1.\" -*- nroff -*- 2.\" 3.\" $NetBSD: bpf.4,v 1.37 2006/02/04 02:20:32 rpaulo Exp $ 4.\" 5.\" Copyright (c) 1990, 1991, 1992, 1993, 1994 6.\" The Regents of the University of California. All rights reserved. 7.\" 8.\" Redistribution and use in source and binary forms, with or without 9.\" modification, are permitted provided that: (1) source code distributions 10.\" retain the above copyright notice and this paragraph in its entirety, (2) 11.\" distributions including binary code include the above copyright notice and 12.\" this paragraph in its entirety in the documentation or other materials 13.\" provided with the distribution, and (3) all advertising materials mentioning 14.\" features or use of this software display the following acknowledgement: 15.\" ``This product includes software developed by the University of California, 16.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 17.\" the University nor the names of its contributors may be used to endorse 18.\" or promote products derived from this software without specific prior 19.\" written permission. 20.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 21.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 22.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 23.\" 24.\" This document is derived in part from the enet man page (enet.4) 25.\" distributed with 4.3BSD Unix. 26.\" 27.Dd February 4, 2006 28.Dt BPF 4 29.Os 30.Sh NAME 31.Nm bpf 32.Nd Berkeley Packet Filter raw network interface 33.Sh SYNOPSIS 34.Cd "pseudo-device bpfilter" 35.Sh DESCRIPTION 36The Berkeley Packet Filter 37provides a raw interface to data link layers in a protocol 38independent fashion. 39All packets on the network, even those destined for other hosts, 40are accessible through this mechanism. 41.Pp 42The packet filter appears as a character special device, 43.Pa /dev/bpf . 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOSETIF 47ioctl. 48A given interface can be shared by multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50.Pp 51Associated with each open instance of a 52.Nm 53file is a user-settable packet filter. 54Whenever a packet is received by an interface, 55all file descriptors listening on that interface apply their filter. 56Each descriptor that accepts the packet receives its own copy. 57.Pp 58Reads from these files return the next group of packets 59that have matched the filter. 60To improve performance, the buffer passed to read must be 61the same size as the buffers used internally by 62.Nm . 63This size is returned by the 64.Dv BIOCGBLEN 65ioctl (see below), and under 66BSD, can be set with 67.Dv BIOCSBLEN . 68Note that an individual packet larger than this size is necessarily 69truncated. 70.Pp 71The packet filter will support any link level protocol that has fixed length 72headers. Currently, only Ethernet, SLIP and PPP drivers have been 73modified to interact with 74.Nm . 75.Pp 76Since packet data is in network byte order, applications should use the 77.Xr byteorder 3 78macros to extract multi-byte values. 79.Pp 80A packet can be sent out on the network by writing to a 81.Nm 82file descriptor. The writes are unbuffered, meaning only one 83packet can be processed per write. 84Currently, only writes to Ethernets and SLIP links are supported. 85.Sh IOCTLS 86The 87.Xr ioctl 2 88command codes below are defined in 89.Aq Pa net/bpf.h . 90All commands require these includes: 91.Bd -literal -offset indent 92#include \*[Lt]sys/types.h\*[Gt] 93#include \*[Lt]sys/time.h\*[Gt] 94#include \*[Lt]sys/ioctl.h\*[Gt] 95#include \*[Lt]net/bpf.h\*[Gt] 96.Ed 97.Pp 98Additionally, 99.Dv BIOCGETIF 100and 101.Dv BIOCSETIF 102require 103.Pa \*[Lt]net/if.h\*[Gt] . 104.Pp 105The (third) argument to the 106.Xr ioctl 2 107should be a pointer to the type indicated. 