1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $Id$ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd pseudo-device bpfilter 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOSETIF 47ioctl. 48A given interface can be shared be multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50The total number of open 51files is limited to the value given in the kernel configuration; the 52example given in the 53.Sx SYNOPSIS 54above sets the limit to 16. 55.Pp 56A separate device file is required for each minor device. 57If a file is in use, the open will fail and 58.Va errno 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm bpf 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. 67Each descriptor that accepts the packet receives its own copy. 68.Pp 69Reads from these files return the next group of packets 70that have matched the filter. 71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm 74This size is returned by the 75.Dv BIOCGBLEN 76ioctl (see below), and 77can be set with 78.Dv BIOCSBLEN. 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length 83headers. Currently, only Ethernet, 84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm bpf . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm bpf 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP 100links are supported. 101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in <net/bpf.h>. All commands require 105these includes: 106.Bd -literal 107 #include <sys/types.h> 108 #include <sys/time.h> 109 #include <sys/ioctl.h> 110 #include <net/bpf.h> 111.Ed 112.Pp 113Additionally, 114.Dv BIOCGETIF 115and 116.Dv BIOCSETIF 117require 118.Aq Pa net/if.h . 119 120In addition to 121.Dv FIONREAD 122and 123.Dv SIOCGIFADDR , 124the following commands may be applied to any open 125.Nm 126file. 127The (third) argument to 128.Xr ioctl 2 129should be a pointer to the type indicated. 130 131.Bl -tag -width BIOCGRTIMEOUT 132.It Dv BIOCGBLEN 133.Pq Li u_int 134Returns the required buffer length for reads on 135.Nm 136files. 137.It Dv BIOCSBLEN 138.Pq Li u_int 139Sets the buffer length for reads on 140.Nm 141files. The buffer must be set before the file is attached to an interface 142with 143.Dv BIOCSETIF . 144If the requested buffer size cannot be accommodated, the closest 145allowable size will be set and returned in the argument. 146A read call will result in 147.Er EIO 148if it is passed a buffer that is not this size. 149.It Dv BIOCGDLT 150.Pq Li u_int 151Returns the type of the data link layer underlying the attached interface. 152.Er EINVAL 153is returned if no interface has been specified. 154The device types, prefixed with 155.Dq Li DLT_ , 156are defined in 157.Aq Pa net/bpf.h . 158.It Dv BIOCPROMISC 159Forces the interface into promiscuous mode. 160All packets, not just those destined for the local host, are processed. 161Since more than one file can be listening on a given interface, 162a listener that opened its interface non-promiscuously may receive 163packets promiscuously. This problem can be remedied with an 164appropriate filter. 165.It Dv BIOCFLUSH 166Flushes the buffer of incoming packets, 167and resets the statistics that are returned by BIOCGSTATS. 168.It Dv BIOCGETIF 169.Pq Li "struct ifreq" 170Returns the name of the hardware interface that the file is listening on. 171The name is returned in the if_name field of 172the 173.Li ifreq 174structure. 175All other fields are undefined. 176.It Dv BIOCSETIF 177.Pq Li "struct ifreq" 178Sets the hardware interface associate with the file. This 179command must be performed before any packets can be read. 180The device is indicated by name using the 181.Li if_name 182field of the 183.Li ifreq 184structure. 185Additionally, performs the actions of 186.Dv BIOCFLUSH . 187.It Dv BIOCSRTIMEOUT 188.It Dv BIOCGRTIMEOUT 189.Pq Li "struct timeval" 190Set or get the read timeout parameter. 191The argument 192specifies the length of time to wait before timing 193out on a read request. 194This parameter is initialized to zero by 195.Xr open 2 , 196indicating no timeout. 