1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $FreeBSD$ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd pseudo-device bpf 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOCSETIF 47ioctl. 48A given interface can be shared be multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50The total number of open 51files is limited to the value given in the kernel configuration; the 52example given in the 53.Sx SYNOPSIS 54above sets the limit to 16. 55.Pp 56A separate device file is required for each minor device. 57If a file is in use, the open will fail and 58.Va errno 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm bpf 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. 67Each descriptor that accepts the packet receives its own copy. 68.Pp 69Reads from these files return the next group of packets 70that have matched the filter. 71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm bpf . 74This size is returned by the 75.Dv BIOCGBLEN 76ioctl (see below), and 77can be set with 78.Dv BIOCSBLEN. 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length 83headers. Currently, only Ethernet, 84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm bpf . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm bpf 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP 100links are supported. 101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in 105.Aq Pa net/bpf.h . 106All commands require 107these includes: 108.Bd -literal 109 #include <sys/types.h> 110 #include <sys/time.h> 111 #include <sys/ioctl.h> 112 #include <net/bpf.h> 113.Ed 114.Pp 115Additionally, 116.Dv BIOCGETIF 117and 118.Dv BIOCSETIF 119require 120.Aq Pa sys/socket.h 121and 122.Aq Pa net/if.h . 123 124In addition to 125.Dv FIONREAD 126and 127.Dv SIOCGIFADDR , 128the following commands may be applied to any open 129.Nm 130file. 131The (third) argument to 132.Xr ioctl 2 133should be a pointer to the type indicated. 134 135.Bl -tag -width BIOCGRTIMEOUT 136.It Dv BIOCGBLEN 137.Pq Li u_int 138Returns the required buffer length for reads on 139.Nm 140files. 141.It Dv BIOCSBLEN 142.Pq Li u_int 143Sets the buffer length for reads on 144.Nm 145files. The buffer must be set before the file is attached to an interface 146with 147.Dv BIOCSETIF . 148If the requested buffer size cannot be accommodated, the closest 149allowable size will be set and returned in the argument. 150A read call will result in 151.Er EIO 152if it is passed a buffer that is not this size. 153.It Dv BIOCGDLT 154.Pq Li u_int 155Returns the type of the data link layer underlying the attached interface. 156.Er EINVAL 157is returned if no interface has been specified. 158The device types, prefixed with 159.Dq Li DLT_ , 160are defined in 161.Aq Pa net/bpf.h . 162.It Dv BIOCPROMISC 163Forces the interface into promiscuous mode. 164All packets, not just those destined for the local host, are processed. 165Since more than one file can be listening on a given interface, 166a listener that opened its interface non-promiscuously may receive 167packets promiscuously. This problem can be remedied with an 168appropriate filter. 169.It Dv BIOCFLUSH 170Flushes the buffer of incoming packets, 171and resets the statistics that are returned by BIOCGSTATS. 172.It Dv BIOCGETIF 173.Pq Li "struct ifreq" 174Returns the name of the hardware interface that the file is listening on. 175The name is returned in the ifr_name field of 176the 177.Li ifreq 178structure. 179All other fields are undefined. 180.It Dv BIOCSETIF 181.Pq Li "struct ifreq" 182Sets the hardware interface associate with the file. This 183command must be performed before any packets can be read. 184The device is indicated by name using the 185.Li ifr_name 186field of the 187.Li ifreq 188structure. 189Additionally, performs the actions of 190.Dv BIOCFLUSH . 191.It Dv BIOCSRTIMEOUT 192.It Dv BIOCGRTIMEOUT 193.Pq Li "struct timeval" 194Set or get the read timeout parameter. 195The argument 196specifies the length of time to wait before timing 197out on a read request. 198This parameter is initialized to zero by 199.Xr open 2 , 200indicating no timeout. 