1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $FreeBSD$ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd device bpf 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOCSETIF 47ioctl. 48A given interface can be shared by multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50.Pp 51A separate device file is required for each minor device. 52If a file is in use, the open will fail and 53.Va errno 54will be set to 55.Er EBUSY . 56.Pp 57Associated with each open instance of a 58.Nm 59file is a user-settable packet filter. 60Whenever a packet is received by an interface, 61all file descriptors listening on that interface apply their filter. 62Each descriptor that accepts the packet receives its own copy. 63.Pp 64Reads from these files return the next group of packets 65that have matched the filter. 66To improve performance, the buffer passed to read must be 67the same size as the buffers used internally by 68.Nm . 69This size is returned by the 70.Dv BIOCGBLEN 71ioctl (see below), and 72can be set with 73.Dv BIOCSBLEN . 74Note that an individual packet larger than this size is necessarily 75truncated. 76.Pp 77The packet filter will support any link level protocol that has fixed length 78headers. 79Currently, only Ethernet, 80.Tn SLIP , 81and 82.Tn PPP 83drivers have been modified to interact with 84.Nm . 85.Pp 86Since packet data is in network byte order, applications should use the 87.Xr byteorder 3 88macros to extract multi-byte values. 89.Pp 90A packet can be sent out on the network by writing to a 91.Nm 92file descriptor. 93The writes are unbuffered, meaning only one packet can be processed per write. 94Currently, only writes to Ethernets and 95.Tn SLIP 96links are supported. 97.Sh IOCTLS 98The 99.Xr ioctl 2 100command codes below are defined in 101.In net/bpf.h . 102All commands require 103these includes: 104.Bd -literal 105 #include <sys/types.h> 106 #include <sys/time.h> 107 #include <sys/ioctl.h> 108 #include <net/bpf.h> 109.Ed 110.Pp 111Additionally, 112.Dv BIOCGETIF 113and 114.Dv BIOCSETIF 115require 116.In sys/socket.h 117and 118.In net/if.h . 119.Pp 120In addition to 121.Dv FIONREAD 122and 123.Dv SIOCGIFADDR , 124the following commands may be applied to any open 125.Nm 126file. 127The (third) argument to 128.Xr ioctl 2 129should be a pointer to the type indicated. 130.Bl -tag -width BIOCGRTIMEOUT 131.It Dv BIOCGBLEN 132.Pq Li u_int 133Returns the required buffer length for reads on 134.Nm 135files. 136.It Dv BIOCSBLEN 137.Pq Li u_int 138Sets the buffer length for reads on 139.Nm 140files. 141The buffer must be set before the file is attached to an interface 142with 143.Dv BIOCSETIF . 144If the requested buffer size cannot be accommodated, the closest 145allowable size will be set and returned in the argument. 146A read call will result in 147.Er EIO 148if it is passed a buffer that is not this size. 149.It Dv BIOCGDLT 150.Pq Li u_int 151Returns the type of the data link layer underlying the attached interface. 152.Er EINVAL 153is returned if no interface has been specified. 154The device types, prefixed with 155.Dq Li DLT_ , 156are defined in 157.In net/bpf.h . 158.It Dv BIOCPROMISC 159Forces the interface into promiscuous mode. 160All packets, not just those destined for the local host, are processed. 161Since more than one file can be listening on a given interface, 162a listener that opened its interface non-promiscuously may receive 163packets promiscuously. 164This problem can be remedied with an appropriate filter. 165.It Dv BIOCFLUSH 166Flushes the buffer of incoming packets, 167and resets the statistics that are returned by BIOCGSTATS. 168.It Dv BIOCGETIF 169.Pq Li "struct ifreq" 170Returns the name of the hardware interface that the file is listening on. 171The name is returned in the ifr_name field of 172the 173.Li ifreq 174structure. 175All other fields are undefined. 176.It Dv BIOCSETIF 177.Pq Li "struct ifreq" 178Sets the hardware interface associate with the file. 179This 180command must be performed before any packets can be read. 181The device is indicated by name using the 182.Li ifr_name 183field of the 184.Li ifreq 185structure. 186Additionally, performs the actions of 187.Dv BIOCFLUSH . 