197.It Dv BIOCGSTATS 198.Pq Li "struct bpf_stat" 199Returns the following structure of packet statistics: 200.Bd -literal 201struct bpf_stat { 202 u_int bs_recv; 203 u_int bs_drop; 204}; 205.Ed 206 207The fields are: 208.Bl -hang -offset indent 209.It Li bs_recv 210the number of packets received by the descriptor since opened or reset 211(including any buffered since the last read call); 212and 213.It Li bs_drop 214the number of packets which were accepted by the filter but dropped by the 215kernel because of buffer overflows 216(i.e., the application's reads aren't keeping up with the packet traffic). 217.El 218.It Dv BIOCIMMEDIATE 219.Pq Li u_int 220Enable or disable ``immediate mode'', based on the truth value of the argument. 221When immediate mode is enabled, reads return immediately upon packet 222reception. Otherwise, a read will block until either the kernel buffer 223becomes full or a timeout occurs. 224This is useful for programs like 225.Xr rarpd 8 226which must respond to messages in real time. 227The default for a new file is off. 228.It Dv BIOCSETF 229.Pq Li "struct bpf_program" 230Sets the filter program used by the kernel to discard uninteresting 231packets. An array of instructions and its length is passed in using 232the following structure: 233.Bd -literal 234struct bpf_program { 235 int bf_len; 236 struct bpf_insn *bf_insns; 237}; 238.Ed 239 240The filter program is pointed to by the 241.Li bf_insns 242field while its length in units of 243.Sq Li struct bpf_insn 244is given by the 245.Li bf_len 246field. 247Also, the actions of 248.Dv BIOCFLUSH are performed. 249See section 250.Sx "FILTER MACHINE" 251for an explanation of the filter language. 252.It Dv BIOCVERSION 253.Pq Li "struct bpf_version" 254Returns the major and minor version numbers of the filter language currently 255recognized by the kernel. Before installing a filter, applications must check 256that the current version is compatible with the running kernel. Version 257numbers are compatible if the major numbers match and the application minor 258is less than or equal to the kernel minor. The kernel version number is 259returned in the following structure: 260.Bd -literal 261struct bpf_version { 262 u_short bv_major; 263 u_short bv_minor; 264}; 265.Ed 266 267The current version numbers are given by 268.Dv BPF_MAJOR_VERSION 269and 270.Dv BPF_MINOR_VERSION 271from 272.Aq Pa net/bpf.h . 273An incompatible filter 274may result in undefined behavior (most likely, an error returned by 275.Fn ioctl 276or haphazard packet matching). 277.Sh BPF HEADER 278The following structure is prepended to each packet returned by 279.Xr read 2 : 280.Bd -literal 281struct bpf_hdr { 282 struct timeval bh_tstamp; 283 u_long bh_caplen; 284 u_long bh_datalen; 285 u_short bh_hdrlen; 286}; 287.Ed 288.Pp 289The fields, whose values are stored in host order, and are: 290.Pp 291.Bl -tag -compact -width bh_datalen 292.It Li bh_tstamp 293The time at which the packet was processed by the packet filter. 294.It Li bh_caplen 295The length of the captured portion of the packet. This is the minimum of 296the truncation amount specified by the filter and the length of the packet. 297.It Li bh_datalen 298The length of the packet off the wire. 299This value is independent of the truncation amount specified by the filter. 300.It Li bh_hdrlen 301The length of the 302.Nm 303header, which may not be equal to 304.\" XXX - not really a function call 305.Fn sizeof "struct bpf_hdr" . 306.El 307.Pp 308The 309.Li bh_hdrlen 310field exists to account for 311padding between the header and the link level protocol. 312The purpose here is to guarantee proper alignment of the packet 313data structures, which is required on alignment sensitive 314architectures and improves performance on many other architectures. 