1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $Id: bpf.4,v 1.5 1996/10/05 18:37:21 wosch Exp $ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd pseudo-device bpfilter 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOSETIF 47ioctl. 48A given interface can be shared be multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50The total number of open 51files is limited to the value given in the kernel configuration; the 52example given in the 53.Sx SYNOPSIS 54above sets the limit to 16. 55.Pp 56A separate device file is required for each minor device. 57If a file is in use, the open will fail and 58.Va errno 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm bpf 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. 67Each descriptor that accepts the packet receives its own copy. 68.Pp 69Reads from these files return the next group of packets 70that have matched the filter. 71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm 74This size is returned by the 75.Dv BIOCGBLEN 76ioctl (see below), and 77can be set with 78.Dv BIOCSBLEN. 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length 83headers. Currently, only Ethernet, 84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm bpf . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm bpf 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP 100links are supported. 101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in <net/bpf.h>. All commands require 105these includes: 106.Bd -literal 107 #include <sys/types.h> 108 #include <sys/time.h> 109 #include <sys/ioctl.h> 110 #include <net/bpf.h> 111.Ed 112.Pp 113Additionally, 114.Dv BIOCGETIF 115and 116.Dv BIOCSETIF 117require 118.Aq Pa sys/socket.h 119and 120.Aq Pa net/if.h . 121 122In addition to 123.Dv FIONREAD 124and 125.Dv SIOCGIFADDR , 126the following commands may be applied to any open 127.Nm 128file. 129The (third) argument to 130.Xr ioctl 2 131should be a pointer to the type indicated. 132 133.Bl -tag -width BIOCGRTIMEOUT 134.It Dv BIOCGBLEN 135.Pq Li u_int 136Returns the required buffer length for reads on 137.Nm 138files. 139.It Dv BIOCSBLEN 140.Pq Li u_int 141Sets the buffer length for reads on 142.Nm 143files. The buffer must be set before the file is attached to an interface 144with 145.Dv BIOCSETIF . 146If the requested buffer size cannot be accommodated, the closest 147allowable size will be set and returned in the argument. 148A read call will result in 149.Er EIO 150if it is passed a buffer that is not this size. 151.It Dv BIOCGDLT 152.Pq Li u_int 153Returns the type of the data link layer underlying the attached interface. 154.Er EINVAL 155is returned if no interface has been specified. 156The device types, prefixed with 157.Dq Li DLT_ , 158are defined in 159.Aq Pa net/bpf.h . 160.It Dv BIOCPROMISC 161Forces the interface into promiscuous mode. 162All packets, not just those destined for the local host, are processed. 163Since more than one file can be listening on a given interface, 164a listener that opened its interface non-promiscuously may receive 165packets promiscuously. This problem can be remedied with an 166appropriate filter. 167.It Dv BIOCFLUSH 168Flushes the buffer of incoming packets, 169and resets the statistics that are returned by BIOCGSTATS. 170.It Dv BIOCGETIF 171.Pq Li "struct ifreq" 172Returns the name of the hardware interface that the file is listening on. 173The name is returned in the if_name field of 174the 175.Li ifreq 176structure. 177All other fields are undefined. 178.It Dv BIOCSETIF 179.Pq Li "struct ifreq" 180Sets the hardware interface associate with the file. This 181command must be performed before any packets can be read. 182The device is indicated by name using the 183.Li if_name 184field of the 185.Li ifreq 186structure. 187Additionally, performs the actions of 188.Dv BIOCFLUSH . 189.It Dv BIOCSRTIMEOUT 190.It Dv BIOCGRTIMEOUT 191.Pq Li "struct timeval" 192Set or get the read timeout parameter. 193The argument 194specifies the length of time to wait before timing 195out on a read request. 