bpf.4 (71895) | bpf.4 (76175) |
---|---|
1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials --- 6 unchanged lines hidden (view full) --- 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" | 1.\" Copyright (c) 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that: (1) source code distributions 6.\" retain the above copyright notice and this paragraph in its entirety, (2) 7.\" distributions including binary code include the above copyright notice and 8.\" this paragraph in its entirety in the documentation or other materials --- 6 unchanged lines hidden (view full) --- 15.\" written permission. 16.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19.\" 20.\" This document is derived in part from the enet man page (enet.4) 21.\" distributed with 4.3BSD Unix. 22.\" |
23.\" $FreeBSD: head/share/man/man4/bpf.4 71895 2001-02-01 16:38:02Z ru $ | 23.\" $FreeBSD: head/share/man/man4/bpf.4 76175 2001-05-01 09:15:30Z schweikh $ |
24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS | 24.\" 25.Dd January 16, 1996 26.Dt BPF 4 27.Os BSD 4.4 28.Sh NAME 29.Nm bpf 30.Nd Berkeley Packet Filter 31.Sh SYNOPSIS |
32.Cd pseudo-device bpf | 32.Cd device bpf |
33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, --- 18 unchanged lines hidden (view full) --- 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. | 33.Sh DESCRIPTION 34The Berkeley Packet Filter 35provides a raw interface to data link layers in a protocol 36independent fashion. 37All packets on the network, even those destined for other hosts, 38are accessible through this mechanism. 39.Pp 40The packet filter appears as a character special device, --- 18 unchanged lines hidden (view full) --- 59will be set to 60.Er EBUSY . 61.Pp 62Associated with each open instance of a 63.Nm 64file is a user-settable packet filter. 65Whenever a packet is received by an interface, 66all file descriptors listening on that interface apply their filter. |
67Each descriptor that accepts the packet receives its own copy. | 67Each descriptor that accepts the packet receives its own copy. |
68.Pp 69Reads from these files return the next group of packets | 68.Pp 69Reads from these files return the next group of packets |
70that have matched the filter. | 70that have matched the filter. |
71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm . 74This size is returned by the 75.Dv BIOCGBLEN | 71To improve performance, the buffer passed to read must be 72the same size as the buffers used internally by 73.Nm . 74This size is returned by the 75.Dv BIOCGBLEN |
76ioctl (see below), and | 76ioctl (see below), and |
77can be set with 78.Dv BIOCSBLEN . 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length | 77can be set with 78.Dv BIOCSBLEN . 79Note that an individual packet larger than this size is necessarily 80truncated. 81.Pp 82The packet filter will support any link level protocol that has fixed length |
83headers. Currently, only Ethernet, | 83headers. Currently, only Ethernet, |
84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP | 84.Tn SLIP , 85and 86.Tn PPP 87drivers have been modified to interact with 88.Nm . 89.Pp 90Since packet data is in network byte order, applications should use the 91.Xr byteorder 3 92macros to extract multi-byte values. 93.Pp 94A packet can be sent out on the network by writing to a 95.Nm 96file descriptor. The writes are unbuffered, meaning only one 97packet can be processed per write. 98Currently, only writes to Ethernets and 99.Tn SLIP |
100links are supported. | 100links are supported. |
101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in 105.Aq Pa net/bpf.h . 106All commands require 107these includes: 108.Bd -literal 109 #include <sys/types.h> 110 #include <sys/time.h> 111 #include <sys/ioctl.h> | 101.Sh IOCTLS 102The 103.Xr ioctl 2 104command codes below are defined in 105.Aq Pa net/bpf.h . 106All commands require 107these includes: 108.Bd -literal 109 #include <sys/types.h> 110 #include <sys/time.h> 111 #include <sys/ioctl.h> |