201.It Dv BIOCGSTATS 202.Pq Li "struct bpf_stat" 203Returns the following structure of packet statistics: 204.Bd -literal 205struct bpf_stat { 206 u_int bs_recv; /* number of packets received */ 207 u_int bs_drop; /* number of packets dropped */ 208}; 209.Ed 210.Pp 211The fields are: 212.Bl -hang -offset indent 213.It Li bs_recv 214the number of packets received by the descriptor since opened or reset 215(including any buffered since the last read call); 216and 217.It Li bs_drop 218the number of packets which were accepted by the filter but dropped by the 219kernel because of buffer overflows 220(i.e., the application's reads aren't keeping up with the packet traffic). 221.El 222.It Dv BIOCIMMEDIATE 223.Pq Li u_int 224Enable or disable 225.Dq immediate mode , 226based on the truth value of the argument. 227When immediate mode is enabled, reads return immediately upon packet 228reception. Otherwise, a read will block until either the kernel buffer 229becomes full or a timeout occurs. 230This is useful for programs like 231.Xr rarpd 8 232which must respond to messages in real time. 233The default for a new file is off. 234.It Dv BIOCSETF 235.Pq Li "struct bpf_program" 236Sets the filter program used by the kernel to discard uninteresting 237packets. An array of instructions and its length is passed in using 238the following structure: 239.Bd -literal 240struct bpf_program { 241 int bf_len; 242 struct bpf_insn *bf_insns; 243}; 244.Ed 245 246The filter program is pointed to by the 247.Li bf_insns 248field while its length in units of 249.Sq Li struct bpf_insn 250is given by the 251.Li bf_len 252field. 253Also, the actions of 254.Dv BIOCFLUSH are performed. 255See section 256.Sx "FILTER MACHINE" 257for an explanation of the filter language. 258.It Dv BIOCVERSION 259.Pq Li "struct bpf_version" 260Returns the major and minor version numbers of the filter language currently 261recognized by the kernel. Before installing a filter, applications must check 262that the current version is compatible with the running kernel. Version 263numbers are compatible if the major numbers match and the application minor 264is less than or equal to the kernel minor. The kernel version number is 265returned in the following structure: 266.Bd -literal 267struct bpf_version { 268 u_short bv_major; 269 u_short bv_minor; 270}; 271.Ed 272.Pp 273The current version numbers are given by 274.Dv BPF_MAJOR_VERSION 275and 276.Dv BPF_MINOR_VERSION 277from 278.Aq Pa net/bpf.h . 279An incompatible filter 280may result in undefined behavior (most likely, an error returned by 281.Fn ioctl 282or haphazard packet matching). 283.It Dv BIOCSHDRCMPLT 284.It Dv BIOCGHDRCMPLT 285.Pq Li u_int 286Set or get the status of the 287.Dq header complete 288flag. 289Set to zero if the link level source address should be filled in automatically 290by the the interface output routine. Set to one if the link level source 291address will be written, as provided, to the wire. This flag is initialized 292to zero by default. 293.Sh BPF HEADER 294The following structure is prepended to each packet returned by 295.Xr read 2 : 296.Bd -literal 297struct bpf_hdr { 298 struct timeval bh_tstamp; /* time stamp */ 299 u_long bh_caplen; /* length of captured portion */ 300 u_long bh_datalen; /* original length of packet */ 301 u_short bh_hdrlen; /* length of bpf header (this struct 302 plus alignment padding */ 303}; 304.Ed 305.Pp 306The fields, whose values are stored in host order, and are: 307.Pp 308.Bl -tag -compact -width bh_datalen 309.It Li bh_tstamp 310The time at which the packet was processed by the packet filter. 311.It Li bh_caplen 312The length of the captured portion of the packet. This is the minimum of 313the truncation amount specified by the filter and the length of the packet. 314.It Li bh_datalen 315The length of the packet off the wire. 316This value is independent of the truncation amount specified by the filter. 317.It Li bh_hdrlen 318The length of the 319.Nm 320header, which may not be equal to 321.\" XXX - not really a function call 322.Fn sizeof "struct bpf_hdr" . 323.El 324.Pp 325The 326.Li bh_hdrlen 327field exists to account for 328padding between the header and the link level protocol. 