196This parameter is initialized to zero by 197.Xr open 2 , 198indicating no timeout. 199.It Dv BIOCGSTATS 200.Pq Li "struct bpf_stat" 201Returns the following structure of packet statistics: 202.Bd -literal 203struct bpf_stat { 204 u_int bs_recv; 205 u_int bs_drop; 206}; 207.Ed 208 209The fields are: 210.Bl -hang -offset indent 211.It Li bs_recv 212the number of packets received by the descriptor since opened or reset 213(including any buffered since the last read call); 214and 215.It Li bs_drop 216the number of packets which were accepted by the filter but dropped by the 217kernel because of buffer overflows 218(i.e., the application's reads aren't keeping up with the packet traffic). 219.El 220.It Dv BIOCIMMEDIATE 221.Pq Li u_int 222Enable or disable ``immediate mode'', based on the truth value of the argument. 223When immediate mode is enabled, reads return immediately upon packet 224reception. Otherwise, a read will block until either the kernel buffer 225becomes full or a timeout occurs. 226This is useful for programs like 227.Xr rarpd 8 228which must respond to messages in real time. 229The default for a new file is off. 230.It Dv BIOCSETF 231.Pq Li "struct bpf_program" 232Sets the filter program used by the kernel to discard uninteresting 233packets. An array of instructions and its length is passed in using 234the following structure: 235.Bd -literal 236struct bpf_program { 237 int bf_len; 238 struct bpf_insn *bf_insns; 239}; 240.Ed 241 242The filter program is pointed to by the 243.Li bf_insns 244field while its length in units of 245.Sq Li struct bpf_insn 246is given by the 247.Li bf_len 248field. 249Also, the actions of 250.Dv BIOCFLUSH are performed. 251See section 252.Sx "FILTER MACHINE" 253for an explanation of the filter language. 254.It Dv BIOCVERSION 255.Pq Li "struct bpf_version" 256Returns the major and minor version numbers of the filter language currently 257recognized by the kernel. Before installing a filter, applications must check 258that the current version is compatible with the running kernel. Version 259numbers are compatible if the major numbers match and the application minor 260is less than or equal to the kernel minor. The kernel version number is 261returned in the following structure: 262.Bd -literal 263struct bpf_version { 264 u_short bv_major; 265 u_short bv_minor; 266}; 267.Ed 268 269The current version numbers are given by 270.Dv BPF_MAJOR_VERSION 271and 272.Dv BPF_MINOR_VERSION 273from 274.Aq Pa net/bpf.h . 275An incompatible filter 276may result in undefined behavior (most likely, an error returned by 277.Fn ioctl 278or haphazard packet matching). 279.Sh BPF HEADER 280The following structure is prepended to each packet returned by 281.Xr read 2 : 282.Bd -literal 283struct bpf_hdr { 284 struct timeval bh_tstamp; 285 u_long bh_caplen; 286 u_long bh_datalen; 287 u_short bh_hdrlen; 288}; 289.Ed 290.Pp 291The fields, whose values are stored in host order, and are: 292.Pp 293.Bl -tag -compact -width bh_datalen 294.It Li bh_tstamp 295The time at which the packet was processed by the packet filter. 296.It Li bh_caplen 297The length of the captured portion of the packet. This is the minimum of 298the truncation amount specified by the filter and the length of the packet. 299.It Li bh_datalen 300The length of the packet off the wire. 301This value is independent of the truncation amount specified by the filter. 302.It Li bh_hdrlen 303The length of the 304.Nm 305header, which may not be equal to 306.\" XXX - not really a function call 307.Fn sizeof "struct bpf_hdr" . 308.El 309.Pp 310The 311.Li bh_hdrlen 312field exists to account for 313padding between the header and the link level protocol. 314The purpose here is to guarantee proper alignment of the packet 315data structures, which is required on alignment sensitive 316architectures and improves performance on many other architectures. 