---
name: "nfbpf_compile"
section: "8"
platform: "linux"
package: "iptables"
version: "1:1.8.13-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/nfbpf_compile"
---

# nfbpf\_compile(8)

generate bytecode for use with xt\_bpf

## NAME

nfbpf\_compile — generate bytecode for use with xt\_bpf

## SYNOPSIS

**nfbpf\_compile** \[ *LLTYPE* \] *PROGRAM*

*LLTYPE* := { **EN10MB** \| **RAW** \| **SLIP** \|  *...* }

## DESCRIPTION

The **nfbpf\_compile** utility aids in generating BPF byte code suitable for passing to the iptables **bpf** match.

## OPTIONS

- *LLTYPE*

  Link-layer header type to operate on. This is a name as defined in \<**pcap/dlt.h**\> but with the leading **DLT\_** prefix stripped. For use with iptables, **RAW** should be the right choice (it's also the default if not specified).

- *PROGRAM*

  The BPF expression to compile, see [**pcap-filter**(7)](/pcap-filter/7.md) for a description of the language.

## EXIT STATUS

The program returns 0 on success, 1 otherwise.

## EXAMPLE

Match incoming TCP packets with size bigger than 100 bytes:

bpf=$(nfbpf\_compile 'tcp and greater 100')\
 iptables -A INPUT -m bpf --bytecode "$bpf" -j ACCEPT

The description of **bpf** match in [**iptables-extensions**(8)](/iptables-extensions/8.md) lists a few more examples.

## SEE ALSO

[**iptables-extensions**(8)](/iptables-extensions/8.md), [**pcap-filter**(7)](/pcap-filter/7.md)