buffer that is not this size.
151.It Dv BIOCGDLT
152.Pq Li u_int
153Returns the type of the data link layer underlying the attached interface.
154.Er EINVAL
155is returned if no interface has been specified.
156The device types, prefixed with
157.Dq Li DLT_ ,
158are defined in
159.Aq Pa net/bpf.h .
160.It Dv BIOCPROMISC
161Forces the interface into promiscuous mode.
162All packets, not just those destined for the local host, are processed.
163Since more than one file can be listening on a given interface,
164a listener that opened its interface non-promiscuously may receive
165packets promiscuously.  This problem can be remedied with an
166appropriate filter.
167.It Dv BIOCFLUSH
168Flushes the buffer of incoming packets,
169and resets the statistics that are returned by BIOCGSTATS.
170.It Dv BIOCGETIF
171.Pq Li "struct ifreq"
172Returns the name of the hardware interface that the file is listening on.
173The name is returned in the if_name field of
174the
175.Li ifreq
176structure.
177All other fields are undefined.
178.It Dv BIOCSETIF
179.Pq Li "struct ifreq"
180Sets the hardware interface associate with the file.  This
181command must be performed before any packets can be read.
182The device is indicated by name using the
183.Li if_name
184field of the
185.Li ifreq
186structure.
187Additionally, performs the actions of
188.Dv BIOCFLUSH .
189.It Dv BIOCSRTIMEOUT
190.It Dv BIOCGRTIMEOUT
191.Pq Li "struct timeval"
192Set or get the read timeout parameter.
193The argument
194specifies the length of time to wait before timing
195out on a read request.
196This parameter is initialized to zero by
197.Xr open 2 ,
198indicating no timeout.
199.It Dv BIOCGSTATS
200.Pq Li "struct bpf_stat"
201Returns the following structure of packet statistics:
202.Bd -literal
203struct bpf_stat {
204	u_int bs_recv;
205	u_int bs_drop;
206};
207.Ed
208
209The fields are:
210.Bl -hang -offset indent
211.It Li bs_recv
212the number of packets received by the descriptor since opened or reset
213(including any buffered since the last read call);
214and
215.It Li bs_drop
216the number of packets which were accepted by the filter but dropped by the
217kernel because of buffer overflows
218(i.e., the application's reads aren't keeping up with the packet traffic).
219.El
220.It Dv BIOCIMMEDIATE
221.Pq Li u_int
222Enable or disable ``immediate mode'', based on the truth value of the argument.
223When immediate mode is enabled, reads return immediately upon packet
224reception.  Otherwise, a read will block until either the kernel buffer
225becomes full or a timeout occurs.
226This is useful for programs like
227.Xr rarpd 8
228which must respond to messages in real time.
229The default for a new file is off.
230.It Dv BIOCSETF
231.Pq Li "struct bpf_program"
232Sets the filter program used by the kernel to discard uninteresting
233packets.  An array of instructions and its length is passed in using
234the following structure:
235.Bd -literal
236struct bpf_program {
237	int bf_len;
238	struct bpf_insn *bf_insns;
239};
240.Ed
241
242The filter program is pointed to by the
243.Li bf_insns
244field while its length in units of
245.Sq Li struct bpf_insn
246is given by the
247.Li bf_len
248field.
249Also, the actions of
250.Dv BIOCFLUSH are performed.
251See section
252.Sx "FILTER MACHINE"
253for an explanation of the filter language.
254.It Dv BIOCVERSION
255.Pq Li "struct bpf_version"
256Returns the major and minor version numbers of the filter language currently
257recognized by the kernel.  Before installing a filter, applications must check
258that the current version is compatible with the running kernel.  Version
259numbers are compatible if the major numbers match and the application minor
260is less than or equal to the kernel minor.  The kernel version number is
261returned in the following structure:
262.Bd -literal
263struct bpf_version {
264        u_short bv_major;
265        u_short bv_minor;
266};
267.Ed
268
269The current version numbers are given by
270.Dv BPF_MAJOR_VERSION
271and
272.Dv BPF_MINOR_VERSION
273from
274.Aq Pa net/bpf.h .
275An incompatible filter
276may result in undefined behavior (most likely, an error returned by
277.Fn ioctl
278or haphazard packet matching).
279.Sh BPF HEADER
280The following structure is prepended to each packet returned by
281.Xr read 2 :
282.Bd -literal
283struct bpf_hdr {
284        struct timeval bh_tstamp;
285        u_long bh_caplen;
286        u_long bh_datalen;
287        u_short bh_hdrlen;
288};
289.Ed
290.Pp
291The fields, whose values are stored in host order, and are:
292.Pp
293.Bl -tag -compact -width bh_datalen
294.It Li bh_tstamp
295The time at which the packet was processed by the packet filter.
