1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials 9.\" provided with the distribution, and (3) all advertising materials mentioning 10.\" features or use of this software display the following acknowledgement: 11.\" ``This product includes software developed by the University of California, 12.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13.\" the University nor the names of its contributors may be used to endorse 14.\" or promote products derived from this software without specific prior 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" 23.\" $FreeBSD: src/share/man/man4/bpf.4,v 1.21.2.10 2001/08/17 13:08:37 ru Exp $ 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS 32.Cd pseudo-device bpf 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, 41.Pa /dev/bpf0 , 42.Pa /dev/bpf1 , 43etc. 44After opening the device, the file descriptor must be bound to a 45specific network interface with the 46.Dv BIOCSETIF 47ioctl. 48A given interface can be shared by multiple listeners, and the filter 49underlying each descriptor will see an identical packet stream. 50.Pp 51A separate device file is required for each minor device. 52If a file is in use, the open will fail and 53.Va errno 54will be set to 55.Er EBUSY . 56.Pp 57Associated with each open instance of a 58.Nm 59file is a user-settable packet filter. 60Whenever a packet is received by an interface, 61all file descriptors listening on that interface apply their filter. 62Each descriptor that accepts the packet receives its own copy. 63.Pp 64Reads from these files return the next group of packets 65that have matched the filter. 66To improve performance, the buffer passed to read must be 67the same size as the buffers used internally by 68.Nm . 69This size is returned by the 70.Dv BIOCGBLEN 71ioctl (see below), and 72can be set with 73.Dv BIOCSBLEN . 74Note that an individual packet larger than this size is necessarily 75truncated. 76.Pp 77A packet can be sent out on the network by writing to a 78.Nm 79file descriptor. 80The writes are unbuffered, meaning only one packet can be processed per write. 81Currently, only writes to Ethernets and 82.Tn SLIP 83links are supported. 84.Pp 85When the last minor device is opened, an additional minor device is 86created on demand. 87The maximum number of devices that can be created is controlled by the 88sysctl debug.bpf_maxdevices. 89.Sh IOCTLS 90The 91.Xr ioctl 2 92command codes below are defined in 93.Aq Pa net/bpf.h . 94All commands require 95these includes: 96.Bd -literal 97 #include <sys/types.h> 98 #include <sys/time.h> 99 #include <sys/ioctl.h> 100 #include <net/bpf.h> 101.Ed 102.Pp 103Additionally, 104.Dv BIOCGETIF 105and 106.Dv BIOCSETIF 107require 108.Aq Pa sys/socket.h 109and 110.Aq Pa net/if.h . 111.Pp 112The (third) argument to 113.Xr ioctl 2 114should be a pointer to the type indicated. 115.Bl -tag -width BIOCGRTIMEOUT 116.It Dv BIOCGBLEN 117.Pq Li u_int 118Returns the required buffer length for reads on 119.Nm 120files. 121.It Dv BIOCSBLEN 122.Pq Li u_int 123Sets the buffer length for reads on 124.Nm 125files. 126The buffer must be set before the file is attached to an interface with 127.Dv BIOCSETIF . 128If the requested buffer size cannot be accommodated, the closest 129allowable size will be set and returned in the argument. 130A read call will result in 131.Er EINVAL 132if it is passed a buffer that is not this size. 133.It Dv BIOCGDLT 134.Pq Li u_int 135Returns the type of the data link layer underlying the attached interface. 136.Er EINVAL 137is returned if no interface has been specified. 138The device types, prefixed with 139.Dq Li DLT_ , 140are defined in 141.Aq Pa net/bpf.h . 142.It Dv BIOCGDLTLIST 143.Pq Li "struct bpf_dltlist" 144Returns an array of the available types of the data link layer 145underlying the attached interface: 146.Bd -literal -offset indent 147struct bpf_dltlist { 148 u_int bfl_len; 149 u_int *bfl_list; 150}; 151.Ed 152.Pp 153The available types are returned in the array pointed to by the 154.Va bfl_list 155field while their length in u_int is supplied to the 156.Va bfl_len 157field. 