329The purpose here is to guarantee proper alignment of the packet 330data structures, which is required on alignment sensitive 331architectures and improves performance on many other architectures. 332The packet filter insures that the 333.Li bpf_hdr 334and the network layer 335header will be word aligned. Suitable precautions 336must be taken when accessing the link layer protocol fields on alignment 337restricted machines. (This isn't a problem on an Ethernet, since 338the type field is a short falling on an even offset, 339and the addresses are probably accessed in a bytewise fashion). 340.Pp 341Additionally, individual packets are padded so that each starts 342on a word boundary. This requires that an application 343has some knowledge of how to get from packet to packet. 344The macro 345.Dv BPF_WORDALIGN 346is defined in 347.Aq Pa net/bpf.h 348to facilitate 349this process. It rounds up its argument 350to the nearest word aligned value (where a word is 351.Dv BPF_ALIGNMENT 352bytes wide). 353.Pp 354For example, if 355.Sq Li p 356points to the start of a packet, this expression 357will advance it to the next packet: 358.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 359.Pp 360For the alignment mechanisms to work properly, the 361buffer passed to 362.Xr read 2 363must itself be word aligned. 364The 365.Xr malloc 3 366function 367will always return an aligned buffer. 368.Sh FILTER MACHINE 369A filter program is an array of instructions, with all branches forwardly 370directed, terminated by a 371.Em return 372instruction. 373Each instruction performs some action on the pseudo-machine state, 374which consists of an accumulator, index register, scratch memory store, 375and implicit program counter. 376 377The following structure defines the instruction format: 378.Bd -literal 379struct bpf_insn { 380 u_short code; 381 u_char jt; 382 u_char jf; 383 u_long k; 384}; 385.Ed 386 387The 388.Li k 389field is used in different ways by different instructions, 390and the 391.Li jt 392and 393.Li jf 394fields are used as offsets 395by the branch instructions. 396The opcodes are encoded in a semi-hierarchical fashion. 397There are eight classes of instructions: 398.Dv BPF_LD , 399.Dv BPF_LDX , 400.Dv BPF_ST , 401.Dv BPF_STX , 402.Dv BPF_ALU , 403.Dv BPF_JMP , 404.Dv BPF_RET , 405and 406.Dv BPF_MISC . 407Various other mode and 408operator bits are or'd into the class to give the actual instructions. 409The classes and modes are defined in 410.Aq Pa net/bpf.h . 411 412Below are the semantics for each defined 413.Nm 414instruction. 415We use the convention that A is the accumulator, X is the index register, 416P[] packet data, and M[] scratch memory store. 417P[i:n] gives the data at byte offset 418.Dq i 419in the packet, 420interpreted as a word (n=4), 421unsigned halfword (n=2), or unsigned byte (n=1). 422M[i] gives the i'th word in the scratch memory store, which is only 423addressed in word units. The memory store is indexed from 0 to 424.Dv BPF_MEMWORDS 425- 1. 426.Li k , 427.Li jt , 428and 429.Li jf 430are the corresponding fields in the 431instruction definition. 432.Dq len 433refers to the length of the packet. 434.Pp 435.Bl -tag -width BPF_STXx -compact 436.It Dv BPF_LD 437These instructions copy a value into the accumulator. The type of the 438source operand is specified by an 439.Dq addressing mode 440and can be a constant 441.Pq Dv BPF_IMM , 442packet data at a fixed offset 443.Pq Dv BPF_ABS , 444packet data at a variable offset 445.Pq Dv BPF_IND , 446the packet length 447.Pq Dv BPF_LEN , 448or a word in the scratch memory store 449.Pq Dv BPF_MEM . 450For 451.Dv BPF_IND 452and 453.Dv BPF_ABS, 454the data size must be specified as a word 455.Pq Dv BPF_W , 456halfword 457.Pq Dv BPF_H , 458or byte 459.Pq Dv BPF_B . 460The semantics of all the recognized 461.Dv BPF_LD 462instructions follow. 463.Pp 464.