315The packet filter insures that the 316.Li bpf_hdr 317and the network layer 318header will be word aligned. Suitable precautions 319must be taken when accessing the link layer protocol fields on alignment 320restricted machines. (This isn't a problem on an Ethernet, since 321the type field is a short falling on an even offset, 322and the addresses are probably accessed in a bytewise fashion). 323.Pp 324Additionally, individual packets are padded so that each starts 325on a word boundary. This requires that an application 326has some knowledge of how to get from packet to packet. 327The macro 328.Dv BPF_WORDALIGN 329is defined in 330.Aq Pa net/bpf.h 331to facilitate 332this process. It rounds up its argument 333to the nearest word aligned value (where a word is 334.Dv BPF_ALIGNMENT 335bytes wide). 336.Pp 337For example, if 338.Sq Li p 339points to the start of a packet, this expression 340will advance it to the next packet: 341.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 342.Pp 343For the alignment mechanisms to work properly, the 344buffer passed to 345.Xr read 2 346must itself be word aligned. 347The 348.Xr malloc 3 349function 350will always return an aligned buffer. 351.Sh FILTER MACHINE 352A filter program is an array of instructions, with all branches forwardly 353directed, terminated by a 354.Em return 355instruction. 356Each instruction performs some action on the pseudo-machine state, 357which consists of an accumulator, index register, scratch memory store, 358and implicit program counter. 359 360The following structure defines the instruction format: 361.Bd -literal 362struct bpf_insn { 363 u_short code; 364 u_char jt; 365 u_char jf; 366 long k; 367}; 368.Ed 369 370The 371.Li k 372field is used in different ways by different instructions, 373and the 374.Li jt 375and 376.Li jf 377fields are used as offsets 378by the branch instructions. 379The opcodes are encoded in a semi-hierarchical fashion. 380There are eight classes of instructions: 381.Dv BPF_LD , 382.Dv BPF_LDX , 383.Dv BPF_ST , 384.Dv BPF_STX , 385.Dv BPF_ALU , 386.Dv BPF_JMP , 387.Dv BPF_RET , 388and 389.Dv BPF_MISC . 390Various other mode and 391operator bits are or'd into the class to give the actual instructions. 392The classes and modes are defined in 393.Aq Pa net/bpf.h . 394 395Below are the semantics for each defined 396.Nm 397instruction. 398We use the convention that A is the accumulator, X is the index register, 399P[] packet data, and M[] scratch memory store. 400P[i:n] gives the data at byte offset ``i'' in the packet, 401interpreted as a word (n=4), 402unsigned halfword (n=2), or unsigned byte (n=1). 403M[i] gives the i'th word in the scratch memory store, which is only 404addressed in word units. The memory store is indexed from 0 to 405.Dv BPF_MEMWORDS 406- 1. 407.Li k , 408.Li jt , 409and 410.Li jf 411are the corresponding fields in the 412instruction definition. ``len'' refers to the length of the packet. 413.Pp 414.Bl -tag -width BPF_STXx -compact 415.It Dv BPF_LD 416These instructions copy a value into the accumulator. The type of the 417source operand is specified by an ``addressing mode'' and can be 418a constant 419.Pq Dv BPF_IMM , 420packet data at a fixed offset 421.Pq Dv BPF_ABS , 422packet data at a variable offset 423.Pq Dv BPF_IND , 424the packet length 425.Pq Dv BPF_LEN , 426or a word in the scratch memory store 427.Pq Dv BPF_MEM . 428For 429.Dv BPF_IND 430and 431.Dv BPF_ABS, 432the data size must be specified as a word 433.Pq Dv BPF_W , 434halfword 435.Pq Dv BPF_H , 436or byte 437.Pq Dv BPF_B . 438The semantics of all the recognized 439.Dv BPF_LD 440instructions follow. 441.Pp 442.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 443.It Li BPF_LD+BPF_W+BPF_ABS 444A <- P[k:4] 445.It Li BPF_LD+BPF_H+BPF_ABS 446A <- P[k:2] 447.It Li BPF_LD+BPF_B+BPF_ABS 448A <- P[k:1] 449.It Li BPF_LD+BPF_W+BPF_IND 450A <- P[X+k:4] 451.It Li BPF_LD+BPF_H+BPF_IND 452A <- P[X+k:2] 453.It Li BPF_LD+BPF_B+BPF_IND 454A <- P[X+k:1] 455.It Li BPF_LD+BPF_W+BPF_LEN 456A <- len 457.It Li BPF_LD+BPF_IMM 458A <- k 459.It Li BPF_LD+BPF_MEM 460A <- M[k] 461.El 462 463.It Dv BPF_LDX 464These instructions load a value into the index register. Note that 465the addressing modes are more restrictive than those of the accumulator loads, 466but they include 467.Dv BPF_MSH , 468a hack for efficiently loading the IP header length. 