158.Er ENOMEM 159is returned if there is not enough buffer space and 160.Er EFAULT 161is returned if a bad address is encountered. 162The 163.Va bfl_len 164field is modified on return to indicate the actual length in u_int 165of the array returned. 166If 167.Va bfl_list 168is 169.Dv NULL , 170the 171.Va bfl_len 172field is set to indicate the required length of an array in u_int. 173.It Dv BIOCSDLT 174.Pq Li u_int 175Changes the type of the data link layer underlying the attached interface. 176.Er EINVAL 177is returned if no interface has been specified or the specified 178type is not available for the interface. 179.It Dv BIOCPROMISC 180Forces the interface into promiscuous mode. 181All packets, not just those destined for the local host, are processed. 182Since more than one file can be listening on a given interface, 183a listener that opened its interface non-promiscuously may receive 184packets promiscuously. 185This problem can be remedied with an appropriate filter. 186.Pp 187The interface remains in promiscuous mode until all files listening 188promiscuously are closed. 189.It Dv BIOCFLUSH 190Flushes the buffer of incoming packets, 191and resets the statistics that are returned by BIOCGSTATS. 192.It Dv BIOCGETIF 193.Pq Li "struct ifreq" 194Returns the name of the hardware interface that the file is listening on. 195The name is returned in the ifr_name field of 196the 197.Li ifreq 198structure. 199All other fields are undefined. 200.It Dv BIOCSETIF 201.Pq Li "struct ifreq" 202Sets the hardware interface associated with the file. 203This command must be performed before any packets can be read. 204The device is indicated by name using the 205.Li ifr_name 206field of the 207.Li ifreq 208structure. 209Additionally, performs the actions of 210.Dv BIOCFLUSH . 211.It Dv BIOCSRTIMEOUT 212.It Dv BIOCGRTIMEOUT 213.Pq Li "struct timeval" 214Sets or gets the read timeout parameter. 215The argument 216specifies the length of time to wait before timing 217out on a read request. 218This parameter is initialized to zero by 219.Xr open 2 , 220indicating no timeout. 221.It Dv BIOCGSTATS 222.Pq Li "struct bpf_stat" 223Returns the following structure of packet statistics: 224.Bd -literal 225struct bpf_stat { 226 u_int bs_recv; /* number of packets received */ 227 u_int bs_drop; /* number of packets dropped */ 228}; 229.Ed 230.Pp 231The fields are: 232.Bl -hang -offset indent 233.It Li bs_recv 234the number of packets received by the descriptor since opened or reset 235(including any buffered since the last read call); 236and 237.It Li bs_drop 238the number of packets which were accepted by the filter but dropped by the 239kernel because of buffer overflows 240(i.e., the application's reads aren't keeping up with the packet traffic). 241.El 242.It Dv BIOCIMMEDIATE 243.Pq Li u_int 244Enables or disables 245.Dq immediate mode , 246based on the truth value of the argument. 247When immediate mode is enabled, reads return immediately upon packet 248reception. 249Otherwise, a read will block until either the kernel buffer 250becomes full or a timeout occurs. 251This is useful for programs like 252.Xr rarpd 8 253which must respond to messages in real time. 254The default for a new file is off. 255.It Dv BIOCSETF 256.It Dv BIOCSETFNR 257.Pq Li "struct bpf_program" 258Sets the filter program used by the kernel to discard uninteresting 259packets. 260An array of instructions and its length is passed in using the following 261structure: 262.Bd -literal 263struct bpf_program { 264 u_int bf_len; 265 struct bpf_insn *bf_insns; 266}; 267.Ed 268.Pp 269The filter program is pointed to by the 270.Li bf_insns 271field while its length in units of 272.Sq Li struct bpf_insn 273is given by the 274.Li bf_len 275field. 276Also, the actions of 277.Dv BIOCFLUSH 278are performed. 279See section 280.Sx "FILTER MACHINE" 281for an explanation of the filter language. 