112 #include <net/bpf.h> | 112 #include |
113.Ed 114.Pp | 113.Ed 114.Pp |
115Additionally, | 115Additionally, |
116.Dv BIOCGETIF 117and 118.Dv BIOCSETIF 119require 120.Aq Pa sys/socket.h 121and 122.Aq Pa net/if.h . 123.Pp --- 17 unchanged lines hidden (view full) --- 141.Pq Li u_int 142Sets the buffer length for reads on 143.Nm 144files. The buffer must be set before the file is attached to an interface 145with 146.Dv BIOCSETIF . 147If the requested buffer size cannot be accommodated, the closest 148allowable size will be set and returned in the argument. | 116.Dv BIOCGETIF 117and 118.Dv BIOCSETIF 119require 120.Aq Pa sys/socket.h 121and 122.Aq Pa net/if.h . 123.Pp --- 17 unchanged lines hidden (view full) --- 141.Pq Li u_int 142Sets the buffer length for reads on 143.Nm 144files. The buffer must be set before the file is attached to an interface 145with 146.Dv BIOCSETIF . 147If the requested buffer size cannot be accommodated, the closest 148allowable size will be set and returned in the argument. |
149A read call will result in | 149A read call will result in |
150.Er EIO 151if it is passed a buffer that is not this size. 152.It Dv BIOCGDLT 153.Pq Li u_int 154Returns the type of the data link layer underlying the attached interface. 155.Er EINVAL 156is returned if no interface has been specified. 157The device types, prefixed with 158.Dq Li DLT_ , 159are defined in 160.Aq Pa net/bpf.h . 161.It Dv BIOCPROMISC 162Forces the interface into promiscuous mode. 163All packets, not just those destined for the local host, are processed. 164Since more than one file can be listening on a given interface, 165a listener that opened its interface non-promiscuously may receive 166packets promiscuously. This problem can be remedied with an | 150.Er EIO 151if it is passed a buffer that is not this size. 152.It Dv BIOCGDLT 153.Pq Li u_int 154Returns the type of the data link layer underlying the attached interface. 155.Er EINVAL 156is returned if no interface has been specified. 157The device types, prefixed with 158.Dq Li DLT_ , 159are defined in 160.Aq Pa net/bpf.h . 161.It Dv BIOCPROMISC 162Forces the interface into promiscuous mode. 163All packets, not just those destined for the local host, are processed. 164Since more than one file can be listening on a given interface, 165a listener that opened its interface non-promiscuously may receive 166packets promiscuously. This problem can be remedied with an |
167appropriate filter. | 167appropriate filter. |
168.It Dv BIOCFLUSH 169Flushes the buffer of incoming packets, 170and resets the statistics that are returned by BIOCGSTATS. 171.It Dv BIOCGETIF 172.Pq Li "struct ifreq" 173Returns the name of the hardware interface that the file is listening on. 174The name is returned in the ifr_name field of 175the --- 4 unchanged lines hidden (view full) --- 180.Pq Li "struct ifreq" 181Sets the hardware interface associate with the file. This 182command must be performed before any packets can be read. 183The device is indicated by name using the 184.Li ifr_name 185field of the 186.Li ifreq 187structure. | 168.It Dv BIOCFLUSH 169Flushes the buffer of incoming packets, 170and resets the statistics that are returned by BIOCGSTATS. 171.It Dv BIOCGETIF 172.Pq Li "struct ifreq" 173Returns the name of the hardware interface that the file is listening on. 174The name is returned in the ifr_name field of 175the --- 4 unchanged lines hidden (view full) --- 180.Pq Li "struct ifreq" 181Sets the hardware interface associate with the file. This 182command must be performed before any packets can be read. 183The device is indicated by name using the 184.Li ifr_name 185field of the 186.Li ifreq 187structure. |
188Additionally, performs the actions of | 188Additionally, performs the actions of |