108.Bl -tag -width indent -offset indent 109.It Dv "BIOCGBLEN (u_int)" 110Returns the required buffer length for reads on 111.Nm 112files. 113.It Dv "BIOCSBLEN (u_int)" 114Sets the buffer length for reads on 115.Nm 116files. The buffer must be set before the file is attached to an interface 117with 118.Dv BIOCSETIF . 119If the requested buffer size cannot be accommodated, the closest 120allowable size will be set and returned in the argument. 121A read call will result in EIO if it is passed a buffer that is not this size. 122.It Dv BIOCGDLT (u_int) 123Returns the type of the data link layer underlying the attached interface. 124.Er EINVAL 125is returned if no interface has been specified. 126The device types, prefixed with 127.Dq DLT_ , 128are defined in 129.Aq Pa net/bpf.h . 130.It Dv BIOCGDLTLIST (struct bpf_dltlist) 131Returns an array of available type of the data link layer 132underlying the attached interface: 133.Bd -literal -offset indent 134struct bpf_dltlist { 135 u_int bfl_len; 136 u_int *bfl_list; 137}; 138.Ed 139.Pp 140The available type is returned to the array pointed to the 141.Va bfl_list 142field while its length in u_int is supplied to the 143.Va bfl_len 144field. 145.Er ENOMEM 146is returned if there is not enough buffer. The 147.Va bfl_len 148field is modified on return to indicate the actual length in u_int 149of the array returned. 150If 151.Va bfl_list 152is 153.Dv NULL , 154the 155.Va bfl_len 156field is returned to indicate the required length of an array in u_int. 157.It Dv BIOCSDLT (u_int) 158Change the type of the data link layer underlying the attached interface. 159.Er EINVAL 160is returned if no interface has been specified or the specified 161type is not available for the interface. 162.It Dv BIOCPROMISC 163Forces the interface into promiscuous mode. 164All packets, not just those destined for the local host, are processed. 165Since more than one file can be listening on a given interface, 166a listener that opened its interface non-promiscuously may receive 167packets promiscuously. This problem can be remedied with an 168appropriate filter. 169.Pp 170The interface remains in promiscuous mode until all files listening 171promiscuously are closed. 172.It Dv BIOCFLUSH 173Flushes the buffer of incoming packets, 174and resets the statistics that are returned by 175.Dv BIOCGSTATS . 176.It Dv BIOCGETIF (struct ifreq) 177Returns the name of the hardware interface that the file is listening on. 178The name is returned in the ifr_name field of 179.Fa ifr . 180All other fields are undefined. 181.It Dv BIOCSETIF (struct ifreq) 182Sets the hardware interface associate with the file. This 183command must be performed before any packets can be read. 184The device is indicated by name using the 185.Dv ifr_name 186field of the 187.Fa ifreq . 188Additionally, performs the actions of 189.Dv BIOCFLUSH . 190.It Dv BIOCSRTIMEOUT, BIOCGRTIMEOUT (struct timeval) 191Set or get the read timeout parameter. 192The 193.Fa timeval 194specifies the length of time to wait before timing 195out on a read request. 196This parameter is initialized to zero by 197.Xr open 2 , 198indicating no timeout. 199.It Dv BIOCGSTATS (struct bpf_stat) 200Returns the following structure of packet statistics: 201.Bd -literal -offset indent 202struct bpf_stat { 203 uint64_t bs_recv; 204 uint64_t bs_drop; 205 uint64_t bs_capt; 206 uint64_t bs_padding[13]; 207}; 208.Ed 209.Pp 210The fields are: 211.Bl -tag -width bs_recv -offset indent 212.It Va bs_recv 213the number of packets received by the descriptor since opened or reset 214(including any buffered since the last read call); 215.It Va bs_drop 216the number of packets which were accepted by the filter but dropped by the 217kernel because of buffer overflows 218(i.e., the application's reads aren't keeping up with the packet 219traffic); and 220.It Va bs_capt 221the number of packets accepted by the filter. 