1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $FreeBSD$ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd pseudo-device bpf 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOCSETIF 47ioctl. 48A given interface can be shared be multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50The total number of open 51files is limited to the value given in the kernel configuration; the 52example given in the 53.Sx SYNOPSIS 54above sets the limit to 16. 55.Pp 56A separate device file is required for each minor device. 57If a file is in use, the open will fail and 58.Va errno 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. 67Each descriptor that accepts the packet receives its own copy. 68.Pp 69Reads from these files return the next group of packets 70that have matched the filter. 71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm . 74This size is returned by the 75.Dv BIOCGBLEN 76ioctl (see below), and 77can be set with 78.Dv BIOCSBLEN. 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length 83headers. Currently, only Ethernet, 84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP 100links are supported. 101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in 105.Aq Pa net/bpf.h . 106All commands require 107these includes: 108.Bd -literal 109 #include <sys/types.h> 110 #include <sys/time.h> 111 #include <sys/ioctl.h> 112 #include <net/bpf.h> 113.Ed 114.Pp 115Additionally, 116.Dv BIOCGETIF 117and 118.Dv BIOCSETIF 119require 120.Aq Pa sys/socket.h 121and 122.Aq Pa net/if.h . 123.Pp 124In addition to 125.Dv FIONREAD 126and 127.Dv SIOCGIFADDR , 128the following commands may be applied to any open 129.Nm 130file. 131The (third) argument to 132.Xr ioctl 2 133should be a pointer to the type indicated. 134.Bl -tag -width BIOCGRTIMEOUT 135.It Dv BIOCGBLEN 136.Pq Li u_int 137Returns the required buffer length for reads on 138.Nm 139files. 140.It Dv BIOCSBLEN 141.Pq Li u_int 142Sets the buffer length for reads on 143.Nm 144files. The buffer must be set before the file is attached to an interface 145with 146.Dv BIOCSETIF . 147If the requested buffer size cannot be accommodated, the closest 148allowable size will be set and returned in the argument. 149A read call will result in 150.Er EIO 151if it is passed a buffer that is not this size. 152.It Dv BIOCGDLT 153.Pq Li u_int 154Returns the type of the data link layer underlying the attached interface. 155.Er EINVAL 156is returned if no interface has been specified. 157The device types, prefixed with 158.Dq Li DLT_ , 159are defined in 160.Aq Pa net/bpf.h . 161.It Dv BIOCPROMISC 162Forces the interface into promiscuous mode. 163All packets, not just those destined for the local host, are processed. 164Since more than one file can be listening on a given interface, 165a listener that opened its interface non-promiscuously may receive 166packets promiscuously. This problem can be remedied with an 167appropriate filter. 168.It Dv BIOCFLUSH 169Flushes the buffer of incoming packets, 170and resets the statistics that are returned by BIOCGSTATS. 171.It Dv BIOCGETIF 172.Pq Li "struct ifreq" 173Returns the name of the hardware interface that the file is listening on. 174The name is returned in the ifr_name field of 175the 176.Li ifreq 177structure. 178All other fields are undefined. 179.It Dv BIOCSETIF 180.Pq Li "struct ifreq" 181Sets the hardware interface associate with the file. This 182command must be performed before any packets can be read. 183The device is indicated by name using the 184.Li ifr_name 185field of the 186.Li ifreq 187structure. 188Additionally, performs the actions of 189.Dv BIOCFLUSH . 190.It Dv BIOCSRTIMEOUT 191.It Dv BIOCGRTIMEOUT 192.Pq Li "struct timeval" 193Set or get the read timeout parameter. 194The argument 195specifies the length of time to wait before timing 196out on a read request. 197This parameter is initialized to zero by 198.Xr open 2 , 199indicating no timeout. 