296.It Li bh_caplen
297The length of the captured portion of the packet.  This is the minimum of
298the truncation amount specified by the filter and the length of the packet.
299.It Li bh_datalen
300The length of the packet off the wire.
301This value is independent of the truncation amount specified by the filter.
302.It Li bh_hdrlen
303The length of the
304.Nm
305header, which may not be equal to
306.\" XXX - not really a function call
307.Fn sizeof "struct bpf_hdr" .
308.El
309.Pp
310The
311.Li bh_hdrlen
312field exists to account for
313padding between the header and the link level protocol.
314The purpose here is to guarantee proper alignment of the packet
315data structures, which is required on alignment sensitive
316architectures and improves performance on many other architectures.
317The packet filter insures that the
318.Li bpf_hdr
319and the network layer
320header will be word aligned.  Suitable precautions
321must be taken when accessing the link layer protocol fields on alignment
322restricted machines.  (This isn't a problem on an Ethernet, since
323the type field is a short falling on an even offset,
324and the addresses are probably accessed in a bytewise fashion).
325.Pp
326Additionally, individual packets are padded so that each starts
327on a word boundary.  This requires that an application
328has some knowledge of how to get from packet to packet.
329The macro
330.Dv BPF_WORDALIGN
331is defined in
332.Aq Pa net/bpf.h
333to facilitate
334this process.  It rounds up its argument
335to the nearest word aligned value (where a word is
336.Dv BPF_ALIGNMENT
337bytes wide).
338.Pp
339For example, if
340.Sq Li p
341points to the start of a packet, this expression
342will advance it to the next packet:
343.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen)
344.Pp
345For the alignment mechanisms to work properly, the
346buffer passed to
347.Xr read 2
348must itself be word aligned.
349The
350.Xr malloc 3
351function
352will always return an aligned buffer.
353.Sh FILTER MACHINE
354A filter program is an array of instructions, with all branches forwardly
355directed, terminated by a
356.Em return
357instruction.
358Each instruction performs some action on the pseudo-machine state,
359which consists of an accumulator, index register, scratch memory store,
360and implicit program counter.
361
362The following structure defines the instruction format:
363.Bd -literal
364struct bpf_insn {
365	u_short	code;
366	u_char 	jt;
367	u_char 	jf;
368	long k;
369};
370.Ed
371
372The
373.Li k
374field is used in different ways by different instructions,
375and the
376.Li jt
377and
378.Li jf
379fields are used as offsets
380by the branch instructions.
381The opcodes are encoded in a semi-hierarchical fashion.
382There are eight classes of instructions:
383.Dv BPF_LD ,
384.Dv BPF_LDX ,
385.Dv BPF_ST ,
386.Dv BPF_STX ,
387.Dv BPF_ALU ,
388.Dv BPF_JMP ,
389.Dv BPF_RET ,
390and
391.Dv BPF_MISC .
392Various other mode and
393operator bits are or'd into the class to give the actual instructions.
394The classes and modes are defined in
395.Aq Pa net/bpf.h .
396
397Below are the semantics for each defined
398.Nm
399instruction.
400We use the convention that A is the accumulator, X is the index register,
401P[] packet data, and M[] scratch memory store.
402P[i:n] gives the data at byte offset ``i'' in the packet,
403interpreted as a word (n=4),
404unsigned halfword (n=2), or unsigned byte (n=1).
405M[i] gives the i'th word in the scratch memory store, which is only
406addressed in word units.  The memory store is indexed from 0 to
407.Dv BPF_MEMWORDS
408- 1.
409.Li k ,
410.Li jt ,
411and
412.Li jf
413are the corresponding fields in the
414instruction definition.  ``len'' refers to the length of the packet.
415.Pp
416.Bl -tag -width BPF_STXx -compact
417.It Dv BPF_LD
418These instructions copy a value into the accumulator.  The type of the
419source operand is specified by an ``addressing mode'' and can be
420a constant
421.Pq Dv BPF_IMM ,
422packet data at a fixed offset
423.Pq Dv BPF_ABS ,
424packet data at a variable offset
425.Pq Dv BPF_IND ,
426the packet length
427.Pq Dv BPF_LEN ,
428or a word in the scratch memory store
429.Pq Dv BPF_MEM .
430For
431.Dv BPF_IND
432and
433.Dv BPF_ABS,
434the data size must be specified as a word
435.Pq Dv BPF_W ,
436halfword
437.Pq Dv BPF_H ,
438or byte
439.Pq Dv BPF_B .
440The semantics of all the recognized
441.Dv BPF_LD
442instructions follow.