189.Dv BIOCFLUSH . 190.It Dv BIOCSRTIMEOUT 191.It Dv BIOCGRTIMEOUT 192.Pq Li "struct timeval" 193Set or get the read timeout parameter. 194The argument 195specifies the length of time to wait before timing 196out on a read request. --- 10 unchanged lines hidden (view full) --- 207}; 208.Ed 209.Pp 210The fields are: 211.Bl -hang -offset indent 212.It Li bs_recv 213the number of packets received by the descriptor since opened or reset 214(including any buffered since the last read call); | 189.Dv BIOCFLUSH . 190.It Dv BIOCSRTIMEOUT 191.It Dv BIOCGRTIMEOUT 192.Pq Li "struct timeval" 193Set or get the read timeout parameter. 194The argument 195specifies the length of time to wait before timing 196out on a read request. --- 10 unchanged lines hidden (view full) --- 207}; 208.Ed 209.Pp 210The fields are: 211.Bl -hang -offset indent 212.It Li bs_recv 213the number of packets received by the descriptor since opened or reset 214(including any buffered since the last read call); |
215and | 215and |
216.It Li bs_drop 217the number of packets which were accepted by the filter but dropped by the 218kernel because of buffer overflows 219(i.e., the application's reads aren't keeping up with the packet traffic). 220.El 221.It Dv BIOCIMMEDIATE 222.Pq Li u_int 223Enable or disable 224.Dq immediate mode , 225based on the truth value of the argument. 226When immediate mode is enabled, reads return immediately upon packet 227reception. Otherwise, a read will block until either the kernel buffer 228becomes full or a timeout occurs. 229This is useful for programs like 230.Xr rarpd 8 231which must respond to messages in real time. | 216.It Li bs_drop 217the number of packets which were accepted by the filter but dropped by the 218kernel because of buffer overflows 219(i.e., the application's reads aren't keeping up with the packet traffic). 220.El 221.It Dv BIOCIMMEDIATE 222.Pq Li u_int 223Enable or disable 224.Dq immediate mode , 225based on the truth value of the argument. 226When immediate mode is enabled, reads return immediately upon packet 227reception. Otherwise, a read will block until either the kernel buffer 228becomes full or a timeout occurs. 229This is useful for programs like 230.Xr rarpd 8 231which must respond to messages in real time. |
232The default for a new file is off. | 232The default for a new file is off. |
233.It Dv BIOCSETF 234.Pq Li "struct bpf_program" 235Sets the filter program used by the kernel to discard uninteresting 236packets. An array of instructions and its length is passed in using 237the following structure: 238.Bd -literal 239struct bpf_program { 240 int bf_len; | 233.It Dv BIOCSETF 234.Pq Li "struct bpf_program" 235Sets the filter program used by the kernel to discard uninteresting 236packets. An array of instructions and its length is passed in using 237the following structure: 238.Bd -literal 239struct bpf_program { 240 int bf_len; |
241 struct bpf_insn *bf_insns; | 241 struct bpf_insn *bf_insns; |
242}; 243.Ed 244.Pp 245The filter program is pointed to by the 246.Li bf_insns | 242}; 243.Ed 244.Pp 245The filter program is pointed to by the 246.Li bf_insns |
247field while its length in units of | 247field while its length in units of |
248.Sq Li struct bpf_insn 249is given by the 250.Li bf_len 251field. 252Also, the actions of 253.Dv BIOCFLUSH 254are performed. 255See section --- 70 unchanged lines hidden (view full) --- 326.It Li bh_hdrlen 327The length of the 328.Nm 329header, which may not be equal to 330.\" XXX - not really a function call 331.Fn sizeof "struct bpf_hdr" . 332.El 333.Pp | 248.Sq Li struct bpf_insn 249is given by the 250.Li bf_len 251field. 252Also, the actions of 253.Dv BIOCFLUSH 254are performed. 255See section --- 70 unchanged lines hidden (view full) --- 326.It Li bh_hdrlen 327The length of the 328.Nm 329header, which may not be equal to 330.\" XXX - not really a function call 331.Fn sizeof "struct bpf_hdr" . 332.El 333.Pp |
334The | 334The |