200.It Dv BIOCGSTATS 201.Pq Li "struct bpf_stat" 202Returns the following structure of packet statistics: 203.Bd -literal 204struct bpf_stat { 205 u_int bs_recv; /* number of packets received */ 206 u_int bs_drop; /* number of packets dropped */ 207}; 208.Ed 209.Pp 210The fields are: 211.Bl -hang -offset indent 212.It Li bs_recv 213the number of packets received by the descriptor since opened or reset 214(including any buffered since the last read call); 215and 216.It Li bs_drop 217the number of packets which were accepted by the filter but dropped by the 218kernel because of buffer overflows 219(i.e., the application's reads aren't keeping up with the packet traffic). 220.El 221.It Dv BIOCIMMEDIATE 222.Pq Li u_int 223Enable or disable 224.Dq immediate mode , 225based on the truth value of the argument. 226When immediate mode is enabled, reads return immediately upon packet 227reception. Otherwise, a read will block until either the kernel buffer 228becomes full or a timeout occurs. 229This is useful for programs like 230.Xr rarpd 8 231which must respond to messages in real time. 232The default for a new file is off. 233.It Dv BIOCSETF 234.Pq Li "struct bpf_program" 235Sets the filter program used by the kernel to discard uninteresting 236packets. An array of instructions and its length is passed in using 237the following structure: 238.Bd -literal 239struct bpf_program { 240 int bf_len; 241 struct bpf_insn *bf_insns; 242}; 243.Ed 244.Pp 245The filter program is pointed to by the 246.Li bf_insns 247field while its length in units of 248.Sq Li struct bpf_insn 249is given by the 250.Li bf_len 251field. 252Also, the actions of 253.Dv BIOCFLUSH are performed. 254See section 255.Sx "FILTER MACHINE" 256for an explanation of the filter language. 257.It Dv BIOCVERSION 258.Pq Li "struct bpf_version" 259Returns the major and minor version numbers of the filter language currently 260recognized by the kernel. Before installing a filter, applications must check 261that the current version is compatible with the running kernel. Version 262numbers are compatible if the major numbers match and the application minor 263is less than or equal to the kernel minor. The kernel version number is 264returned in the following structure: 265.Bd -literal 266struct bpf_version { 267 u_short bv_major; 268 u_short bv_minor; 269}; 270.Ed 271.Pp 272The current version numbers are given by 273.Dv BPF_MAJOR_VERSION 274and 275.Dv BPF_MINOR_VERSION 276from 277.Aq Pa net/bpf.h . 278An incompatible filter 279may result in undefined behavior (most likely, an error returned by 280.Fn ioctl 281or haphazard packet matching). 282.It Dv BIOCSHDRCMPLT 283.It Dv BIOCGHDRCMPLT 284.Pq Li u_int 285Set or get the status of the 286.Dq header complete 287flag. 288Set to zero if the link level source address should be filled in automatically 289by the the interface output routine. Set to one if the link level source 290address will be written, as provided, to the wire. This flag is initialized 291to zero by default. 292.It Dv BIOCSSEESENT 293.It Dv BIOCGSEESENT 294.Pq Li u_int 295Set or get the flag determining whether locally generated packets on the 296interface should be returned by BPF. Set to zero to see only incoming 297packets on the interface. Set to one to see packets originating 298locally and remotely on the interface. This flag is initialized to one by 299default. 300.El 301.Sh BPF HEADER 302The following structure is prepended to each packet returned by 303.Xr read 2 : 304.Bd -literal 305struct bpf_hdr { 306 struct timeval bh_tstamp; /* time stamp */ 307 u_long bh_caplen; /* length of captured portion */ 308 u_long bh_datalen; /* original length of packet */ 309 u_short bh_hdrlen; /* length of bpf header (this struct 310 plus alignment padding */ 311}; 312.Ed 313.Pp 314The fields, whose values are stored in host order, and are: 315.Pp 316.Bl -tag -compact -width bh_datalen 317.It Li bh_tstamp 318The time at which the packet was processed by the packet filter. 319.It Li bh_caplen 320The length of the captured portion of the packet. This is the minimum of 321the truncation amount specified by the filter and the length of the packet. 322.It Li bh_datalen 323The length of the packet off the wire. 324This value is independent of the truncation amount specified by the filter. 325.It Li bh_hdrlen 326The length of the 327.Nm 328header, which may not be equal to 329.\" XXX - not really a function call 330.Fn sizeof "struct bpf_hdr" . 