222.El 223.It Dv BIOCIMMEDIATE (u_int) 224Enable or disable 225.Dq immediate mode , 226based on the truth value of the argument. 227When immediate mode is enabled, reads return immediately upon packet 228reception. Otherwise, a read will block until either the kernel buffer 229becomes full or a timeout occurs. 230This is useful for programs like 231.Xr rarpd 8 , 232which must respond to messages in real time. 233The default for a new file is off. 234.It Dv BIOCSETF (struct bpf_program) 235Sets the filter program used by the kernel to discard uninteresting 236packets. An array of instructions and its length is passed in using 237the following structure: 238.Bd -literal -offset indent 239struct bpf_program { 240 u_int bf_len; 241 struct bpf_insn *bf_insns; 242}; 243.Ed 244.Pp 245The filter program is pointed to by the 246.Va bf_insns 247field while its length in units of 248.Sq struct bpf_insn 249is given by the 250.Va bf_len 251field. 252Also, the actions of 253.Dv BIOCFLUSH 254are performed. 255.Pp 256See section 257.Sy FILTER MACHINE 258for an explanation of the filter language. 259.It Dv BIOCVERSION (struct bpf_version) 260Returns the major and minor version numbers of the filter language currently 261recognized by the kernel. Before installing a filter, applications must check 262that the current version is compatible with the running kernel. Version 263numbers are compatible if the major numbers match and the application minor 264is less than or equal to the kernel minor. The kernel version number is 265returned in the following structure: 266.Bd -literal -offset indent 267struct bpf_version { 268 u_short bv_major; 269 u_short bv_minor; 270}; 271.Ed 272.Pp 273The current version numbers are given by 274.Dv BPF_MAJOR_VERSION 275and 276.Dv BPF_MINOR_VERSION 277from 278.Aq Pa net/bpf.h . 279An incompatible filter 280may result in undefined behavior (most likely, an error returned by 281.Xr ioctl 2 282or haphazard packet matching). 283.It Dv BIOCGHDRCMPLT BIOCSHDRCMPLT (u_int) 284Enable/disable or get the 285.Dq header complete 286flag status. 287If enabled, packets written to the bpf file descriptor will not have 288network layer headers rewritten in the interface output routine. 289By default, the flag is disabled (value is 0). 290.It Dv BIOCGSEESENT BIOCSSEESENT (u_int) 291Enable/disable or get the 292.Dq see sent 293flag status. 294If enabled, packets sent will be passed to the filter. 295By default, the flag is enabled (value is 1). 296.El 297.Sh STANDARD IOCTLS 298.Nm 299now supports several standard 300.Xr ioctl 2 Ns 's 301which allow the user to do async and/or non-blocking I/O to an open 302.I bpf 303file descriptor. 304.Bl -tag -width indent -offset indent 305.It Dv FIONREAD (int) 306Returns the number of bytes that are immediately available for reading. 307.It Dv SIOCGIFADDR (struct ifreq) 308Returns the address associated with the interface. 309.It Dv FIONBIO (int) 310Set or clear non-blocking I/O. If arg is non-zero, then doing a 311.Xr read 2 312when no data is available will return -1 and 313.Va errno 314will be set to 315.Er EAGAIN . 316If arg is zero, non-blocking I/O is disabled. Note: setting this 317overrides the timeout set by 318.Dv BIOCSRTIMEOUT . 319.It Dv FIOASYNC (int) 320Enable or disable async I/O. When enabled (arg is non-zero), the process or 321process group specified by FIOSETOWN will start receiving SIGIO's when packets 322arrive. 323Note that you must do an FIOSETOWN in order for this to take affect, as 324the system will not default this for you. 325The signal may be changed via 326.Dv BIOCSRSIG . 