443.Pp
444.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact
445.It Li BPF_LD+BPF_W+BPF_ABS
446A <- P[k:4]
447.It Li BPF_LD+BPF_H+BPF_ABS
448A <- P[k:2]
449.It Li BPF_LD+BPF_B+BPF_ABS
450A <- P[k:1]
451.It Li BPF_LD+BPF_W+BPF_IND
452A <- P[X+k:4]
453.It Li BPF_LD+BPF_H+BPF_IND
454A <- P[X+k:2]
455.It Li BPF_LD+BPF_B+BPF_IND
456A <- P[X+k:1]
457.It Li BPF_LD+BPF_W+BPF_LEN
458A <- len
459.It Li BPF_LD+BPF_IMM
460A <- k
461.It Li BPF_LD+BPF_MEM
462A <- M[k]
463.El
464
465.It Dv BPF_LDX
466These instructions load a value into the index register.  Note that
467the addressing modes are more restrictive than those of the accumulator loads,
468but they include
469.Dv BPF_MSH ,
470a hack for efficiently loading the IP header length.
471
472.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact
473.It Li BPF_LDX+BPF_W+BPF_IMM
474X <- k
475.It Li BPF_LDX+BPF_W+BPF_MEM
476X <- M[k]
477.It Li BPF_LDX+BPF_W+BPF_LEN
478X <- len
479.It Li BPF_LDX+BPF_B+BPF_MSH
480X <- 4*(P[k:1]&0xf)
481.El
482
483.It Dv BPF_ST
484This instruction stores the accumulator into the scratch memory.
485We do not need an addressing mode since there is only one possibility
486for the destination.
487
488.Bl -tag -width "BPF_ST" -compact
489.It Li BPF_ST
490M[k] <- A
491.El
492
493.It Dv BPF_STX
494This instruction stores the index register in the scratch memory store.
495
496.Bl -tag -width "BPF_STX" -compact
497.It Li BPF_STX
498M[k] <- X
499.El
500
501.It Dv BPF_ALU
502The alu instructions perform operations between the accumulator and
503index register or constant, and store the result back in the accumulator.
504For binary operations, a source mode is required
505.Po
506.Dv BPF_K
507or
508.Dv BPF_X
509.Pc .
510
511.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact
512.It Li BPF_ALU+BPF_ADD+BPF_K
513A <- A + k
514.It Li BPF_ALU+BPF_SUB+BPF_K
515A <- A - k
516.It Li BPF_ALU+BPF_MUL+BPF_K
517A <- A * k
518.It Li BPF_ALU+BPF_DIV+BPF_K
519A <- A / k
520.It Li BPF_ALU+BPF_AND+BPF_K
521A <- A & k
522.It Li BPF_ALU+BPF_OR+BPF_K
523A <- A | k
524.It Li BPF_ALU+BPF_LSH+BPF_K
525A <- A << k
526.It Li BPF_ALU+BPF_RSH+BPF_K
527A <- A >> k
528.It Li BPF_ALU+BPF_ADD+BPF_X
529A <- A + X
530.It Li BPF_ALU+BPF_SUB+BPF_X
531A <- A - X
532.It Li BPF_ALU+BPF_MUL+BPF_X
533A <- A * X
534.It Li BPF_ALU+BPF_DIV+BPF_X
535A <- A / X
536.It Li BPF_ALU+BPF_AND+BPF_X
537A <- A & X
538.It Li BPF_ALU+BPF_OR+BPF_X
539A <- A | X
540.It Li BPF_ALU+BPF_LSH+BPF_X
541A <- A << X
542.It Li BPF_ALU+BPF_RSH+BPF_X
543A <- A >> X
544.It Li BPF_ALU+BPF_NEG
545A <- -A
546.El
547
548.It Dv BPF_JMP
549The jump instructions alter flow of control.  Conditional jumps
550compare the accumulator against a constant
551.Pq Dv BPF_K
552or the index register
553.Pq Dv BPF_X .
554If the result is true (or non-zero),
555the true branch is taken, otherwise the false branch is taken.
556Jump offsets are encoded in 8 bits so the longest jump is 256 instructions.
557However, the jump always
558.Pq Dv BPF_JA
559opcode uses the 32 bit
560.Li k
561field as the offset, allowing arbitrarily distant destinations.
562All conditionals use unsigned comparison conventions.
563
564.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact
565.It Li BPF_JMP+BPF_JA
566pc += k
567.It Li BPF_JMP+BPF_JGT+BPF_K
568pc += (A > k) ? jt : jf
569.It Li BPF_JMP+BPF_JGE+BPF_K
570pc += (A >= k) ? jt : jf
571.It Li BPF_JMP+BPF_JEQ+BPF_K
572pc += (A == k) ? jt : jf
573.It Li BPF_JMP+BPF_JSET+BPF_K
574pc += (A & k) ? jt : jf
575.It Li BPF_JMP+BPF_JGT+BPF_X
576pc += (A > X) ? jt : jf
577.It Li BPF_JMP+BPF_JGE+BPF_X
578pc += (A >= X) ? jt : jf
579.It Li BPF_JMP+BPF_JEQ+BPF_X
580pc += (A == X) ? jt : jf
581.It Li BPF_JMP+BPF_JSET+BPF_X
582pc += (A & X) ? jt : jf
583.El
584
585.It Dv BPF_RET
586The return instructions terminate the filter program and specify the amount
587of packet to accept (i.e., they return the truncation amount).  A return
588value of zero indicates that the packet should be ignored.