331.El 332.Pp 333The 334.Li bh_hdrlen 335field exists to account for 336padding between the header and the link level protocol. 337The purpose here is to guarantee proper alignment of the packet 338data structures, which is required on alignment sensitive 339architectures and improves performance on many other architectures. 340The packet filter insures that the 341.Li bpf_hdr 342and the network layer 343header will be word aligned. Suitable precautions 344must be taken when accessing the link layer protocol fields on alignment 345restricted machines. (This isn't a problem on an Ethernet, since 346the type field is a short falling on an even offset, 347and the addresses are probably accessed in a bytewise fashion). 348.Pp 349Additionally, individual packets are padded so that each starts 350on a word boundary. This requires that an application 351has some knowledge of how to get from packet to packet. 352The macro 353.Dv BPF_WORDALIGN 354is defined in 355.Aq Pa net/bpf.h 356to facilitate 357this process. It rounds up its argument 358to the nearest word aligned value (where a word is 359.Dv BPF_ALIGNMENT 360bytes wide). 361.Pp 362For example, if 363.Sq Li p 364points to the start of a packet, this expression 365will advance it to the next packet: 366.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 367.Pp 368For the alignment mechanisms to work properly, the 369buffer passed to 370.Xr read 2 371must itself be word aligned. 372The 373.Xr malloc 3 374function 375will always return an aligned buffer. 376.Sh FILTER MACHINE 377A filter program is an array of instructions, with all branches forwardly 378directed, terminated by a 379.Em return 380instruction. 381Each instruction performs some action on the pseudo-machine state, 382which consists of an accumulator, index register, scratch memory store, 383and implicit program counter. 384.Pp 385The following structure defines the instruction format: 386.Bd -literal 387struct bpf_insn { 388 u_short code; 389 u_char jt; 390 u_char jf; 391 u_long k; 392}; 393.Ed 394.Pp 395The 396.Li k 397field is used in different ways by different instructions, 398and the 399.Li jt 400and 401.Li jf 402fields are used as offsets 403by the branch instructions. 404The opcodes are encoded in a semi-hierarchical fashion. 405There are eight classes of instructions: 406.Dv BPF_LD , 407.Dv BPF_LDX , 408.Dv BPF_ST , 409.Dv BPF_STX , 410.Dv BPF_ALU , 411.Dv BPF_JMP , 412.Dv BPF_RET , 413and 414.Dv BPF_MISC . 415Various other mode and 416operator bits are or'd into the class to give the actual instructions. 417The classes and modes are defined in 418.Aq Pa net/bpf.h . 419.Pp 420Below are the semantics for each defined 421.Nm 422instruction. 423We use the convention that A is the accumulator, X is the index register, 424P[] packet data, and M[] scratch memory store. 425P[i:n] gives the data at byte offset 426.Dq i 427in the packet, 428interpreted as a word (n=4), 429unsigned halfword (n=2), or unsigned byte (n=1). 430M[i] gives the i'th word in the scratch memory store, which is only 431addressed in word units. The memory store is indexed from 0 to 432.Dv BPF_MEMWORDS 433- 1. 434.Li k , 435.Li jt , 436and 437.Li jf 438are the corresponding fields in the 439instruction definition. 440.Dq len 441refers to the length of the packet. 442.Pp 443.Bl -tag -width BPF_STXx 444.It Dv BPF_LD 445These instructions copy a value into the accumulator. The type of the 446source operand is specified by an 447.Dq addressing mode 448and can be a constant 449.Pq Dv BPF_IMM , 450packet data at a fixed offset 451.Pq Dv BPF_ABS , 452packet data at a variable offset 453.Pq Dv BPF_IND , 454the packet length 455.Pq Dv BPF_LEN , 456or a word in the scratch memory store 457.Pq Dv BPF_MEM . 458For 459.Dv BPF_IND 460and 461.Dv BPF_ABS, 462the data size must be specified as a word 463.Pq Dv BPF_W , 464halfword 465.Pq Dv BPF_H , 466or byte 467.Pq Dv BPF_B . 468The semantics of all the recognized 469.Dv BPF_LD 470instructions follow. 471.Pp 472.