327.It Dv FIOSETOWN FIOGETOWN (int) 328Set or get the process or process group (if negative) that should receive SIGIO 329when packets are available. 330The signal may be changed using 331.Dv BIOCSRSIG 332(see above). 333.El 334.Sh BPF HEADER 335The following structure is prepended to each packet returned by 336.Xr read 2 : 337.Bd -literal -offset indent 338struct bpf_hdr { 339 struct timeval bh_tstamp; 340 uint32_t bh_caplen; 341 uint32_t bh_datalen; 342 uint16_t bh_hdrlen; 343}; 344.Ed 345.Pp 346The fields, whose values are stored in host order, and are: 347.Bl -tag -width bh_datalen -offset indent 348.It Va bh_tstamp 349The time at which the packet was processed by the packet filter. 350.It Va bh_caplen 351The length of the captured portion of the packet. This is the minimum of 352the truncation amount specified by the filter and the length of the packet. 353.It Va bh_datalen 354The length of the packet off the wire. 355This value is independent of the truncation amount specified by the filter. 356.It Va bh_hdrlen 357The length of the BPF header, which may not be equal to 358.Em sizeof(struct bpf_hdr) . 359.El 360.Pp 361The 362.Va bh_hdrlen 363field exists to account for 364padding between the header and the link level protocol. 365The purpose here is to guarantee proper alignment of the packet 366data structures, which is required on alignment sensitive 367architectures and improves performance on many other architectures. 368The packet filter ensures that the 369.Va bpf_hdr 370and the 371.Em network layer 372header will be word aligned. Suitable precautions 373must be taken when accessing the link layer protocol fields on alignment 374restricted machines. (This isn't a problem on an Ethernet, since 375the type field is a short falling on an even offset, 376and the addresses are probably accessed in a bytewise fashion). 377.Pp 378Additionally, individual packets are padded so that each starts 379on a word boundary. This requires that an application 380has some knowledge of how to get from packet to packet. 381The macro 382.Dv BPF_WORDALIGN 383is defined in 384.Aq Pa net/bpf.h 385to facilitate this process. 386It rounds up its argument 387to the nearest word aligned value (where a word is BPF_ALIGNMENT bytes wide). 388.Pp 389For example, if 390.Sq Va p 391points to the start of a packet, this expression 392will advance it to the next packet: 393.Pp 394.Dl p = (char *)p + BPF_WORDALIGN(p-\*[Gt]bh_hdrlen + p-\*[Gt]bh_caplen) 395.Pp 396For the alignment mechanisms to work properly, the 397buffer passed to 398.Xr read 2 399must itself be word aligned. 400.Xr malloc 3 401will always return an aligned buffer. 402.Sh FILTER MACHINE 403A filter program is an array of instructions, with all branches forwardly 404directed, terminated by a 405.Sy return 406instruction. 407Each instruction performs some action on the pseudo-machine state, 408which consists of an accumulator, index register, scratch memory store, 409and implicit program counter. 410.Pp 411The following structure defines the instruction format: 412.Bd -literal -offset indent 413struct bpf_insn { 414 uint16_t code; 415 u_char jt; 416 u_char jf; 417 int32_t k; 418}; 419.Ed 420.Pp 421The 422.Va k 423field is used in different ways by different instructions, 424and the 425.Va jt 426and 427.Va jf 428fields are used as offsets 429by the branch instructions. 430The opcodes are encoded in a semi-hierarchical fashion. 431There are eight classes of instructions: BPF_LD, BPF_LDX, BPF_ST, BPF_STX, 432BPF_ALU, BPF_JMP, BPF_RET, and BPF_MISC. Various other mode and 433operator bits are or'd into the class to give the actual instructions. 434The classes and modes are defined in 435.Aq Pa net/bpf.h . 