335.Li bh_hdrlen 336field exists to account for 337padding between the header and the link level protocol. 338The purpose here is to guarantee proper alignment of the packet | 335.Li bh_hdrlen 336field exists to account for 337padding between the header and the link level protocol. 338The purpose here is to guarantee proper alignment of the packet |
339data structures, which is required on alignment sensitive | 339data structures, which is required on alignment sensitive |
340architectures and improves performance on many other architectures. | 340architectures and improves performance on many other architectures. |
341The packet filter insures that the | 341The packet filter insures that the |
342.Li bpf_hdr 343and the network layer 344header will be word aligned. Suitable precautions 345must be taken when accessing the link layer protocol fields on alignment 346restricted machines. (This isn't a problem on an Ethernet, since 347the type field is a short falling on an even offset, 348and the addresses are probably accessed in a bytewise fashion). 349.Pp --- 12 unchanged lines hidden (view full) --- 362.Pp 363For example, if 364.Sq Li p 365points to the start of a packet, this expression 366will advance it to the next packet: 367.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 368.Pp 369For the alignment mechanisms to work properly, the | 342.Li bpf_hdr 343and the network layer 344header will be word aligned. Suitable precautions 345must be taken when accessing the link layer protocol fields on alignment 346restricted machines. (This isn't a problem on an Ethernet, since 347the type field is a short falling on an even offset, 348and the addresses are probably accessed in a bytewise fashion). 349.Pp --- 12 unchanged lines hidden (view full) --- 362.Pp 363For example, if 364.Sq Li p 365points to the start of a packet, this expression 366will advance it to the next packet: 367.Dl p = (char *)p + BPF_WORDALIGN(p->bh_hdrlen + p->bh_caplen) 368.Pp 369For the alignment mechanisms to work properly, the |
370buffer passed to | 370buffer passed to |
371.Xr read 2 | 371.Xr read 2 |
372must itself be word aligned. | 372must itself be word aligned. |
373The 374.Xr malloc 3 375function 376will always return an aligned buffer. 377.Sh FILTER MACHINE 378A filter program is an array of instructions, with all branches forwardly | 373The 374.Xr malloc 3 375function 376will always return an aligned buffer. 377.Sh FILTER MACHINE 378A filter program is an array of instructions, with all branches forwardly |
379directed, terminated by a | 379directed, terminated by a |
380.Em return 381instruction. 382Each instruction performs some action on the pseudo-machine state, 383which consists of an accumulator, index register, scratch memory store, 384and implicit program counter. 385.Pp 386The following structure defines the instruction format: 387.Bd -literal 388struct bpf_insn { 389 u_short code; 390 u_char jt; 391 u_char jf; 392 u_long k; 393}; 394.Ed 395.Pp | 380.Em return 381instruction. 382Each instruction performs some action on the pseudo-machine state, 383which consists of an accumulator, index register, scratch memory store, 384and implicit program counter. 385.Pp 386The following structure defines the instruction format: 387.Bd -literal 388struct bpf_insn { 389 u_short code; 390 u_char jt; 391 u_char jf; 392 u_long k; 393}; 394.Ed 395.Pp |
396The | 396The |
397.Li k | 397.Li k |
398field is used in different ways by different instructions, | 398field is used in different ways by different instructions, |
399and the 400.Li jt | 399and the 400.Li jt |
401and | 401and |
402.Li jf 403fields are used as offsets 404by the branch instructions. 405The opcodes are encoded in a semi-hierarchical fashion. | 402.Li jf 403fields are used as offsets 404by the branch instructions. 405The opcodes are encoded in a semi-hierarchical fashion. |