317The packet filter insures that the 318.Li bpf_hdr 319and the network layer 320header will be word aligned. Suitable precautions 321must be taken when accessing the link layer protocol fields on alignment 322restricted machines. (This isn't a problem on an Ethernet, since 323the type field is a short falling on an even offset, 324and the addresses are probably accessed in a bytewise fashion). 325.Pp 326Additionally, individual packets are padded so that each starts 327on a word boundary. This requires that an application 328has some knowledge of how to get from packet to packet. 329The macro 330.Dv BPF_WORDALIGN 331is defined in 332.Aq Pa net/bpf.h 333to facilitate 334this process. It rounds up its argument 335to the nearest word aligned value (where a word is 336.Dv BPF_ALIGNMENT 337bytes wide). 338.Pp 339For example, if 340.Sq Li p 341points to the start of a packet, this expression 342will advance it to the next packet: 343.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 344.Pp 345For the alignment mechanisms to work properly, the 346buffer passed to 347.Xr read 2 348must itself be word aligned. 349The 350.Xr malloc 3 351function 352will always return an aligned buffer. 353.Sh FILTER MACHINE 354A filter program is an array of instructions, with all branches forwardly 355directed, terminated by a 356.Em return 357instruction. 358Each instruction performs some action on the pseudo-machine state, 359which consists of an accumulator, index register, scratch memory store, 360and implicit program counter. 361 362The following structure defines the instruction format: 363.Bd -literal 364struct bpf_insn { 365 u_short code; 366 u_char jt; 367 u_char jf; 368 long k; 369}; 370.Ed 371 372The 373.Li k 374field is used in different ways by different instructions, 375and the 376.Li jt 377and 378.Li jf 379fields are used as offsets 380by the branch instructions. 381The opcodes are encoded in a semi-hierarchical fashion. 382There are eight classes of instructions: 383.Dv BPF_LD , 384.Dv BPF_LDX , 385.Dv BPF_ST , 386.Dv BPF_STX , 387.Dv BPF_ALU , 388.Dv BPF_JMP , 389.Dv BPF_RET , 390and 391.Dv BPF_MISC . 392Various other mode and 393operator bits are or'd into the class to give the actual instructions. 394The classes and modes are defined in 395.Aq Pa net/bpf.h . 396 397Below are the semantics for each defined 398.Nm 399instruction. 400We use the convention that A is the accumulator, X is the index register, 401P[] packet data, and M[] scratch memory store. 402P[i:n] gives the data at byte offset ``i'' in the packet, 403interpreted as a word (n=4), 404unsigned halfword (n=2), or unsigned byte (n=1). 405M[i] gives the i'th word in the scratch memory store, which is only 406addressed in word units. The memory store is indexed from 0 to 407.Dv BPF_MEMWORDS 408- 1. 409.Li k , 410.Li jt , 411and 412.Li jf 413are the corresponding fields in the 414instruction definition. ``len'' refers to the length of the packet. 415.Pp 416.Bl -tag -width BPF_STXx -compact 417.It Dv BPF_LD 418These instructions copy a value into the accumulator. The type of the 419source operand is specified by an ``addressing mode'' and can be 420a constant 421.Pq Dv BPF_IMM , 422packet data at a fixed offset 423.Pq Dv BPF_ABS , 424packet data at a variable offset 425.Pq Dv BPF_IND , 426the packet length 427.Pq Dv BPF_LEN , 428or a word in the scratch memory store 429.Pq Dv BPF_MEM . 430For 431.Dv BPF_IND 432and 433.Dv BPF_ABS, 434the data size must be specified as a word 435.Pq Dv BPF_W , 436halfword 437.Pq Dv BPF_H , 438or byte 439.Pq Dv BPF_B . 440The semantics of all the recognized 441.Dv BPF_LD 442instructions follow. 443.Pp 444.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 445.It Li BPF_LD+BPF_W+BPF_ABS 446A <- P[k:4] 447.It Li BPF_LD+BPF_H+BPF_ABS 448A <- P[k:2] 449.It Li BPF_LD+BPF_B+BPF_ABS 450A <- P[k:1] 451.It Li BPF_LD+BPF_W+BPF_IND 452A <- P[X+k:4] 453.It Li BPF_LD+BPF_H+BPF_IND 454A <- P[X+k:2] 455.It Li BPF_LD+BPF_B+BPF_IND 456A <- P[X+k:1] 457.It Li BPF_LD+BPF_W+BPF_LEN 458A <- len 459.It Li BPF_LD+BPF_IMM 460A <- k 461.It Li BPF_LD+BPF_MEM 462A <- M[k] 463.El 464 465.It Dv BPF_LDX 466These instructions load a value into the index register. Note that 467the addressing modes are more restrictive than those of the accumulator loads, 468but they include 469.Dv BPF_MSH , 470a hack for efficiently loading the IP header length. 