436.Pp 437Below are the semantics for each defined BPF instruction. 438We use the convention that A is the accumulator, X is the index register, 439P[] packet data, and M[] scratch memory store. 440P[i:n] gives the data at byte offset 441.Dq i 442in the packet, 443interpreted as a word (n=4), 444unsigned halfword (n=2), or unsigned byte (n=1). 445M[i] gives the i'th word in the scratch memory store, which is only 446addressed in word units. The memory store is indexed from 0 to BPF_MEMWORDS-1. 447.Va k , 448.Va jt , 449and 450.Va jf 451are the corresponding fields in the 452instruction definition. 453.Dq len 454refers to the length of the packet. 455.Bl -tag -width indent -offset indent 456.It Sy BPF_LD 457These instructions copy a value into the accumulator. The type of the 458source operand is specified by an 459.Dq addressing mode 460and can be a constant 461.Sy ( BBPF_IMM ) , 462packet data at a fixed offset 463.Sy ( BPF_ABS ) , 464packet data at a variable offset 465.Sy ( BPF_IND ) , 466the packet length 467.Sy ( BPF_LEN ) , 468or a word in the scratch memory store 469.Sy ( BPF_MEM ) . 470For 471.Sy BPF_IND 472and 473.Sy BPF_ABS , 474the data size must be specified as a word 475.Sy ( BPF_W ) , 476halfword 477.Sy ( BPF_H ) , 478or byte 479.Sy ( BPF_B ) . 480The semantics of all the recognized BPF_LD instructions follow. 481.Bl -column "BPF_LD_BPF_W_BPF_ABS" "A \*[Lt]- P[k:4]" -offset indent 482.It Sy BPF_LD+BPF_W+BPF_ABS Ta A \*[Lt]- P[k:4] 483.It Sy BPF_LD+BPF_H+BPF_ABS Ta A \*[Lt]- P[k:2] 484.It Sy BPF_LD+BPF_B+BPF_ABS Ta A \*[Lt]- P[k:1] 485.It Sy BPF_LD+BPF_W+BPF_IND Ta A \*[Lt]- P[X+k:4] 486.It Sy BPF_LD+BPF_H+BPF_IND Ta A \*[Lt]- P[X+k:2] 487.It Sy BPF_LD+BPF_B+BPF_IND Ta A \*[Lt]- P[X+k:1] 488.It Sy BPF_LD+BPF_W+BPF_LEN Ta A \*[Lt]- len 489.It Sy BPF_LD+BPF_IMM Ta A \*[Lt]- k 490.It Sy BPF_LD+BPF_MEM Ta A \*[Lt]- M[k] 491.El 492.It Sy BPF_LDX 493These instructions load a value into the index register. Note that 494the addressing modes are more restricted than those of the accumulator loads, 495but they include 496.Sy BPF_MSH , 497a hack for efficiently loading the IP header length. 498.Bl -column "BPF_LDX_BPF_W_BPF_IMM" "X \*[Lt]- k" -offset indent 499.It Sy BPF_LDX+BPF_W+BPF_IMM Ta X \*[Lt]- k 500.It Sy BPF_LDX+BPF_W+BPF_MEM Ta X \*[Lt]- M[k] 501.It Sy BPF_LDX+BPF_W+BPF_LEN Ta X \*[Lt]- len 502.It Sy BPF_LDX+BPF_B+BPF_MSH Ta X \*[Lt]- 4*(P[k:1]\*[Am]0xf) 503.El 504.It Sy BPF_ST 505This instruction stores the accumulator into the scratch memory. 506We do not need an addressing mode since there is only one possibility 507for the destination. 508.Bl -column "BPF_ST" "M[k] \*[Lt]- A" -offset indent 509.It Sy BPF_ST Ta M[k] \*[Lt]- A 510.El 511.It Sy BPF_STX 512This instruction stores the index register in the scratch memory store. 513.Bl -column "BPF_STX" "M[k] \*[Lt]- X" -offset indent 514.It Sy BPF_STX Ta M[k] \*[Lt]- X 515.El 516.It Sy BPF_ALU 517The alu instructions perform operations between the accumulator and 518index register or constant, and store the result back in the accumulator. 519For binary operations, a source mode is required 520.Sy ( BPF_K 521or 522.Sy BPF_X ) . 523.Bl -column "BPF_ALU_BPF_ADD_BPF_K" "A \*[Lt]- A + k" -offset indent 524.It Sy BPF_ALU+BPF_ADD+BPF_K Ta A \*[Lt]- A + k 525.It Sy BPF_ALU+BPF_SUB+BPF_K Ta A \*[Lt]- A - k 526.It Sy BPF_ALU+BPF_MUL+BPF_K Ta A \*[Lt]- A * k 527.It Sy BPF_ALU+BPF_DIV+BPF_K Ta A \*[Lt]- A / k 528.It Sy BPF_ALU+BPF_AND+BPF_K Ta A \*[Lt]- A \*[Am] k 529.It Sy BPF_ALU+BPF_OR+BPF_K Ta A \*[Lt]- A | k 530.It Sy BPF_ALU+BPF_LSH+BPF_K Ta A \*[Lt]- A \*[Lt]\*[Lt] k 531.It Sy BPF_ALU+BPF_RSH+BPF_K Ta A \*[Lt]- A \*[Gt]\*[Gt] k 532.It Sy BPF_ALU+BPF_ADD+BPF_X Ta A \*[Lt]- A + X 533.It Sy BPF_ALU+BPF_SUB+BPF_X Ta A \*[Lt]- A - X 534.It Sy BPF_ALU+BPF_MUL+BPF_X Ta A \*[Lt]- A * X 535.It Sy BPF_ALU+BPF_DIV+BPF_X Ta A \*[Lt]- A / X 536.It Sy BPF_ALU+BPF_AND+BPF_X Ta A \*[Lt]- A \*[Am] X 537.It Sy BPF_ALU+BPF_OR+BPF_X Ta A \*[Lt]- A | X 538.It Sy BPF_ALU+BPF_LSH+BPF_X Ta A \*[Lt]- A \*[Lt]\*[Lt] X 539.It Sy BPF_ALU+BPF_RSH+BPF_X Ta A \*[Lt]- A \*[Gt]\*[Gt] X 540.It Sy BPF_ALU+BPF_NEG Ta A \*[Lt]- -A 541.El 542.It Sy BPF_JMP 543The jump instructions alter flow of control. Conditional jumps 544compare the accumulator against a constant 545.Sy ( BPF_K ) 546or the index register 547.Sy ( BPF_X ) . 