188.It Dv BIOCSRTIMEOUT 189.It Dv BIOCGRTIMEOUT 190.Pq Li "struct timeval" 191Set or get the read timeout parameter. 192The argument 193specifies the length of time to wait before timing 194out on a read request. 195This parameter is initialized to zero by 196.Xr open 2 , 197indicating no timeout. 198.It Dv BIOCGSTATS 199.Pq Li "struct bpf_stat" 200Returns the following structure of packet statistics: 201.Bd -literal 202struct bpf_stat { 203 u_int bs_recv; /* number of packets received */ 204 u_int bs_drop; /* number of packets dropped */ 205}; 206.Ed 207.Pp 208The fields are: 209.Bl -hang -offset indent 210.It Li bs_recv 211the number of packets received by the descriptor since opened or reset 212(including any buffered since the last read call); 213and 214.It Li bs_drop 215the number of packets which were accepted by the filter but dropped by the 216kernel because of buffer overflows 217(i.e., the application's reads aren't keeping up with the packet traffic). 218.El 219.It Dv BIOCIMMEDIATE 220.Pq Li u_int 221Enable or disable 222.Dq immediate mode , 223based on the truth value of the argument. 224When immediate mode is enabled, reads return immediately upon packet 225reception. 226Otherwise, a read will block until either the kernel buffer 227becomes full or a timeout occurs. 228This is useful for programs like 229.Xr rarpd 8 230which must respond to messages in real time. 231The default for a new file is off. 232.It Dv BIOCSETF 233.Pq Li "struct bpf_program" 234Sets the filter program used by the kernel to discard uninteresting 235packets. 236An array of instructions and its length is passed in using 237the following structure: 238.Bd -literal 239struct bpf_program { 240 int bf_len; 241 struct bpf_insn *bf_insns; 242}; 243.Ed 244.Pp 245The filter program is pointed to by the 246.Li bf_insns 247field while its length in units of 248.Sq Li struct bpf_insn 249is given by the 250.Li bf_len 251field. 252Also, the actions of 253.Dv BIOCFLUSH 254are performed. 255See section 256.Sx "FILTER MACHINE" 257for an explanation of the filter language. 258.It Dv BIOCVERSION 259.Pq Li "struct bpf_version" 260Returns the major and minor version numbers of the filter language currently 261recognized by the kernel. 262Before installing a filter, applications must check 263that the current version is compatible with the running kernel. 264Version numbers are compatible if the major numbers match and the application minor 265is less than or equal to the kernel minor. 266The kernel version number is returned in the following structure: 267.Bd -literal 268struct bpf_version { 269 u_short bv_major; 270 u_short bv_minor; 271}; 272.Ed 273.Pp 274The current version numbers are given by 275.Dv BPF_MAJOR_VERSION 276and 277.Dv BPF_MINOR_VERSION 278from 279.In net/bpf.h . 280An incompatible filter 281may result in undefined behavior (most likely, an error returned by 282.Fn ioctl 283or haphazard packet matching). 284.It Dv BIOCSHDRCMPLT 285.It Dv BIOCGHDRCMPLT 286.Pq Li u_int 287Set or get the status of the 288.Dq header complete 289flag. 290Set to zero if the link level source address should be filled in automatically 291by the interface output routine. 292Set to one if the link level source 293address will be written, as provided, to the wire. 294This flag is initialized to zero by default. 295.It Dv BIOCSSEESENT 296.It Dv BIOCGSEESENT 297.Pq Li u_int 298Set or get the flag determining whether locally generated packets on the 299interface should be returned by BPF. 300Set to zero to see only incoming packets on the interface. 301Set to one to see packets originating locally and remotely on the interface. 302This flag is initialized to one by 303default. 304.El 305.Sh BPF HEADER 306The following structure is prepended to each packet returned by 307.Xr read 2 : 308.Bd -literal 309struct bpf_hdr { 310 struct timeval bh_tstamp; /* time stamp */ 311 u_long bh_caplen; /* length of captured portion */ 312 u_long bh_datalen; /* original length of packet */ 313 u_short bh_hdrlen; /* length of bpf header (this struct 314 plus alignment padding */ 315}; 316.Ed 317.Pp 318The fields, whose values are stored in host order, and are: 319.Pp 320.Bl -tag -compact -width bh_datalen 321.It Li bh_tstamp 322The time at which the packet was processed by the packet filter. 