282The only difference between 283.Dv BIOCSETF 284and 285.Dv BIOCSETFNR 286is 287.Dv BIOCSETF 288performs the actions of 289.Dv BIOCFLUSH 290while 291.Dv BIOCSETFNR 292does not. 293.It Dv BIOCVERSION 294.Pq Li "struct bpf_version" 295Returns the major and minor version numbers of the filter language currently 296recognized by the kernel. 297Before installing a filter, applications must check that the current version 298is compatible with the running kernel. 299Version numbers are compatible if the major numbers match and the application 300minor is less than or equal to the kernel minor. 301The kernel version number is returned in the following structure: 302.Bd -literal 303struct bpf_version { 304 u_short bv_major; 305 u_short bv_minor; 306}; 307.Ed 308.Pp 309The current version numbers are given by 310.Dv BPF_MAJOR_VERSION 311and 312.Dv BPF_MINOR_VERSION 313from 314.Aq Pa net/bpf.h . 315An incompatible filter 316may result in undefined behavior (most likely, an error returned by 317.Fn ioctl 318or haphazard packet matching). 319.It Dv BIOCSHDRCMPLT 320.It Dv BIOCGHDRCMPLT 321.Pq Li u_int 322Sets or gets the status of the 323.Dq header complete 324flag. 325Set to zero if the link level source address should be filled in automatically 326by the interface output routine. 327Set to one if the link level source address will be written, as provided, 328to the wire. 329This flag is initialized to zero by default. 330.It Dv BIOCSSEESENT 331.It Dv BIOCGSEESENT 332.Pq Li u_int 333Sets or gets the flag determining whether locally generated packets on the 334interface should be returned by BPF. 335Set to zero to see only incoming packets on the interface. 336Set to one to see packets originating locally and remotely on the interface. 337This flag is initialized to one by default. 338.It Dv BIOCGRSIG 339.Pq Li u_int 340Returns the signal that will be sent to a process waiting on the bpf descriptor upon packet reception. 341The default is SIGIO. 342.It Dv BIOCSRSIG 343.Pq Li u_int 344Sets the signal that should be sent to a process waiting on bpf descriptor upon packet reception. 345The default is SIGIO. 346.El 347.Sh STANDARD IOCTLS 348.Nm 349now supports several standard 350.Xr ioctl 2 Ns 's 351which allow the user to do non-blocking I/O to an open 352.Nm 353file descriptor. 354.Bl -tag -width SIOCGIFADDR 355.It Dv FIONREAD 356.Pq Li int 357Returns the number of bytes that are immediately available for reading. 358.It Dv SIOCGIFADDR 359.Pq Li "struct ifreq" 360Returns the address associated with the interface. 361.El 362.Sh BPF HEADER 363The following structure is prepended to each packet returned by 364.Xr read 2 : 365.Bd -literal 366struct bpf_hdr { 367 struct BPF_TIMEVAL bh_tstamp; /* time stamp */ 368 bpf_u_int32 bh_caplen; /* length of captured portion */ 369 bpf_u_int32 bh_datalen; /* original length of packet */ 370 u_short bh_hdrlen; /* length of bpf header (this struct 371 plus alignment padding */ 372}; 373.Ed 374.Pp 375The fields, whose values are stored in host order, are: 376.Pp 377.Bl -tag -compact -width bh_datalen 378.It Li bh_tstamp 379The time at which the packet was processed by the packet filter. 380.It Li bh_caplen 381The length of the captured portion of the packet. 382This is the minimum of 383the truncation amount specified by the filter and the length of the packet. 384.It Li bh_datalen 385The length of the packet off the wire. 386This value is independent of the truncation amount specified by the filter. 387.It Li bh_hdrlen 388The length of the 389.Nm 390header, which may not be equal to 391.\" XXX - not really a function call 392.Fn sizeof "struct bpf_hdr" . 393.El 394.Pp 395The 396.Li bh_hdrlen 397field exists to account for 398padding between the header and the link level protocol. 399The purpose here is to guarantee proper alignment of the packet 400data structures, which is required on alignment sensitive 401architectures and improves performance on many other architectures. 402The packet filter insures that the 403.Li bpf_hdr 404and the network layer 405header will be word aligned. 