548If the result is true (or non-zero), 549the true branch is taken, otherwise the false branch is taken. 550Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 551However, the jump always 552.Sy ( BPF_JA ) 553opcode uses the 32 bit 554.Va k 555field as the offset, allowing arbitrarily distant destinations. 556All conditionals use unsigned comparison conventions. 557.Bl -column "BPF_JMP+BPF_JGE+BPF_K" "pc += (A \*[Ge] k) ? jt : jf" -offset indent 558.It Sy BPF_JMP+BPF_JA Ta pc += k 559.It Sy BPF_JMP+BPF_JGT+BPF_K Ta "pc += (A \*[Gt] k) ? jt : jf" 560.It Sy BPF_JMP+BPF_JGE+BPF_K Ta "pc += (A \*[Ge] k) ? jt : jf" 561.It Sy BPF_JMP+BPF_JEQ+BPF_K Ta "pc += (A == k) ? jt : jf" 562.It Sy BPF_JMP+BPF_JSET+BPF_K Ta "pc += (A \*[Am] k) ? jt : jf" 563.It Sy BPF_JMP+BPF_JGT+BPF_X Ta "pc += (A \*[Gt] X) ? jt : jf" 564.It Sy BPF_JMP+BPF_JGE+BPF_X Ta "pc += (A \*[Ge] X) ? jt : jf" 565.It Sy BPF_JMP+BPF_JEQ+BPF_X Ta "pc += (A == X) ? jt : jf" 566.It Sy BPF_JMP+BPF_JSET+BPF_X Ta "pc += (A \*[Am] X) ? jt : jf" 567.El 568.It Sy BPF_RET 569The return instructions terminate the filter program and specify the amount 570of packet to accept (i.e., they return the truncation amount). A return 571value of zero indicates that the packet should be ignored. 572The return value is either a constant 573.Sy ( BPF_K ) 574or the accumulator 575.Sy ( BPF_A ) . 576.Bl -column "BPF_RET+BPF_A" "accept A bytes" -offset indent 577.It Sy BPF_RET+BPF_A Ta accept A bytes 578.It Sy BPF_RET+BPF_K Ta accept k bytes 579.El 580.It Sy BPF_MISC 581The miscellaneous category was created for anything that doesn't 582fit into the above classes, and for any new instructions that might need to 583be added. Currently, these are the register transfer instructions 584that copy the index register to the accumulator or vice versa. 585.Bl -column "BPF_MISC+BPF_TAX" "X \*[Lt]- A" -offset indent 586.It Sy BPF_MISC+BPF_TAX Ta X \*[Lt]- A 587.It Sy BPF_MISC+BPF_TXA Ta A \*[Lt]- X 588.El 589.El 590.Pp 591The BPF interface provides the following macros to facilitate 592array initializers: 593.Bd -unfilled -offset indent 594.Sy BPF_STMT No (opcode, operand) 595.Sy BPF_JUMP No (opcode, operand, true_offset, false_offset) 596.Ed 597.Sh SYSCTLS 598The following sysctls are available when 599.Nm 600is enabled: 601.Pp 602.Bl -tag -width "XnetXbpfXmaxbufsizeXX" 603.It Li net.bpf.maxbufsize 604Sets the maximum buffer size available for 605.Nm 606peers. 607.It Li net.bpf.stats 608Shows 609.Nm 610statistics. 611They can be retrieved with the 612.Xr netstat 1 613utility. 614.It Li net.bpf.peers 615Shows the current 616.Nm 617peers. 618This is only available to the super user and can also be retrieved with the 619.Xr netstat 1 620utility. 621.El 622.Sh FILES 623.Pa /dev/bpf 624.Sh EXAMPLES 625The following filter is taken from the Reverse ARP Daemon. It accepts 626only Reverse ARP requests. 627.Bd -literal -offset indent 628struct bpf_insn insns[] = { 629 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 630 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 631 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 632 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 633 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 634 sizeof(struct ether_header)), 635 BPF_STMT(BPF_RET+BPF_K, 0), 636}; 637.Ed 638.Pp 639This filter accepts only IP packets between host 128.3.112.15 and 640128.3.112.35. 