323.It Li bh_caplen 324The length of the captured portion of the packet. 325This is the minimum of 326the truncation amount specified by the filter and the length of the packet. 327.It Li bh_datalen 328The length of the packet off the wire. 329This value is independent of the truncation amount specified by the filter. 330.It Li bh_hdrlen 331The length of the 332.Nm 333header, which may not be equal to 334.\" XXX - not really a function call 335.Fn sizeof "struct bpf_hdr" . 336.El 337.Pp 338The 339.Li bh_hdrlen 340field exists to account for 341padding between the header and the link level protocol. 342The purpose here is to guarantee proper alignment of the packet 343data structures, which is required on alignment sensitive 344architectures and improves performance on many other architectures. 345The packet filter insures that the 346.Li bpf_hdr 347and the network layer 348header will be word aligned. 349Suitable precautions 350must be taken when accessing the link layer protocol fields on alignment 351restricted machines. 352(This isn't a problem on an Ethernet, since 353the type field is a short falling on an even offset, 354and the addresses are probably accessed in a bytewise fashion). 355.Pp 356Additionally, individual packets are padded so that each starts 357on a word boundary. 358This requires that an application 359has some knowledge of how to get from packet to packet. 360The macro 361.Dv BPF_WORDALIGN 362is defined in 363.In net/bpf.h 364to facilitate 365this process. 366It rounds up its argument to the nearest word aligned value (where a word is 367.Dv BPF_ALIGNMENT 368bytes wide). 369.Pp 370For example, if 371.Sq Li p 372points to the start of a packet, this expression 373will advance it to the next packet: 374.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 375.Pp 376For the alignment mechanisms to work properly, the 377buffer passed to 378.Xr read 2 379must itself be word aligned. 380The 381.Xr malloc 3 382function 383will always return an aligned buffer. 384.Sh FILTER MACHINE 385A filter program is an array of instructions, with all branches forwardly 386directed, terminated by a 387.Em return 388instruction. 389Each instruction performs some action on the pseudo-machine state, 390which consists of an accumulator, index register, scratch memory store, 391and implicit program counter. 392.Pp 393The following structure defines the instruction format: 394.Bd -literal 395struct bpf_insn { 396 u_short code; 397 u_char jt; 398 u_char jf; 399 u_long k; 400}; 401.Ed 402.Pp 403The 404.Li k 405field is used in different ways by different instructions, 406and the 407.Li jt 408and 409.Li jf 410fields are used as offsets 411by the branch instructions. 412The opcodes are encoded in a semi-hierarchical fashion. 413There are eight classes of instructions: 414.Dv BPF_LD , 415.Dv BPF_LDX , 416.Dv BPF_ST , 417.Dv BPF_STX , 418.Dv BPF_ALU , 419.Dv BPF_JMP , 420.Dv BPF_RET , 421and 422.Dv BPF_MISC . 423Various other mode and 424operator bits are or'd into the class to give the actual instructions. 425The classes and modes are defined in 426.In net/bpf.h . 427.Pp 428Below are the semantics for each defined 429.Nm 430instruction. 431We use the convention that A is the accumulator, X is the index register, 432P[] packet data, and M[] scratch memory store. 433P[i:n] gives the data at byte offset 434.Dq i 435in the packet, 436interpreted as a word (n=4), 437unsigned halfword (n=2), or unsigned byte (n=1). 438M[i] gives the i'th word in the scratch memory store, which is only 439addressed in word units. 440The memory store is indexed from 0 to 441.Dv BPF_MEMWORDS 442- 1. 443.Li k , 444.Li jt , 445and 446.Li jf 447are the corresponding fields in the 448instruction definition. 449.Dq len 450refers to the length of the packet. 451.Pp 452.Bl -tag -width BPF_STXx 453.It Dv BPF_LD 454These instructions copy a value into the accumulator. 455The type of the source operand is specified by an 456.Dq addressing mode 457and can be a constant 458.Pq Dv BPF_IMM , 459packet data at a fixed offset 460.Pq Dv BPF_ABS , 461packet data at a variable offset 462.Pq Dv BPF_IND , 463the packet length 464.Pq Dv BPF_LEN , 465or a word in the scratch memory store 466.Pq Dv BPF_MEM . 