589The return value is either a constant
590.Pq Dv BPF_K
591or the accumulator
592.Pq Dv BPF_A .
593
594.Bl -tag -width "BPF_RET+BPF_K" -compact
595.It Li BPF_RET+BPF_A
596accept A bytes
597.It Li BPF_RET+BPF_K
598accept k bytes
599.El
600
601.It Dv BPF_MISC
602The miscellaneous category was created for anything that doesn't
603fit into the above classes, and for any new instructions that might need to
604be added.  Currently, these are the register transfer instructions
605that copy the index register to the accumulator or vice versa.
606
607.Bl -tag -width "BPF_MISC+BPF_TAX" -compact
608.It Li BPF_MISC+BPF_TAX
609X <- A
610.It Li BPF_MISC+BPF_TXA
611A <- X
612.El
613.Pp
614The
615.Nm
616interface provides the following macros to facilitate
617array initializers:
618.Fn BPF_STMT opcode operand
619and
620.Fn BPF_JUMP opcode operand true_offset false_offset .
621.Pp
622.Sh EXAMPLES
623The following filter is taken from the Reverse ARP Daemon.  It accepts
624only Reverse ARP requests.
625.Bd -literal
626struct bpf_insn insns[] = {
627	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12),
628	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3),
629	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20),
630	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1),
631	BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) +
632		 sizeof(struct ether_header)),
633	BPF_STMT(BPF_RET+BPF_K, 0),
634};
635.Ed
636.Pp
637This filter accepts only IP packets between host 128.3.112.15 and
638128.3.112.35.
639.Bd -literal
640struct bpf_insn insns[] = {
641	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12),
642	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8),
643	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 26),
644	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2),
645	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30),
646	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4),
647	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3),
648	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30),
649	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1),
650	BPF_STMT(BPF_RET+BPF_K, (u_int)-1),
651	BPF_STMT(BPF_RET+BPF_K, 0),
652};
653.Ed
654.Pp
655Finally, this filter returns only TCP finger packets.  We must parse
656the IP header to reach the TCP header.  The
657.Dv BPF_JSET
658instruction
659checks that the IP fragment offset is 0 so we are sure
660that we have a TCP header.
661.Bd -literal
662struct bpf_insn insns[] = {
663	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12),
664	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10),
665	BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23),
666	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8),
667	BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20),
668	BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0),
669	BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14),
670	BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14),
671	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0),
672	BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16),
673	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1),
674	BPF_STMT(BPF_RET+BPF_K, (u_int)-1),
675	BPF_STMT(BPF_RET+BPF_K, 0),
676};
677.Ed
678.Sh SEE ALSO
679.Xr tcpdump 1 ,
680.Xr ioctl 2
681.Rs
682.%A McCanne, S.
683.%A Jacobson V.
684.%T "An efficient, extensible, and portable network monitor"
685.Re
686.Sh FILES
687.Bl -tag -compact -width /dev/bpfXXX
688.It Pa /dev/bpf Ns Sy n
689the packet filter device
690.El
691.Sh BUGS
692The read buffer must be of a fixed size (returned by the
693.Dv BIOCGBLEN
694ioctl).
695.Pp
696A file that does not request promiscuous mode may receive promiscuously
697received packets as a side effect of another file requesting this
698mode on the same hardware interface.  This could be fixed in the kernel
699with additional processing overhead.  However, we favor the model where
700all files must assume that the interface is promiscuous, and if
701so desired, must utilize a filter to reject foreign packets.
702.Pp
703Data link protocols with variable length headers are not currently supported.
704.Sh HISTORY
705.Pp
706The Enet packet filter was created in 1980 by Mike Accetta and
707Rick Rashid at Carnegie-Mellon University.  Jeffrey Mogul, at
708Stanford, ported the code to BSD and continued its development from
7091983 on.  Since then, it has evolved into the Ultrix Packet Filter
710at
711.Tn DEC ,
712a
713.Tn STREAMS
714.Tn NIT
715module under
716.Tn SunOS 4.1 ,
717and
718.Tn BPF .
719.Sh AUTHORS
720.Pp
721Steven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in
722Summer 1990.  Much of the design is due to Van Jacobson.
723