406There are eight classes of instructions: 407.Dv BPF_LD , | 406There are eight classes of instructions: 407.Dv BPF_LD , |
408.Dv BPF_LDX , 409.Dv BPF_ST , 410.Dv BPF_STX , 411.Dv BPF_ALU , 412.Dv BPF_JMP , 413.Dv BPF_RET , 414and 415.Dv BPF_MISC . | 408.Dv BPF_LDX , 409.Dv BPF_ST , 410.Dv BPF_STX , 411.Dv BPF_ALU , 412.Dv BPF_JMP , 413.Dv BPF_RET , 414and 415.Dv BPF_MISC . |
416Various other mode and | 416Various other mode and |
417operator bits are or'd into the class to give the actual instructions. 418The classes and modes are defined in 419.Aq Pa net/bpf.h . 420.Pp 421Below are the semantics for each defined 422.Nm 423instruction. 424We use the convention that A is the accumulator, X is the index register, 425P[] packet data, and M[] scratch memory store. 426P[i:n] gives the data at byte offset 427.Dq i 428in the packet, 429interpreted as a word (n=4), 430unsigned halfword (n=2), or unsigned byte (n=1). 431M[i] gives the i'th word in the scratch memory store, which is only | 417operator bits are or'd into the class to give the actual instructions. 418The classes and modes are defined in 419.Aq Pa net/bpf.h . 420.Pp 421Below are the semantics for each defined 422.Nm 423instruction. 424We use the convention that A is the accumulator, X is the index register, 425P[] packet data, and M[] scratch memory store. 426P[i:n] gives the data at byte offset 427.Dq i 428in the packet, 429interpreted as a word (n=4), 430unsigned halfword (n=2), or unsigned byte (n=1). 431M[i] gives the i'th word in the scratch memory store, which is only |
432addressed in word units. The memory store is indexed from 0 to | 432addressed in word units. The memory store is indexed from 0 to |
433.Dv BPF_MEMWORDS 434- 1. 435.Li k , 436.Li jt , 437and 438.Li jf 439are the corresponding fields in the 440instruction definition. --- 10 unchanged lines hidden (view full) --- 451packet data at a fixed offset 452.Pq Dv BPF_ABS , 453packet data at a variable offset 454.Pq Dv BPF_IND , 455the packet length 456.Pq Dv BPF_LEN , 457or a word in the scratch memory store 458.Pq Dv BPF_MEM . | 433.Dv BPF_MEMWORDS 434- 1. 435.Li k , 436.Li jt , 437and 438.Li jf 439are the corresponding fields in the 440instruction definition. --- 10 unchanged lines hidden (view full) --- 451packet data at a fixed offset 452.Pq Dv BPF_ABS , 453packet data at a variable offset 454.Pq Dv BPF_IND , 455the packet length 456.Pq Dv BPF_LEN , 457or a word in the scratch memory store 458.Pq Dv BPF_MEM . |
459For | 459For |
460.Dv BPF_IND 461and 462.Dv BPF_ABS , 463the data size must be specified as a word 464.Pq Dv BPF_W , 465halfword 466.Pq Dv BPF_H , 467or byte 468.Pq Dv BPF_B . | 460.Dv BPF_IND 461and 462.Dv BPF_ABS , 463the data size must be specified as a word 464.Pq Dv BPF_W , 465halfword 466.Pq Dv BPF_H , 467or byte 468.Pq Dv BPF_B . |
469The semantics of all the recognized | 469The semantics of all the recognized |
470.Dv BPF_LD 471instructions follow. 472.Pp 473.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 474.It Li BPF_LD+BPF_W+BPF_ABS 475A <- P[k:4] 476.It Li BPF_LD+BPF_H+BPF_ABS 477A <- P[k:2] --- 43 unchanged lines hidden (view full) --- 521.Pp 522.Bl -tag -width "BPF_STX" -compact 523.It Li BPF_STX 524M[k] <- X 525.El 526.It Dv BPF_ALU 527The alu instructions perform operations between the accumulator and 528index register or constant, and store the result back in the accumulator. | 470.Dv BPF_LD 471instructions follow. 472.Pp 473.Bl -tag -width "BPF_LD+BPF_W+BPF_IND" -compact 474.It Li BPF_LD+BPF_W+BPF_ABS 475A <- P[k:4] 476.It Li BPF_LD+BPF_H+BPF_ABS 477A <- P[k:2] --- 43 unchanged lines hidden (view full) --- 521.Pp 522.Bl -tag -width "BPF_STX" -compact 523.It Li BPF_STX 524M[k] <- X 525.El 526.It Dv BPF_ALU 527The alu instructions perform operations between the accumulator and 528index register or constant, and store the result back in the accumulator. |