406Suitable precautions 407must be taken when accessing the link layer protocol fields on alignment 408restricted machines. (This isn't a problem on an Ethernet, since 409the type field is a short falling on an even offset, 410and the addresses are probably accessed in a bytewise fashion). 411.Pp 412Additionally, individual packets are padded so that each starts 413on a word boundary. 414This requires that an application 415has some knowledge of how to get from packet to packet. 416The macro 417.Dv BPF_WORDALIGN 418is defined in 419.Aq Pa net/bpf.h 420to facilitate 421this process. 422It rounds up its argument to the nearest word aligned value (where a word is 423.Dv BPF_ALIGNMENT 424bytes wide). 425.Pp 426For example, if 427.Sq Li p 428points to the start of a packet, this expression 429will advance it to the next packet: 430.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 431.Pp 432For the alignment mechanisms to work properly, the 433buffer passed to 434.Xr read 2 435must itself be word aligned. 436The 437.Xr malloc 3 438function 439will always return an aligned buffer. 440.Sh FILTER MACHINE 441A filter program is an array of instructions, with all branches forwardly 442directed, terminated by a 443.Em return 444instruction. 445Each instruction performs some action on the pseudo-machine state, 446which consists of an accumulator, index register, scratch memory store, 447and implicit program counter. 448.Pp 449The following structure defines the instruction format: 450.Bd -literal 451struct bpf_insn { 452 u_short code; 453 u_char jt; 454 u_char jf; 455 bpf_u_int32 k; 456}; 457.Ed 458.Pp 459The 460.Li k 461field is used in different ways by different instructions, 462and the 463.Li jt 464and 465.Li jf 466fields are used as offsets 467by the branch instructions. 468The opcodes are encoded in a semi-hierarchical fashion. 469There are eight classes of instructions: 470.Dv BPF_LD , 471.Dv BPF_LDX , 472.Dv BPF_ST , 473.Dv BPF_STX , 474.Dv BPF_ALU , 475.Dv BPF_JMP , 476.Dv BPF_RET , 477and 478.Dv BPF_MISC . 479Various other mode and 480operator bits are or'd into the class to give the actual instructions. 481The classes and modes are defined in 482.Aq Pa net/bpf.h . 483.Pp 484Below are the semantics for each defined 485.Nm 486instruction. 487We use the convention that A is the accumulator, X is the index register, 488P[] packet data, and M[] scratch memory store. 489P[i:n] gives the data at byte offset 490.Dq i 491in the packet, 492interpreted as a word (n=4), 493unsigned halfword (n=2), or unsigned byte (n=1). 494M[i] gives the i'th word in the scratch memory store, which is only 495addressed in word units. 496The memory store is indexed from 0 to 497.Dv BPF_MEMWORDS 498- 1. 499.Li k , 500.Li jt , 501and 502.Li jf 503are the corresponding fields in the 504instruction definition. 505.Dq len 506refers to the length of the packet. 507.Bl -tag -width BPF_STXx 508.It Dv BPF_LD 509These instructions copy a value into the accumulator. 510The type of the source operand is specified by an 511.Dq addressing mode 512and can be a constant 513.Pq Dv BPF_IMM , 514packet data at a fixed offset 515.Pq Dv BPF_ABS , 516packet data at a variable offset 517.Pq Dv BPF_IND , 518the packet length 519.Pq Dv BPF_LEN , 520or a word in the scratch memory store 521.Pq Dv BPF_MEM . 522For 523.Dv BPF_IND 524and 525.Dv BPF_ABS , 526the data size must be specified as a word 527.Pq Dv BPF_W , 528halfword 529.Pq Dv BPF_H , 530or byte 531.Pq Dv BPF_B . 532The semantics of all the recognized 533.Dv BPF_LD 534instructions follow. 535.Pp 536.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 537.It Li BPF_LD+BPF_W+BPF_ABS 538A <- P[k:4] 539.It Li BPF_LD+BPF_H+BPF_ABS 540A <- P[k:2] 541.It Li BPF_LD+BPF_B+BPF_ABS 542A <- P[k:1] 543.It Li BPF_LD+BPF_W+BPF_IND 544A <- P[X+k:4] 545.It Li BPF_LD+BPF_H+BPF_IND 546A <- P[X+k:2] 547.It Li BPF_LD+BPF_B+BPF_IND 548A <- P[X+k:1] 549.It Li BPF_LD+BPF_W+BPF_LEN 550A <- len 551.It Li BPF_LD+BPF_IMM 552A <- k 553.It Li BPF_LD+BPF_MEM 554A <- M[k] 555.El 556.It Dv BPF_LDX 557These instructions load a value into the index register. 