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 465.It Li BPF_LD+BPF_W+BPF_ABS 466A <- P[k:4] 467.It Li BPF_LD+BPF_H+BPF_ABS 468A <- P[k:2] 469.It Li BPF_LD+BPF_B+BPF_ABS 470A <- P[k:1] 471.It Li BPF_LD+BPF_W+BPF_IND 472A <- P[X+k:4] 473.It Li BPF_LD+BPF_H+BPF_IND 474A <- P[X+k:2] 475.It Li BPF_LD+BPF_B+BPF_IND 476A <- P[X+k:1] 477.It Li BPF_LD+BPF_W+BPF_LEN 478A <- len 479.It Li BPF_LD+BPF_IMM 480A <- k 481.It Li BPF_LD+BPF_MEM 482A <- M[k] 483.El 484 485.It Dv BPF_LDX 486These instructions load a value into the index register. Note that 487the addressing modes are more restrictive than those of the accumulator loads, 488but they include 489.Dv BPF_MSH , 490a hack for efficiently loading the IP header length. 491 492.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 493.It Li BPF_LDX+BPF_W+BPF_IMM 494X <- k 495.It Li BPF_LDX+BPF_W+BPF_MEM 496X <- M[k] 497.It Li BPF_LDX+BPF_W+BPF_LEN 498X <- len 499.It Li BPF_LDX+BPF_B+BPF_MSH 500X <- 4*(P[k:1]&0xf) 501.El 502 503.It Dv BPF_ST 504This instruction stores the accumulator into the scratch memory. 505We do not need an addressing mode since there is only one possibility 506for the destination. 507 508.Bl -tag -width "BPF_ST" -compact 509.It Li BPF_ST 510M[k] <- A 511.El 512 513.It Dv BPF_STX 514This instruction stores the index register in the scratch memory store. 515 516.Bl -tag -width "BPF_STX" -compact 517.It Li BPF_STX 518M[k] <- X 519.El 520 521.It Dv BPF_ALU 522The alu instructions perform operations between the accumulator and 523index register or constant, and store the result back in the accumulator. 524For binary operations, a source mode is required 525.Po 526.Dv BPF_K 527or 528.Dv BPF_X 529.Pc . 530 531.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 532.It Li BPF_ALU+BPF_ADD+BPF_K 533A <- A + k 534.It Li BPF_ALU+BPF_SUB+BPF_K 535A <- A - k 536.It Li BPF_ALU+BPF_MUL+BPF_K 537A <- A * k 538.It Li BPF_ALU+BPF_DIV+BPF_K 539A <- A / k 540.It Li BPF_ALU+BPF_AND+BPF_K 541A <- A & k 542.It Li BPF_ALU+BPF_OR+BPF_K 543A <- A | k 544.It Li BPF_ALU+BPF_LSH+BPF_K 545A <- A << k 546.It Li BPF_ALU+BPF_RSH+BPF_K 547A <- A >> k 548.It Li BPF_ALU+BPF_ADD+BPF_X 549A <- A + X 550.It Li BPF_ALU+BPF_SUB+BPF_X 551A <- A - X 552.It Li BPF_ALU+BPF_MUL+BPF_X 553A <- A * X 554.It Li BPF_ALU+BPF_DIV+BPF_X 555A <- A / X 556.It Li BPF_ALU+BPF_AND+BPF_X 557A <- A & X 558.It Li BPF_ALU+BPF_OR+BPF_X 559A <- A | X 560.It Li BPF_ALU+BPF_LSH+BPF_X 561A <- A << X 562.It Li BPF_ALU+BPF_RSH+BPF_X 563A <- A >> X 564.It Li BPF_ALU+BPF_NEG 565A <- -A 566.El 567 568.It Dv BPF_JMP 569The jump instructions alter flow of control. Conditional jumps 570compare the accumulator against a constant 571.Pq Dv BPF_K 572or the index register 573.Pq Dv BPF_X . 574If the result is true (or non-zero), 575the true branch is taken, otherwise the false branch is taken. 576Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 577However, the jump always 578.Pq Dv BPF_JA 579opcode uses the 32 bit 580.Li k 581field as the offset, allowing arbitrarily distant destinations. 582All conditionals use unsigned comparison conventions. 583 584.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 585.It Li BPF_JMP+BPF_JA 586pc += k 587.It Li BPF_JMP+BPF_JGT+BPF_K 588pc += (A > k) ? jt : jf 589.It Li BPF_JMP+BPF_JGE+BPF_K 590pc += (A >= k) ? jt : jf 591.It Li BPF_JMP+BPF_JEQ+BPF_K 592pc += (A == k) ? jt : jf 593.It Li BPF_JMP+BPF_JSET+BPF_K 594pc += (A & k) ? jt : jf 595.It Li BPF_JMP+BPF_JGT+BPF_X 596pc += (A > X) ? jt : jf 597.It Li BPF_JMP+BPF_JGE+BPF_X 598pc += (A >= X) ? jt : jf 599.It Li BPF_JMP+BPF_JEQ+BPF_X 600pc += (A == X) ? jt : jf 601.It Li BPF_JMP+BPF_JSET+BPF_X 602pc += (A & X) ? jt : jf 603.El 604 605.It Dv BPF_RET 606The return instructions terminate the filter program and specify the amount 607of packet to accept (i.e., they return the truncation amount). A return 608value of zero indicates that the packet should be ignored. 609The return value is either a constant 610.Pq Dv BPF_K 611or the accumulator 612.Pq Dv BPF_A . 613 614.Bl -tag -width "BPF_RET+BPF_K" -compact 615.It Li BPF_RET+BPF_A 616accept A bytes 617.It Li BPF_RET+BPF_K 618accept k bytes 619.El 620 621.It Dv BPF_MISC 622The miscellaneous category was created for anything that doesn't 623fit into the above classes, and for any new instructions that might need to 624be added. Currently, these are the register transfer instructions 625that copy the index register to the accumulator or vice versa. 