471 472.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 473.It Li BPF_LDX+BPF_W+BPF_IMM 474X <- k 475.It Li BPF_LDX+BPF_W+BPF_MEM 476X <- M[k] 477.It Li BPF_LDX+BPF_W+BPF_LEN 478X <- len 479.It Li BPF_LDX+BPF_B+BPF_MSH 480X <- 4*(P[k:1]&0xf) 481.El 482 483.It Dv BPF_ST 484This instruction stores the accumulator into the scratch memory. 485We do not need an addressing mode since there is only one possibility 486for the destination. 487 488.Bl -tag -width "BPF_ST" -compact 489.It Li BPF_ST 490M[k] <- A 491.El 492 493.It Dv BPF_STX 494This instruction stores the index register in the scratch memory store. 495 496.Bl -tag -width "BPF_STX" -compact 497.It Li BPF_STX 498M[k] <- X 499.El 500 501.It Dv BPF_ALU 502The alu instructions perform operations between the accumulator and 503index register or constant, and store the result back in the accumulator. 504For binary operations, a source mode is required 505.Po 506.Dv BPF_K 507or 508.Dv BPF_X 509.Pc . 510 511.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 512.It Li BPF_ALU+BPF_ADD+BPF_K 513A <- A + k 514.It Li BPF_ALU+BPF_SUB+BPF_K 515A <- A - k 516.It Li BPF_ALU+BPF_MUL+BPF_K 517A <- A * k 518.It Li BPF_ALU+BPF_DIV+BPF_K 519A <- A / k 520.It Li BPF_ALU+BPF_AND+BPF_K 521A <- A & k 522.It Li BPF_ALU+BPF_OR+BPF_K 523A <- A | k 524.It Li BPF_ALU+BPF_LSH+BPF_K 525A <- A << k 526.It Li BPF_ALU+BPF_RSH+BPF_K 527A <- A >> k 528.It Li BPF_ALU+BPF_ADD+BPF_X 529A <- A + X 530.It Li BPF_ALU+BPF_SUB+BPF_X 531A <- A - X 532.It Li BPF_ALU+BPF_MUL+BPF_X 533A <- A * X 534.It Li BPF_ALU+BPF_DIV+BPF_X 535A <- A / X 536.It Li BPF_ALU+BPF_AND+BPF_X 537A <- A & X 538.It Li BPF_ALU+BPF_OR+BPF_X 539A <- A | X 540.It Li BPF_ALU+BPF_LSH+BPF_X 541A <- A << X 542.It Li BPF_ALU+BPF_RSH+BPF_X 543A <- A >> X 544.It Li BPF_ALU+BPF_NEG 545A <- -A 546.El 547 548.It Dv BPF_JMP 549The jump instructions alter flow of control. Conditional jumps 550compare the accumulator against a constant 551.Pq Dv BPF_K 552or the index register 553.Pq Dv BPF_X . 554If the result is true (or non-zero), 555the true branch is taken, otherwise the false branch is taken. 556Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 557However, the jump always 558.Pq Dv BPF_JA 559opcode uses the 32 bit 560.Li k 561field as the offset, allowing arbitrarily distant destinations. 562All conditionals use unsigned comparison conventions. 563 564.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 565.It Li BPF_JMP+BPF_JA 566pc += k 567.It Li BPF_JMP+BPF_JGT+BPF_K 568pc += (A > k) ? jt : jf 569.It Li BPF_JMP+BPF_JGE+BPF_K 570pc += (A >= k) ? jt : jf 571.It Li BPF_JMP+BPF_JEQ+BPF_K 572pc += (A == k) ? jt : jf 573.It Li BPF_JMP+BPF_JSET+BPF_K 574pc += (A & k) ? jt : jf 575.It Li BPF_JMP+BPF_JGT+BPF_X 576pc += (A > X) ? jt : jf 577.It Li BPF_JMP+BPF_JGE+BPF_X 578pc += (A >= X) ? jt : jf 579.It Li BPF_JMP+BPF_JEQ+BPF_X 580pc += (A == X) ? jt : jf 581.It Li BPF_JMP+BPF_JSET+BPF_X 582pc += (A & X) ? jt : jf 583.El 584 585.It Dv BPF_RET 586The return instructions terminate the filter program and specify the amount 587of packet to accept (i.e., they return the truncation amount). A return 588value of zero indicates that the packet should be ignored. 589The return value is either a constant 590.Pq Dv BPF_K 591or the accumulator 592.Pq Dv BPF_A . 593 594.Bl -tag -width "BPF_RET+BPF_K" -compact 595.It Li BPF_RET+BPF_A 596accept A bytes 597.It Li BPF_RET+BPF_K 598accept k bytes 599.El 600 601.It Dv BPF_MISC 602The miscellaneous category was created for anything that doesn't 603fit into the above classes, and for any new instructions that might need to 604be added. Currently, these are the register transfer instructions 605that copy the index register to the accumulator or vice versa. 606 607.