529For binary operations, a source mode is required | 529For binary operations, a source mode is required |
530.Po 531.Dv BPF_K 532or 533.Dv BPF_X 534.Pc . 535.Pp 536.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 537.It Li BPF_ALU+BPF_ADD+BPF_K --- 38 unchanged lines hidden (view full) --- 576or the index register 577.Pq Dv BPF_X . 578If the result is true (or non-zero), 579the true branch is taken, otherwise the false branch is taken. 580Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 581However, the jump always 582.Pq Dv BPF_JA 583opcode uses the 32 bit | 530.Po 531.Dv BPF_K 532or 533.Dv BPF_X 534.Pc . 535.Pp 536.Bl -tag -width "BPF_ALU+BPF_MUL+BPF_K" -compact 537.It Li BPF_ALU+BPF_ADD+BPF_K --- 38 unchanged lines hidden (view full) --- 576or the index register 577.Pq Dv BPF_X . 578If the result is true (or non-zero), 579the true branch is taken, otherwise the false branch is taken. 580Jump offsets are encoded in 8 bits so the longest jump is 256 instructions. 581However, the jump always 582.Pq Dv BPF_JA 583opcode uses the 32 bit |
584.Li k | 584.Li k |
585field as the offset, allowing arbitrarily distant destinations. 586All conditionals use unsigned comparison conventions. 587.Pp 588.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 589.It Li BPF_JMP+BPF_JA 590pc += k 591.It Li BPF_JMP+BPF_JGT+BPF_K 592pc += (A > k) ? jt : jf --- 38 unchanged lines hidden (view full) --- 631X <- A 632.It Li BPF_MISC+BPF_TXA 633A <- X 634.El 635.El 636.Pp 637The 638.Nm | 585field as the offset, allowing arbitrarily distant destinations. 586All conditionals use unsigned comparison conventions. 587.Pp 588.Bl -tag -width "BPF_JMP+BPF_KSET+BPF_X" -compact 589.It Li BPF_JMP+BPF_JA 590pc += k 591.It Li BPF_JMP+BPF_JGT+BPF_K 592pc += (A > k) ? jt : jf --- 38 unchanged lines hidden (view full) --- 631X <- A 632.It Li BPF_MISC+BPF_TXA 633A <- X 634.El 635.El 636.Pp 637The 638.Nm |
639interface provides the following macros to facilitate | 639interface provides the following macros to facilitate |
640array initializers: 641.Fn BPF_STMT opcode operand | 640array initializers: 641.Fn BPF_STMT opcode operand |
642and | 642and |
643.Fn BPF_JUMP opcode operand true_offset false_offset . 644.Pp 645.Sh EXAMPLES 646The following filter is taken from the Reverse ARP Daemon. It accepts 647only Reverse ARP requests. 648.Bd -literal 649struct bpf_insn insns[] = { 650 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 651 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 652 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 653 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), | 643.Fn BPF_JUMP opcode operand true_offset false_offset . 644.Pp 645.Sh EXAMPLES 646The following filter is taken from the Reverse ARP Daemon. It accepts 647only Reverse ARP requests. 648.Bd -literal 649struct bpf_insn insns[] = { 650 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 651 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_REVARP, 0, 3), 652 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 20), 653 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, REVARP_REQUEST, 0, 1), |
654 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + | 654 BPF_STMT(BPF_RET+BPF_K, sizeof(struct ether_arp) + |
655 sizeof(struct ether_header)), 656 BPF_STMT(BPF_RET+BPF_K, 0), 657}; 658.Ed 659.Pp 660This filter accepts only IP packets between host 128.3.112.15 and 661128.3.112.35. 662.Bd -literal --- 8 unchanged lines hidden (view full) --- 671 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 672 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 673 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 674 BPF_STMT(BPF_RET+BPF_K, 0), 675}; 676.Ed 677.Pp 678Finally, this filter returns only TCP finger packets. We must parse | 655 sizeof(struct ether_header)), 656 BPF_STMT(BPF_RET+BPF_K, 0), 657}; 658.Ed 659.Pp 660This filter accepts only IP packets between host 128.3.112.15 and 661128.3.112.35. 662.Bd -literal --- 8 unchanged lines hidden (view full) --- 671 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, 30), 672 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0x8003700f, 0, 1), 673 BPF_STMT(BPF_RET+BPF_K, (u_int)-1), 674 BPF_STMT(BPF_RET+BPF_K, 0), 675}; 676.Ed 677.Pp 678Finally, this filter returns only TCP finger packets. We must parse |