469 470.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 471.It Li BPF_LDX+BPF_W+BPF_IMM 472X <- k 473.It Li BPF_LDX+BPF_W+BPF_MEM 474X <- M[k] 475.It Li BPF_LDX+BPF_W+BPF_LEN 476X <- len 477.It Li BPF_LDX+BPF_B+BPF_MSH 478X <- 4*(P[k:1]&0xf) 479.El 480 481.It Dv BPF_ST 482This instruction stores the accumulator into the scratch memory. 483We do not need an addressing mode since there is only one possibility 484for the destination. 485 486.Bl -tag -width "BPF_ST" -compact 487.It Li BPF_ST 488M[k] <- A 489.El 490 491.It Dv BPF_STX 492This instruction stores the index register in the scratch memory store. 493 494.Bl -tag -width "BPF_STX" -compact 495.It Li BPF_STX 496M[k] <- X 497.El 498 499.It Dv BPF_ALU 500The alu instructions perform operations between the accumulator and 501index register or constant, and store the result back in the accumulator. 502For binary operations, a source mode is required 503.Po 504.Dv BPF_K 505or 506.Dv BPF_X 507.Pc . 508 509.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 510.It Li BPF_ALU+BPF_ADD+BPF_K 511A <- A + k 512.It Li BPF_ALU+BPF_SUB+BPF_K 513A <- A - k 514.It Li BPF_ALU+BPF_MUL+BPF_K 515A <- A * k 516.It Li BPF_ALU+BPF_DIV+BPF_K 517A <- A / k 518.It Li BPF_ALU+BPF_AND+BPF_K 519A <- A & k 520.It Li BPF_ALU+BPF_OR+BPF_K 521A <- A | k 522.It Li BPF_ALU+BPF_LSH+BPF_K 523A <- A << k 524.It Li BPF_ALU+BPF_RSH+BPF_K 525A <- A >> k 526.It Li BPF_ALU+BPF_ADD+BPF_X 527A <- A + X 528.It Li BPF_ALU+BPF_SUB+BPF_X 529A <- A - X 530.It Li BPF_ALU+BPF_MUL+BPF_X 531A <- A * X 532.It Li BPF_ALU+BPF_DIV+BPF_X 533A <- A / X 534.It Li BPF_ALU+BPF_AND+BPF_X 535A <- A & X 536.It Li BPF_ALU+BPF_OR+BPF_X 537A <- A | X 538.It Li BPF_ALU+BPF_LSH+BPF_X 539A <- A << X 540.It Li BPF_ALU+BPF_RSH+BPF_X 541A <- A >> X 542.It Li BPF_ALU+BPF_NEG 543A <- -A 544.El 545 546.It Dv BPF_JMP 547The jump instructions alter flow of control. Conditional jumps 548compare the accumulator against a constant 549.Pq Dv BPF_K 550or the index register 551.Pq Dv BPF_X . 552If the result is true (or non-zero), 553the true branch is taken, otherwise the false branch is taken. 554Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 555However, the jump always 556.Pq Dv BPF_JA 557opcode uses the 32 bit 558.Li k 559field as the offset, allowing arbitrarily distant destinations. 560All conditionals use unsigned comparison conventions. 561 562.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 563.It Li BPF_JMP+BPF_JA 564pc += k 565.It Li BPF_JMP+BPF_JGT+BPF_K 566pc += (A > k) ? jt : jf 567.It Li BPF_JMP+BPF_JGE+BPF_K 568pc += (A >= k) ? jt : jf 569.It Li BPF_JMP+BPF_JEQ+BPF_K 570pc += (A == k) ? jt : jf 571.It Li BPF_JMP+BPF_JSET+BPF_K 572pc += (A & k) ? jt : jf 573.It Li BPF_JMP+BPF_JGT+BPF_X 574pc += (A > X) ? jt : jf 575.It Li BPF_JMP+BPF_JGE+BPF_X 576pc += (A >= X) ? jt : jf 577.It Li BPF_JMP+BPF_JEQ+BPF_X 578pc += (A == X) ? jt : jf 579.It Li BPF_JMP+BPF_JSET+BPF_X 580pc += (A & X) ? jt : jf 581.El 582 583.It Dv BPF_RET 584The return instructions terminate the filter program and specify the amount 585of packet to accept (i.e., they return the truncation amount). A return 586value of zero indicates that the packet should be ignored. 587The return value is either a constant 588.Pq Dv BPF_K 589or the accumulator 590.Pq Dv BPF_A . 591 592.Bl -tag -width "BPF_RET+BPF_K" -compact 593.It Li BPF_RET+BPF_A 594accept A bytes 595.It Li BPF_RET+BPF_K 596accept k bytes 597.El 598 599.It Dv BPF_MISC 600The miscellaneous category was created for anything that doesn't 601fit into the above classes, and for any new instructions that might need to 602be added. Currently, these are the register transfer instructions 603that copy the index register to the accumulator or vice versa. 604 605.