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 608.It Li BPF_MISC+BPF_TAX 609X <- A 610.It Li BPF_MISC+BPF_TXA 611A <- X 612.El 613.Pp 614The 615.Nm 616interface provides the following macros to facilitate 617array initializers: 618.Fn BPF_STMT opcode operand 619and 620.Fn BPF_JUMP opcode operand true_offset false_offset . 621.Pp 622.Sh EXAMPLES 623The following filter is taken from the Reverse ARP Daemon. It accepts 624only Reverse ARP requests. 625.Bd -literal 626struct bpf_insn insns[] = { 627 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 628 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 629 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 630 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 631 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 632 sizeof(struct ether_header)), 633 BPF_STMT(BPF_RET+BPF_K, 0), 634}; 635.Ed 636.Pp 637This filter accepts only IP packets between host 128.3.112.15 and 638128.3.112.35. 639.Bd -literal 640struct bpf_insn insns[] = { 641 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 642 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 643 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 26), 644 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 645 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 646 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 647 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 648 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 649 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 650 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 651 BPF_STMT(BPF_RET+BPF_K, 0), 652}; 653.Ed 654.Pp 655Finally, this filter returns only TCP finger packets. We must parse 656the IP header to reach the TCP header. The 657.Dv BPF_JSET 658instruction 659checks that the IP fragment offset is 0 so we are sure 660that we have a TCP header. 661.Bd -literal 662struct bpf_insn insns[] = { 663 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 664 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 665 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 666 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 667 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 668 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 669 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 670 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 671 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 672 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 673 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 674 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 675 BPF_STMT(BPF_RET+BPF_K, 0), 676}; 677.Ed 678.Sh SEE ALSO 679.Xr tcpdump 1 , 680.Xr ioctl 2 681.Rs 682.%A McCanne, S. 683.%A Jacobson V. 684.%T "An efficient, extensible, and portable network monitor" 685.Re 686.Sh FILES 687.Bl -tag -compact -width /dev/bpfXXX 688.It Pa /dev/bpf Ns Sy n 689the packet filter device 690.El 691.Sh BUGS 692The read buffer must be of a fixed size (returned by the 693.Dv BIOCGBLEN 694ioctl). 695.Pp 696A file that does not request promiscuous mode may receive promiscuously 697received packets as a side effect of another file requesting this 698mode on the same hardware interface. This could be fixed in the kernel 699with additional processing overhead. However, we favor the model where 700all files must assume that the interface is promiscuous, and if 701so desired, must utilize a filter to reject foreign packets. 702.Pp 703Data link protocols with variable length headers are not currently supported. 704.Sh HISTORY 705.Pp 706The Enet packet filter was created in 1980 by Mike Accetta and 707Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 708Stanford, ported the code to BSD and continued its development from 7091983 on. Since then, it has evolved into the Ultrix Packet Filter 710at 711.Tn DEC , 712a 713.Tn STREAMS 714.Tn NIT 715module under 716.Tn SunOS 4.1 , 717and 718.Tn BPF . 719.Sh AUTHORS 720.Pp 721Steven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in 722Summer 1990. Much of the design is due to Van Jacobson. 723