679the IP header to reach the TCP header. The | 679the IP header to reach the TCP header. The |
680.Dv BPF_JSET 681instruction 682checks that the IP fragment offset is 0 so we are sure 683that we have a TCP header. 684.Bd -literal 685struct bpf_insn insns[] = { 686 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 687 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), --- 21 unchanged lines hidden (view full) --- 709.%T "An efficient, extensible, and portable network monitor" 710.Re 711.Sh FILES 712.Bl -tag -compact -width /dev/bpfXXX 713.It Pa /dev/bpf Ns Sy n 714the packet filter device 715.El 716.Sh BUGS | 680.Dv BPF_JSET 681instruction 682checks that the IP fragment offset is 0 so we are sure 683that we have a TCP header. 684.Bd -literal 685struct bpf_insn insns[] = { 686 BPF_STMT(BPF_LD+BPF_H+BPF_ABS, 12), 687 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ETHERTYPE_IP, 0, 10), --- 21 unchanged lines hidden (view full) --- 709.%T "An efficient, extensible, and portable network monitor" 710.Re 711.Sh FILES 712.Bl -tag -compact -width /dev/bpfXXX 713.It Pa /dev/bpf Ns Sy n 714the packet filter device 715.El 716.Sh BUGS |
717The read buffer must be of a fixed size (returned by the | 717The read buffer must be of a fixed size (returned by the |
718.Dv BIOCGBLEN 719ioctl). 720.Pp 721A file that does not request promiscuous mode may receive promiscuously 722received packets as a side effect of another file requesting this 723mode on the same hardware interface. This could be fixed in the kernel | 718.Dv BIOCGBLEN 719ioctl). 720.Pp 721A file that does not request promiscuous mode may receive promiscuously 722received packets as a side effect of another file requesting this 723mode on the same hardware interface. This could be fixed in the kernel |
724with additional processing overhead. However, we favor the model where 725all files must assume that the interface is promiscuous, and if | 724with additional processing overhead. However, we favor the model where 725all files must assume that the interface is promiscuous, and if |
726so desired, must utilize a filter to reject foreign packets. 727.Pp 728Data link protocols with variable length headers are not currently supported. 729.Sh HISTORY 730.Pp 731The Enet packet filter was created in 1980 by Mike Accetta and 732Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at | 726so desired, must utilize a filter to reject foreign packets. 727.Pp 728Data link protocols with variable length headers are not currently supported. 729.Sh HISTORY 730.Pp 731The Enet packet filter was created in 1980 by Mike Accetta and 732Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at |
733Stanford, ported the code to BSD and continued its development from | 733Stanford, ported the code to BSD and continued its development from |
7341983 on. Since then, it has evolved into the Ultrix Packet Filter 735at 736.Tn DEC , 737a 738.Tn STREAMS 739.Tn NIT 740module under 741.Tn SunOS 4.1 , 742and 743.Tn BPF . 744.Sh AUTHORS 745.An -nosplit 746.An Steven McCanne , 747of Lawrence Berkeley Laboratory, implemented BPF in 748Summer 1990. Much of the design is due to 749.An Van Jacobson . | 7341983 on. Since then, it has evolved into the Ultrix Packet Filter 735at 736.Tn DEC , 737a 738.Tn STREAMS 739.Tn NIT 740module under 741.Tn SunOS 4.1 , 742and 743.Tn BPF . 744.Sh AUTHORS 745.An -nosplit 746.An Steven McCanne , 747of Lawrence Berkeley Laboratory, implemented BPF in 748Summer 1990. Much of the design is due to 749.An Van Jacobson . |