BPF(9)

BPF(9) | Kernel Developer's Manual | BPF(9)

# NAME

`bpf` — Berkeley Packet Filter kernel interface

# SYNOPSIS

`#include <sys/mbuf.h>`
`#include <net/bpf.h>`

# DESCRIPTION

`bpf` is called via an operations vector described by the following struct:

    struct bpf_ops {
            void (*bpf_attach)(struct ifnet *, u_int, u_int, struct bpf_if **);
            void (*bpf_detach)(struct ifnet *);
            void (*bpf_change_type)(struct ifnet *, u_int, u_int);

            void (*bpf_mtap)(struct bpf_if *, struct mbuf *);
            void (*bpf_mtap2)(struct bpf_if *, void *, u_int, struct mbuf *);
            void (*bpf_mtap_af)(struct bpf_if *, uint32_t, struct mbuf *);
            void (*bpf_mtap_et)(struct bpf_if *, uint16_t, struct mbuf *);
            void (*bpf_mtap_sl_in)(struct bpf_if *, u_char *, struct mbuf **);
            void (*bpf_mtap_sl_out)(struct bpf_if *, u_char *, struct mbuf *);
    };

This vector is found from struct bpf_ops * bpf_ops. It is either a “stub” implementation or a real implementation, depending on whether `bpf` is absent or present in the kernel, respectively.

# CODE REFERENCES

The `bpf` implementation is located in sys/net/bpf.c, the stub implementation is in sys/net/bpf_stub.c, and sys/net/bpf.h describes the interface.

June 25, 2018 | NetBSD 11.0