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 606.It Li BPF_MISC+BPF_TAX 607X <- A 608.It Li BPF_MISC+BPF_TXA 609A <- X 610.El 611.Pp 612The 613.Nm 614interface provides the following macros to facilitate 615array initializers: 616.Fn BPF_STMT opcode operand 617and 618.Fn BPF_JUMP opcode operand true_offset false_offset . 619.Pp 620.Sh EXAMPLES 621The following filter is taken from the Reverse ARP Daemon. It accepts 622only Reverse ARP requests. 623.Bd -literal 624struct bpf_insn insns[] = { 625 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 626 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 627 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 628 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 629 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 630 sizeof(struct ether_header)), 631 BPF_STMT(BPF_RET+BPF_K, 0), 632}; 633.Ed 634.Pp 635This filter accepts only IP packets between host 128.3.112.15 and 636128.3.112.35. 637.Bd -literal 638struct bpf_insn insns[] = { 639 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 640 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 641 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 26), 642 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 643 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 644 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 645 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 646 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 30), 647 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 648 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 649 BPF_STMT(BPF_RET+BPF_K, 0), 650}; 651.Ed 652.Pp 653Finally, this filter returns only TCP finger packets. We must parse 654the IP header to reach the TCP header. The 655.Dv BPF_JSET 656instruction 657checks that the IP fragment offset is 0 so we are sure 658that we have a TCP header. 659.Bd -literal 660struct bpf_insn insns[] = { 661 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 662 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 663 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 664 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 665 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 666 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 667 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 668 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 669 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 670 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 671 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 672 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 673 BPF_STMT(BPF_RET+BPF_K, 0), 674}; 675.Ed 676.Sh SEE ALSO 677.Xr tcpdump 1 , 678.Xr ioctl 2 679.Rs 680.%A McCanne, S. 681.%A Jacobson V. 682.%T "An efficient, extensible, and portable network monitor" 683.Re 684.Sh FILES 685.Bl -tag -compact -width /dev/bpfXXX 686.It Pa /dev/bpf Ns Sy n 687the packet filter device 688.El 689.Sh BUGS 690The read buffer must be of a fixed size (returned by the 691.Dv BIOCGBLEN 692ioctl). 693.Pp 694A file that does not request promiscuous mode may receive promiscuously 695received packets as a side effect of another file requesting this 696mode on the same hardware interface. This could be fixed in the kernel 697with additional processing overhead. However, we favor the model where 698all files must assume that the interface is promiscuous, and if 699so desired, must utilize a filter to reject foreign packets. 700.Pp 701Data link protocols with variable length headers are not currently supported. 702.Sh HISTORY 703.Pp 704The Enet packet filter was created in 1980 by Mike Accetta and 705Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 706Stanford, ported the code to BSD and continued its development from 7071983 on. Since then, it has evolved into the Ultrix Packet Filter 708at 709.Tn DEC , 710a 711.Tn STREAMS 712.Tn NIT 713module under 714.Tn SunOS 4.1 , 715and 716.Tn BPF . 717.Sh AUTHORS 718.Pp 719Steven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in 720Summer 1990. Much of the design is due to Van Jacobson. 721