467For 468.Dv BPF_IND 469and 470.Dv BPF_ABS , 471the data size must be specified as a word 472.Pq Dv BPF_W , 473halfword 474.Pq Dv BPF_H , 475or byte 476.Pq Dv BPF_B . 477The semantics of all the recognized 478.Dv BPF_LD 479instructions follow. 480.Pp 481.Bd -literal 482BPF_LD+BPF_W+BPF_ABS A <- P[k:4] 483BPF_LD+BPF_H+BPF_ABS A <- P[k:2] 484BPF_LD+BPF_B+BPF_ABS A <- P[k:1] 485BPF_LD+BPF_W+BPF_IND A <- P[X+k:4] 486BPF_LD+BPF_H+BPF_IND A <- P[X+k:2] 487BPF_LD+BPF_B+BPF_IND A <- P[X+k:1] 488BPF_LD+BPF_W+BPF_LEN A <- len 489BPF_LD+BPF_IMM A <- k 490BPF_LD+BPF_MEM A <- M[k] 491.Ed 492.It Dv BPF_LDX 493These instructions load a value into the index register. 494Note that 495the addressing modes are more restrictive than those of the accumulator loads, 496but they include 497.Dv BPF_MSH , 498a hack for efficiently loading the IP header length. 499.Pp 500.Bd -literal 501BPF_LDX+BPF_W+BPF_IMM X <- k 502BPF_LDX+BPF_W+BPF_MEM X <- M[k] 503BPF_LDX+BPF_W+BPF_LEN X <- len 504BPF_LDX+BPF_B+BPF_MSH X <- 4*(P[k:1]&0xf) 505.Ed 506.It Dv BPF_ST 507This instruction stores the accumulator into the scratch memory. 508We do not need an addressing mode since there is only one possibility 509for the destination. 510.Pp 511.Bd -literal 512BPF_ST M[k] <- A 513.Ed 514.It Dv BPF_STX 515This instruction stores the index register in the scratch memory store. 516.Pp 517.Bd -literal 518BPF_STX M[k] <- X 519.Ed 520.It Dv BPF_ALU 521The alu instructions perform operations between the accumulator and 522index register or constant, and store the result back in the accumulator. 523For binary operations, a source mode is required 524.Dv ( BPF_K 525or 526.Dv BPF_X ) . 527.Pp 528.Bd -literal 529BPF_ALU+BPF_ADD+BPF_K A <- A + k 530BPF_ALU+BPF_SUB+BPF_K A <- A - k 531BPF_ALU+BPF_MUL+BPF_K A <- A * k 532BPF_ALU+BPF_DIV+BPF_K A <- A / k 533BPF_ALU+BPF_AND+BPF_K A <- A & k 534BPF_ALU+BPF_OR+BPF_K A <- A | k 535BPF_ALU+BPF_LSH+BPF_K A <- A << k 536BPF_ALU+BPF_RSH+BPF_K A <- A >> k 537BPF_ALU+BPF_ADD+BPF_X A <- A + X 538BPF_ALU+BPF_SUB+BPF_X A <- A - X 539BPF_ALU+BPF_MUL+BPF_X A <- A * X 540BPF_ALU+BPF_DIV+BPF_X A <- A / X 541BPF_ALU+BPF_AND+BPF_X A <- A & X 542BPF_ALU+BPF_OR+BPF_X A <- A | X 543BPF_ALU+BPF_LSH+BPF_X A <- A << X 544BPF_ALU+BPF_RSH+BPF_X A <- A >> X 545BPF_ALU+BPF_NEG A <- -A 546.Ed 547.It Dv BPF_JMP 548The jump instructions alter flow of control. 549Conditional jumps 550compare the accumulator against a constant 551.Pq Dv BPF_K 552or the index register 553.Pq Dv BPF_X . 554If the result is true (or non-zero), 555the true branch is taken, otherwise the false branch is taken. 556Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 557However, the jump always 558.Pq Dv BPF_JA 559opcode uses the 32 bit 560.Li k 561field as the offset, allowing arbitrarily distant destinations. 562All conditionals use unsigned comparison conventions. 563.Pp 564.Bd -literal 565BPF_JMP+BPF_JA pc += k 566BPF_JMP+BPF_JGT+BPF_K pc += (A > k) ? jt : jf 567BPF_JMP+BPF_JGE+BPF_K pc += (A >= k) ? jt : jf 568BPF_JMP+BPF_JEQ+BPF_K pc += (A == k) ? jt : jf 569BPF_JMP+BPF_JSET+BPF_K pc += (A & k) ? jt : jf 570BPF_JMP+BPF_JGT+BPF_X pc += (A > X) ? jt : jf 571BPF_JMP+BPF_JGE+BPF_X pc += (A >= X) ? jt : jf 572BPF_JMP+BPF_JEQ+BPF_X pc += (A == X) ? jt : jf 573BPF_JMP+BPF_JSET+BPF_X pc += (A & X) ? jt : jf 574.Ed 575.It Dv BPF_RET 576The return instructions terminate the filter program and specify the amount 577of packet to accept (i.e., they return the truncation amount). 578A return value of zero indicates that the packet should be ignored. 579The return value is either a constant 580.Pq Dv BPF_K 581or the accumulator 582.Pq Dv BPF_A . 583.Pp 584.Bd -literal 585BPF_RET+BPF_A accept A bytes 586BPF_RET+BPF_K accept k bytes 587.Ed 588.It Dv BPF_MISC 589The miscellaneous category was created for anything that doesn't 590fit into the above classes, and for any new instructions that might need to 591be added. 592Currently, these are the register transfer instructions 593that copy the index register to the accumulator or vice versa. 594.Pp 595.Bd -literal 596BPF_MISC+BPF_TAX X <- A 597BPF_MISC+BPF_TXA A <- X 598.Ed 599.El 600.Pp 601The 602.Nm 603interface provides the following macros to facilitate 604array initializers: 605.Fn BPF_STMT opcode operand 606and 607.Fn BPF_JUMP opcode operand true_offset false_offset . 