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 473.It Li BPF_LD+BPF_W+BPF_ABS 474A <- P[k:4] 475.It Li BPF_LD+BPF_H+BPF_ABS 476A <- P[k:2] 477.It Li BPF_LD+BPF_B+BPF_ABS 478A <- P[k:1] 479.It Li BPF_LD+BPF_W+BPF_IND 480A <- P[X+k:4] 481.It Li BPF_LD+BPF_H+BPF_IND 482A <- P[X+k:2] 483.It Li BPF_LD+BPF_B+BPF_IND 484A <- P[X+k:1] 485.It Li BPF_LD+BPF_W+BPF_LEN 486A <- len 487.It Li BPF_LD+BPF_IMM 488A <- k 489.It Li BPF_LD+BPF_MEM 490A <- M[k] 491.El 492.It Dv BPF_LDX 493These instructions load a value into the index register. Note that 494the addressing modes are more restrictive than those of the accumulator loads, 495but they include 496.Dv BPF_MSH , 497a hack for efficiently loading the IP header length. 498.Pp 499.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 500.It Li BPF_LDX+BPF_W+BPF_IMM 501X <- k 502.It Li BPF_LDX+BPF_W+BPF_MEM 503X <- M[k] 504.It Li BPF_LDX+BPF_W+BPF_LEN 505X <- len 506.It Li BPF_LDX+BPF_B+BPF_MSH 507X <- 4*(P[k:1]&0xf) 508.El 509.It Dv BPF_ST 510This instruction stores the accumulator into the scratch memory. 511We do not need an addressing mode since there is only one possibility 512for the destination. 513.Pp 514.Bl -tag -width "BPF_ST" -compact 515.It Li BPF_ST 516M[k] <- A 517.El 518.It Dv BPF_STX 519This instruction stores the index register in the scratch memory store. 520.Pp 521.Bl -tag -width "BPF_STX" -compact 522.It Li BPF_STX 523M[k] <- X 524.El 525.It Dv BPF_ALU 526The alu instructions perform operations between the accumulator and 527index register or constant, and store the result back in the accumulator. 528For binary operations, a source mode is required 529.Po 530.Dv BPF_K 531or 532.Dv BPF_X 533.Pc . 534.Pp 535.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 536.It Li BPF_ALU+BPF_ADD+BPF_K 537A <- A + k 538.It Li BPF_ALU+BPF_SUB+BPF_K 539A <- A - k 540.It Li BPF_ALU+BPF_MUL+BPF_K 541A <- A * k 542.It Li BPF_ALU+BPF_DIV+BPF_K 543A <- A / k 544.It Li BPF_ALU+BPF_AND+BPF_K 545A <- A & k 546.It Li BPF_ALU+BPF_OR+BPF_K 547A <- A | k 548.It Li BPF_ALU+BPF_LSH+BPF_K 549A <- A << k 550.It Li BPF_ALU+BPF_RSH+BPF_K 551A <- A >> k 552.It Li BPF_ALU+BPF_ADD+BPF_X 553A <- A + X 554.It Li BPF_ALU+BPF_SUB+BPF_X 555A <- A - X 556.It Li BPF_ALU+BPF_MUL+BPF_X 557A <- A * X 558.It Li BPF_ALU+BPF_DIV+BPF_X 559A <- A / X 560.It Li BPF_ALU+BPF_AND+BPF_X 561A <- A & X 562.It Li BPF_ALU+BPF_OR+BPF_X 563A <- A | X 564.It Li BPF_ALU+BPF_LSH+BPF_X 565A <- A << X 566.It Li BPF_ALU+BPF_RSH+BPF_X 567A <- A >> X 568.It Li BPF_ALU+BPF_NEG 569A <- -A 570.El 571.It Dv BPF_JMP 572The jump instructions alter flow of control. Conditional jumps 573compare the accumulator against a constant 574.Pq Dv BPF_K 575or the index register 576.Pq Dv BPF_X . 577If the result is true (or non-zero), 578the true branch is taken, otherwise the false branch is taken. 579Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 580However, the jump always 581.Pq Dv BPF_JA 582opcode uses the 32 bit 583.Li k 584field as the offset, allowing arbitrarily distant destinations. 585All conditionals use unsigned comparison conventions. 586.Pp 587.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 588.It Li BPF_JMP+BPF_JA 589pc += k 590.It Li BPF_JMP+BPF_JGT+BPF_K 591pc += (A > k) ? jt : jf 592.It Li BPF_JMP+BPF_JGE+BPF_K 593pc += (A >= k) ? jt : jf 594.It Li BPF_JMP+BPF_JEQ+BPF_K 595pc += (A == k) ? jt : jf 596.It Li BPF_JMP+BPF_JSET+BPF_K 597pc += (A & k) ? jt : jf 598.It Li BPF_JMP+BPF_JGT+BPF_X 599pc += (A > X) ? jt : jf 600.It Li BPF_JMP+BPF_JGE+BPF_X 601pc += (A >= X) ? jt : jf 602.It Li BPF_JMP+BPF_JEQ+BPF_X 603pc += (A == X) ? jt : jf 604.It Li BPF_JMP+BPF_JSET+BPF_X 605pc += (A & X) ? jt : jf 606.El 607.It Dv BPF_RET 608The return instructions terminate the filter program and specify the amount 609of packet to accept (i.e., they return the truncation amount). A return 610value of zero indicates that the packet should be ignored. 611The return value is either a constant 612.Pq Dv BPF_K 613or the accumulator 614.Pq Dv BPF_A . 615.Pp 616.Bl -tag -width "BPF_RET+BPF_K" -compact 617.It Li BPF_RET+BPF_A 618accept A bytes 619.It Li BPF_RET+BPF_K 620accept k bytes 621.El 622.It Dv BPF_MISC 623The miscellaneous category was created for anything that doesn't 624fit into the above classes, and for any new instructions that might need to 625be added. Currently, these are the register transfer instructions 626that copy the index register to the accumulator or vice versa. 