---
name: "bpf"
section: "9"
platform: "linux"
package: "freebsd-manpages"
version: "6.0-5"
release: "Debian 4.0 (Etch)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/bpf/9"
---

# bpf(9)

Berkeley Packet Filter

## NAME

**bpf** – Berkeley Packet Filter

## SYNOPSIS

**#include \<net/bpf.h\>**

*void*\

**bpfattach**(*struct ifnet \*ifp*, *u\_int dlt*, *u\_int hdrlen*);

*void*\

**bpfattach2**(*struct ifnet \*ifp*, *u\_int dlt*, *u\_int hdrlen*, *struct bpf\_if \*\*driverp*);

*void*\

**bpfdetach**(*struct ifnet \*ifp*);

*void*\

**bpf\_tap**(*struct ifnet \*ifp*, *u\_char \*pkt*, *u\_int \*pktlen*);

*void*\

**bpf\_mtap**(*struct ifnet \*ifp*, *struct mbuf \*m*);

*void*\

**bpf\_mtap2**(*struct bpf\_if \*bp*, *void \*data*, *u\_int dlen*, *struct mbuf \*m*);

*u\_int*\

**bpf\_filter**(*const struct bpf\_insn \*pc* , *u\_char \*pkt*, *u\_int \*wirelen*, *u\_int \*buflen*);

*int*\

**bpf\_validate**(*const struct bpf\_insn \*fcode*, *int flen*);

## DESCRIPTION

The Berkeley Packet Filter provides a raw interface, that is protocol independent, to data link layers. It allows all packets on the network, even those destined for other hosts, to be passed from a network interface to user programs. Each program may specify a filter, in the form of a **bpf** filter machine program. The [bpf(4)](/bpf/4.md) manual page describes the interface used by user programs. This manual page describes the functions used by interfaces to pass packets to **bpf** and the functions for testing and running **bpf** filter machine programs.

The **bpfattach**() function attaches a network interface to **bpf**. The *ifp* argument is a pointer to the structure that defines the interface to be attached to an interface. The *dlt* argument is the data link-layer type: DLT\_NULL (no link-layer encapsulation), DLT\_EN10MB (Ethernet), DLT\_IEEE802\_11 (802.11 wireless networks), etc. The rest of the link layer types can be found in ⟨net/bpf.h⟩. The *hdrlen* argument is the fixed size of the link header; variable length headers are not yet supported. The **bpf** system will hold a pointer to *ifp-\>if\_bpf*. This variable will set to a non-NULL value when **bpf** requires packets from this interface to be tapped using the functions below.

The **bpfattach2**() function allows multiple **bpf** instances to be attached to a single interface, by registering an explicit *if\_bpf* rather than using *ifp-\>if\_bpf*. It is then possible to run [tcpdump(1)](/tcpdump/1.md) on the interface for any data link-layer types attached.

The **bpfdetach**() function detaches a **bpf** instance from an interface, specified by *ifp*. The **bpfdetach**() function should be called once for each **bpf** instance attached.

The **bpf\_tap**() function is used by an interface to pass the packet to **bpf**. The packet data (including link-header), pointed to by *pkt*, is of length *pktlen*, which must be a contiguous buffer. The *ifp* argument is a pointer to the structure that defines the interface to be tapped. The packet is parsed by each processes filter, and if accepted, it is buffered for the process to read.

The **bpf\_mtap**() function is like **bpf\_tap**() except that it is used to tap packets that are in an *mbuf* chain, *m*. The *ifp* argument is a pointer to the structure that defines the interface to be tapped. Like **bpf\_tap**(), **bpf\_mtap**() requires a link-header for whatever data link layer type is specified. Note that **bpf** only reads from the *mbuf* chain, it does not free it or keep a pointer to it. This means that an *mbuf* containing the link-header can be prepended to the chain if necessary. A cleaner interface to achieve this is provided by **bpf\_mtap2**().

The **bpf\_mtap2**() function allows the user to pass a link-header *data*, of length *dlen*, independent of the *mbuf* *m*, containing the packet. This simplifies the passing of some link-headers.

The **bpf\_filter**() function executes the filter program starting at *pc* on the packet *pkt*. The *wirelen* argument is the length of the original packet and *buflen* is the amount of data present.

The **bpf\_validate**() function checks that the filter code *fcode*, of length *flen*, is valid.

## RETURN VALUES

The **bpf\_filter**() function returns -1 (cast to an unsigned integer) if there is no filter. Otherwise, it returns the result of the filter program.

The **bpf\_validate**() function returns 0 when the program is not a valid filter program.

## SEE ALSO

[tcpdump(1)](/tcpdump/1.md), [bpf(4)](/bpf/4.md)

## HISTORY

The Enet packet filter was created in 1980 by Mike Accetta and Rick Rashid at Carnegie-Mellon University. Jeffrey Mogul, at Stanford, ported the code to BSD and continued its development from 1983 on. Since then, it has evolved into the Ultrix Packet Filter at DEC, a STREAMS NIT module under SunOS 4.1, and BPF.

## AUTHORS

Steven McCanne, of Lawrence Berkeley Laboratory, implemented BPF in Summer 1990. Much of the design is due to Van Jacobson. This manpage was written by Orla McGann.