641.Bd -literal -offset indent 642struct bpf_insn insns[] = { 643 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 644 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 645 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 26), 646 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 647 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 648 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 649 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 650 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 651 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 652 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 653 BPF_STMT(BPF_RET+BPF_K, 0), 654}; 655.Ed 656.Pp 657Finally, this filter returns only TCP finger packets. We must parse 658the IP header to reach the TCP header. The 659.Sy BPF_JSET 660instruction checks that the IP fragment offset is 0 so we are sure 661that we have a TCP header. 662.Bd -literal -offset indent 663struct bpf_insn insns[] = { 664 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 665 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 666 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 667 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 668 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 669 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 670 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 671 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 672 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 673 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 674 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 675 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 676 BPF_STMT(BPF_RET+BPF_K, 0), 677}; 678.Ed 679.Sh SEE ALSO 680.Xr ioctl 2 , 681.Xr read 2 , 682.Xr select 2 , 683.Xr signal 3 , 684.Xr tcpdump 8 685.Rs 686.%T "The BSD Packet Filter: A New Architecture for User-level Packet Capture" 687.%A S. McCanne 688.%A V. Jacobson 689.%J Proceedings of the 1993 Winter USENIX 690.%C Technical Conference, San Diego, CA 691.Re 692.Sh HISTORY 693The Enet packet filter was created in 1980 by Mike Accetta and 694Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at 695Stanford, ported the code to BSD and continued its development from 6961983 on. Since then, it has evolved into the ULTRIX Packet Filter 697at DEC, a STREAMS NIT module under SunOS 4.1, and BPF. 698.Sh AUTHORS 699Steven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in 700Summer 1990. The design was in collaboration with Van Jacobson, 701also of Lawrence Berkeley Laboratory. 702.Sh BUGS 703The read buffer must be of a fixed size (returned by the 704.Dv BIOCGBLEN 705ioctl). 706.Pp 707A file that does not request promiscuous mode may receive promiscuously 708received packets as a side effect of another file requesting this 709mode on the same hardware interface. This could be fixed in the kernel 710with additional processing overhead. However, we favor the model where 711all files must assume that the interface is promiscuous, and if 712so desired, must use a filter to reject foreign packets. 713.Pp 714Data link protocols with variable length headers are not currently supported. 715.Pp 716Under SunOS, if a BPF application reads more than 2^31 bytes of 717data, read will fail in 718.Er EINVAL . 719You can either fix the bug in SunOS, 720or lseek to 0 when read fails for this reason. 721.Pp 722.Dq Immediate mode 723and the 724.Dq read timeout 725are misguided features. 726This functionality can be emulated with non-blocking mode and 727.Xr select 2 . 728