558Note that 559the addressing modes are more restrictive than those of the accumulator loads, 560but they include 561.Dv BPF_MSH , 562a hack for efficiently loading the IP header length. 563.Pp 564.Bl -tag -width "BPF_LDX+BPF_W+BPF_MEM" -compact 565.It Li BPF_LDX+BPF_W+BPF_IMM 566X <- k 567.It Li BPF_LDX+BPF_W+BPF_MEM 568X <- M[k] 569.It Li BPF_LDX+BPF_W+BPF_LEN 570X <- len 571.It Li BPF_LDX+BPF_B+BPF_MSH 572X <- 4*(P[k:1]&0xf) 573.El 574.It Dv BPF_ST 575This instruction stores the accumulator into the scratch memory. 576We do not need an addressing mode since there is only one possibility 577for the destination. 578.Pp 579.Bl -tag -width "BPF_ST" -compact 580.It Li BPF_ST 581M[k] <- A 582.El 583.It Dv BPF_STX 584This instruction stores the index register in the scratch memory store. 585.Pp 586.Bl -tag -width "BPF_STX" -compact 587.It Li BPF_STX 588M[k] <- X 589.El 590.It Dv BPF_ALU 591The alu instructions perform operations between the accumulator and 592index register or constant, and store the result back in the accumulator. 593For binary operations, a source mode is required 594.Dv ( BPF_K 595or 596.Dv BPF_X ) . 597.Pp 598.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 599.It Li BPF_ALU+BPF_ADD+BPF_K 600A <- A + k 601.It Li BPF_ALU+BPF_SUB+BPF_K 602A <- A - k 603.It Li BPF_ALU+BPF_MUL+BPF_K 604A <- A * k 605.It Li BPF_ALU+BPF_DIV+BPF_K 606A <- A / k 607.It Li BPF_ALU+BPF_AND+BPF_K 608A <- A & k 609.It Li BPF_ALU+BPF_OR+BPF_K 610A <- A | k 611.It Li BPF_ALU+BPF_LSH+BPF_K 612A <- A << k 613.It Li BPF_ALU+BPF_RSH+BPF_K 614A <- A >> k 615.It Li BPF_ALU+BPF_ADD+BPF_X 616A <- A + X 617.It Li BPF_ALU+BPF_SUB+BPF_X 618A <- A - X 619.It Li BPF_ALU+BPF_MUL+BPF_X 620A <- A * X 621.It Li BPF_ALU+BPF_DIV+BPF_X 622A <- A / X 623.It Li BPF_ALU+BPF_AND+BPF_X 624A <- A & X 625.It Li BPF_ALU+BPF_OR+BPF_X 626A <- A | X 627.It Li BPF_ALU+BPF_LSH+BPF_X 628A <- A << X 629.It Li BPF_ALU+BPF_RSH+BPF_X 630A <- A >> X 631.It Li BPF_ALU+BPF_NEG 632A <- -A 633.El 634.It Dv BPF_JMP 635The jump instructions alter flow of control. 636Conditional jumps compare the accumulator against a constant 637.Pq Dv BPF_K 638or the index register 639.Pq Dv BPF_X . 640If the result is true (or non-zero), 641the true branch is taken, otherwise the false branch is taken. 642Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 643However, the jump always 644.Pq Dv BPF_JA 645opcode uses the 32 bit 646.Li k 647field as the offset, allowing arbitrarily distant destinations. 648All conditionals use unsigned comparison conventions. 649.Pp 650.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 651.It Li BPF_JMP+BPF_JA 652pc += k 653.It Li BPF_JMP+BPF_JGT+BPF_K 654pc += (A > k) ? jt : jf 655.It Li BPF_JMP+BPF_JGE+BPF_K 656pc += (A >= k) ? jt : jf 657.It Li BPF_JMP+BPF_JEQ+BPF_K 658pc += (A == k) ? jt : jf 659.It Li BPF_JMP+BPF_JSET+BPF_K 660pc += (A & k) ? jt : jf 661.It Li BPF_JMP+BPF_JGT+BPF_X 662pc += (A > X) ? jt : jf 663.It Li BPF_JMP+BPF_JGE+BPF_X 664pc += (A >= X) ? jt : jf 665.It Li BPF_JMP+BPF_JEQ+BPF_X 666pc += (A == X) ? jt : jf 667.It Li BPF_JMP+BPF_JSET+BPF_X 668pc += (A & X) ? jt : jf 669.El 670.It Dv BPF_RET 671The return instructions terminate the filter program and specify the amount 672of packet to accept (i.e., they return the truncation amount). A return 673value of zero indicates that the packet should be ignored. 674The return value is either a constant 675.Pq Dv BPF_K 676or the accumulator 677.Pq Dv BPF_A . 678.Pp 679.Bl -tag -width "BPF_RET+BPF_K" -compact 680.It Li BPF_RET+BPF_A 681accept A bytes 682.It Li BPF_RET+BPF_K 683accept k bytes 684.El 685.It Dv BPF_MISC 686The miscellaneous category was created for anything that doesn't 687fit into the above classes, and for any new instructions that might need to 688be added. 689Currently, these are the register transfer instructions 690that copy the index register to the accumulator or vice versa. 