608.Sh EXAMPLES 609The following filter is taken from the Reverse ARP Daemon. 610It accepts only Reverse ARP requests. 611.Bd -literal 612struct bpf_insn insns[] = { 613 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 614 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 615 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 616 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 617 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 618 sizeof(struct ether_header)), 619 BPF_STMT(BPF_RET+BPF_K, 0), 620}; 621.Ed 622.Pp 623This filter accepts only IP packets between host 128.3.112.15 and 624128.3.112.35. 625.Bd -literal 626struct bpf_insn insns[] = { 627 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 628 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 629 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 26), 630 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 631 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 632 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 633 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 634 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 635 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 636 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 637 BPF_STMT(BPF_RET+BPF_K, 0), 638}; 639.Ed 640.Pp 641Finally, this filter returns only TCP finger packets. 642We must parse the IP header to reach the TCP header. 643The 644.Dv BPF_JSET 645instruction 646checks that the IP fragment offset is 0 so we are sure 647that we have a TCP header. 648.Bd -literal 649struct bpf_insn insns[] = { 650 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 651 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 652 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 653 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 654 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 655 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 656 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 657 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 658 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 659 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 660 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 661 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 662 BPF_STMT(BPF_RET+BPF_K, 0), 663}; 664.Ed 665.Sh SEE ALSO 666.Xr tcpdump 1 , 667.Xr ioctl 2 , 668.Xr byteorder 3 , 669.Xr ng_bpf 4 , 670.Xr bpf 9 671.Rs 672.%A McCanne, S. 673.%A Jacobson V. 674.%T "An efficient, extensible, and portable network monitor" 675.Re 676.Sh FILES 677.Bl -tag -compact -width /dev/bpfXXX 678.It Pa /dev/bpf Ns Sy n 679the packet filter device 680.El 681.Sh BUGS 682The read buffer must be of a fixed size (returned by the 683.Dv BIOCGBLEN 684ioctl). 685.Pp 686A file that does not request promiscuous mode may receive promiscuously 687received packets as a side effect of another file requesting this 688mode on the same hardware interface. 689This could be fixed in the kernel with additional processing overhead. 690However, we favor the model where 691all files must assume that the interface is promiscuous, and if 692so desired, must utilize a filter to reject foreign packets. 693.Pp 694Data link protocols with variable length headers are not currently supported. 695.Pp 696The 697.Dv SEESENT 698flag has been observed to work incorrectly on some interface 699types, including those with hardware loopback rather than software loopback, 700and point-to-point interfaces. 701It appears to function correctly on a 702broad range of ethernet-style interfaces. 703.Sh HISTORY 704The Enet packet filter was created in 1980 by Mike Accetta and 705Rick Rashid at Carnegie-Mellon University. 706Jeffrey Mogul, at 707Stanford, ported the code to 708.Bx 709and continued its development from 7101983 on. 711Since then, it has evolved into the Ultrix Packet Filter at 712.Tn DEC , 713a 714.Tn STREAMS 715.Tn NIT 716module under 717.Tn SunOS 4.1 , 718and 719.Tn BPF . 720.Sh AUTHORS 721.An -nosplit 722.An Steven McCanne , 723of Lawrence Berkeley Laboratory, implemented BPF in 724Summer 1990. 725Much of the design is due to 726.An Van Jacobson . 727