627.Pp 628.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 629.It Li BPF_MISC+BPF_TAX 630X <- A 631.It Li BPF_MISC+BPF_TXA 632A <- X 633.El 634.El 635.Pp 636The 637.Nm 638interface provides the following macros to facilitate 639array initializers: 640.Fn BPF_STMT opcode operand 641and 642.Fn BPF_JUMP opcode operand true_offset false_offset . 643.Pp 644.Sh EXAMPLES 645The following filter is taken from the Reverse ARP Daemon. It accepts 646only Reverse ARP requests. 647.Bd -literal 648struct bpf_insn insns[] = { 649 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 650 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 651 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 652 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 653 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 654 sizeof(struct ether_header)), 655 BPF_STMT(BPF_RET+BPF_K, 0), 656}; 657.Ed 658.Pp 659This filter accepts only IP packets between host 128.3.112.15 and 660128.3.112.35. 661.Bd -literal 662struct bpf_insn insns[] = { 663 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 664 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 665 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 26), 666 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 667 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 668 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 669 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 670 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 671 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 672 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 673 BPF_STMT(BPF_RET+BPF_K, 0), 674}; 675.Ed 676.Pp 677Finally, this filter returns only TCP finger packets. We must parse 678the IP header to reach the TCP header. The 679.Dv BPF_JSET 680instruction 681checks that the IP fragment offset is 0 so we are sure 682that we have a TCP header. 683.Bd -literal 684struct bpf_insn insns[] = { 685 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 686 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 687 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 688 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 689 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 690 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 691 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 692 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 693 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 694 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 695 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 696 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 697 BPF_STMT(BPF_RET+BPF_K, 0), 698}; 699.Ed 700.Sh SEE ALSO 701.Xr tcpdump 1 , 702.Xr ioctl 2 , 703.Xr byteorder 3 , 704.Xr ng_bpf 8 705.Rs 706.%A McCanne, S. 707.%A Jacobson V. 708.%T "An efficient, extensible, and portable network monitor" 709.Re 710.Sh FILES 711.Bl -tag -compact -width /dev/bpfXXX 712.It Pa /dev/bpf Ns Sy n 713the packet filter device 714.El 715.Sh BUGS 716The read buffer must be of a fixed size (returned by the 717.Dv BIOCGBLEN 718ioctl). 719.Pp 720A file that does not request promiscuous mode may receive promiscuously 721received packets as a side effect of another file requesting this 722mode on the same hardware interface. This could be fixed in the kernel 723with additional processing overhead. However, we favor the model where 724all files must assume that the interface is promiscuous, and if 725so desired, must utilize a filter to reject foreign packets. 726.Pp 727Data link protocols with variable length headers are not currently supported. 728.Sh HISTORY 729.Pp 730The Enet packet filter was created in 1980 by Mike Accetta and 731Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 732Stanford, ported the code to BSD and continued its development from 7331983 on. Since then, it has evolved into the Ultrix Packet Filter 734at 735.Tn DEC , 736a 737.Tn STREAMS 738.Tn NIT 739module under 740.Tn SunOS 4.1 , 741and 742.Tn BPF . 743.Sh AUTHORS 744.An -nosplit 745.An Steven McCanne , 746of Lawrence Berkeley Laboratory, implemented BPF in 747Summer 1990. Much of the design is due to 748.An Van Jacobson . 749