626 627.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 628.It Li BPF_MISC+BPF_TAX 629X <- A 630.It Li BPF_MISC+BPF_TXA 631A <- X 632.El 633.Pp 634The 635.Nm 636interface provides the following macros to facilitate 637array initializers: 638.Fn BPF_STMT opcode operand 639and 640.Fn BPF_JUMP opcode operand true_offset false_offset . 641.Pp 642.Sh EXAMPLES 643The following filter is taken from the Reverse ARP Daemon. It accepts 644only Reverse ARP requests. 645.Bd -literal 646struct bpf_insn insns[] = { 647 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 648 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 649 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 650 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 651 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 652 sizeof(struct ether_header)), 653 BPF_STMT(BPF_RET+BPF_K, 0), 654}; 655.Ed 656.Pp 657This filter accepts only IP packets between host 128.3.112.15 and 658128.3.112.35. 659.Bd -literal 660struct bpf_insn insns[] = { 661 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 662 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 663 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 26), 664 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 665 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 666 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 667 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 668 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 669 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 670 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 671 BPF_STMT(BPF_RET+BPF_K, 0), 672}; 673.Ed 674.Pp 675Finally, this filter returns only TCP finger packets. We must parse 676the IP header to reach the TCP header. The 677.Dv BPF_JSET 678instruction 679checks that the IP fragment offset is 0 so we are sure 680that we have a TCP header. 681.Bd -literal 682struct bpf_insn insns[] = { 683 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 684 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 685 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 686 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 687 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 688 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 689 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 690 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 691 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 692 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 693 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 694 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 695 BPF_STMT(BPF_RET+BPF_K, 0), 696}; 697.Ed 698.Sh SEE ALSO 699.Xr tcpdump 1 , 700.Xr ioctl 2 , 701.Xr byteorder 3 702.Rs 703.%A McCanne, S. 704.%A Jacobson V. 705.%T "An efficient, extensible, and portable network monitor" 706.Re 707.Sh FILES 708.Bl -tag -compact -width /dev/bpfXXX 709.It Pa /dev/bpf Ns Sy n 710the packet filter device 711.El 712.Sh BUGS 713The read buffer must be of a fixed size (returned by the 714.Dv BIOCGBLEN 715ioctl). 716.Pp 717A file that does not request promiscuous mode may receive promiscuously 718received packets as a side effect of another file requesting this 719mode on the same hardware interface. This could be fixed in the kernel 720with additional processing overhead. However, we favor the model where 721all files must assume that the interface is promiscuous, and if 722so desired, must utilize a filter to reject foreign packets. 723.Pp 724Data link protocols with variable length headers are not currently supported. 725.Sh HISTORY 726.Pp 727The Enet packet filter was created in 1980 by Mike Accetta and 728Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 729Stanford, ported the code to BSD and continued its development from 7301983 on. Since then, it has evolved into the Ultrix Packet Filter 731at 732.Tn DEC , 733a 734.Tn STREAMS 735.Tn NIT 736module under 737.Tn SunOS 4.1 , 738and 739.Tn BPF . 740.Sh AUTHORS 741.An Steven McCanne , 742of Lawrence Berkeley Laboratory, implemented BPF in 743Summer 1990. Much of the design is due to 744.An Van Jacobson . 745