691.Pp 692.Bl -tag -width "BPF_MISC+BPF_TAX" -compact 693.It Li BPF_MISC+BPF_TAX 694X <- A 695.It Li BPF_MISC+BPF_TXA 696A <- X 697.El 698.El 699.Pp 700The 701.Nm 702interface provides the following macros to facilitate 703array initializers: 704.Fn BPF_STMT opcode operand 705and 706.Fn BPF_JUMP opcode operand true_offset false_offset . 707.Sh FILES 708.Bl -tag -compact -width /dev/bpfXXX 709.It Pa /dev/bpf Ns Sy n 710the packet filter device 711.El 712.Sh EXAMPLES 713The following filter is taken from the Reverse ARP Daemon. 714It accepts only Reverse ARP requests. 715.Bd -literal 716struct bpf_insn insns[] = { 717 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 718 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 719 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 720 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), 721 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + 722 sizeof(struct ether_header)), 723 BPF_STMT(BPF_RET+BPF_K, 0), 724}; 725.Ed 726.Pp 727This filter accepts only IP packets between host 128.3.112.15 and 728128.3.112.35. 729.Bd -literal 730struct bpf_insn insns[] = { 731 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 732 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 8), 733 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 26), 734 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 2), 735 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 736 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 3, 4), 737 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x80037023, 0, 3), 738 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 739 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 740 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 741 BPF_STMT(BPF_RET+BPF_K, 0), 742}; 743.Ed 744.Pp 745Finally, this filter returns only TCP finger packets. 746We must parse the IP header to reach the TCP header. 747The 748.Dv BPF_JSET 749instruction 750checks that the IP fragment offset is 0 so we are sure 751that we have a TCP header. 752.Bd -literal 753struct bpf_insn insns[] = { 754 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 755 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), 756 BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 23), 757 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, IPPROTO_TCP, 0, 8), 758 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 759 BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, 0x1fff, 6, 0), 760 BPF_STMT(BPF_LDX+BPF_B+BPF_MSH, 14), 761 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 14), 762 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 2, 0), 763 BPF_STMT(BPF_LD+BPF_H+BPF_IND, 16), 764 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 79, 0, 1), 765 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 766 BPF_STMT(BPF_RET+BPF_K, 0), 767}; 768.Ed 769.Sh SEE ALSO 770.Xr tcpdump 1 , 771.Xr ioctl 2 772.Rs 773.%A McCanne, S. 774.%A Jacobson V. 775.%T "An efficient, extensible, and portable network monitor" 776.Re 777.Sh HISTORY 778The Enet packet filter was created in 1980 by Mike Accetta and 779Rick Rashid at Carnegie-Mellon University. 780Jeffrey Mogul, at Stanford, ported the code to 781.Bx 782and continued its development from 7831983 on. 784Since then, it has evolved into the Ultrix Packet Filter at 785.Tn DEC , 786a 787.Tn STREAMS 788.Tn NIT 789module under 790.Tn SunOS 4.1 , 791and 792.Tn BPF . 793.Sh AUTHORS 794.An -nosplit 795.An Steven McCanne , 796of Lawrence Berkeley Laboratory, implemented BPF in 797Summer 1990. 798Much of the design is due to 799.An Van Jacobson . 800.Sh BUGS 801The read buffer must be of a fixed size (returned by the 802.Dv BIOCGBLEN 803ioctl). 804.Pp 805A file that does not request promiscuous mode may receive promiscuously 806received packets as a side effect of another file requesting this 807mode on the same hardware interface. 808This could be fixed in the kernel 809with additional processing overhead. 810However, we favor the model where 811all files must assume that the interface is promiscuous, and if 812so desired, must utilize a filter to reject foreign packets. 813