bpf.h

Includes:

Overview

Functions

bpf_attach
bpf_tap_in
bpf_tap_out
bpfattach

bpf_attach

errno_t bpf_attach(
    ifnet_t interface,
    u_int32_t data_link_type, 
    u_int32_t header_length,
    bpf_send_func send, 
    bpf_tap_func tap);

Parameters

interface: The interface to register with BPF.
data_link_type: The data link type of the interface. See the DLT_* defines in bpf.h.
header_length: The length, in bytes, of the data link header.

Discussion

Registers an interface with BPF. This allows bpf devices to attach to your interface to capture and transmit packets. Your interface will be unregistered automatically when your interface is detached. You may register multiple times with different data link types. An 802.11 interface would use this to allow clients to pick whether they want just an ethernet style frame or the 802.11 wireless headers as well. The first dlt you register will be considered the default. Any bpf device attaches that do not specify a data link type will use the default.

bpf_tap_in

void bpf_tap_in(
    ifnet_t interface,
    u_int32_t dlt,
    mbuf_t packet, 
    void *header,
    size_t header_len);

Parameters

interface: The interface the packet was received on.
dlt: The data link type of the packet.
packet: The packet received.
header: An optional pointer to a header that will be prepended.
headerlen: If the header was specified, the length of the header.

Discussion

Call this function when your interface receives a packet. This function will check if any bpf devices need a a copy of the packet.

bpf_tap_out

void bpf_tap_out(
    ifnet_t interface,
    u_int32_t dlt,
    mbuf_t packet, 
    void *header,
    size_t header_len);

Parameters

interface: The interface the packet was or will be transmitted on.
dlt: The data link type of the packet.
packet: The packet received.
header: An optional pointer to a header that will be prepended.
headerlen: If the header was specified, the length of the header.

Discussion

Call this function when your interface trasmits a packet. This function will check if any bpf devices need a a copy of the packet.

bpfattach

void bpfattach(
    ifnet_t interface,
    u_int data_link_type,
    u_int header_length);

Parameters

interface: The interface to register with BPF.
data_link_type: The data link type of the interface. See the DLT_* defines in bpf.h.
header_length: The length, in bytes, of the data link header.

Discussion

Registers an interface with BPF. This allows bpf devices to attach to your interface to capture packets. Your interface will be unregistered automatically when your interface is detached.

Typedefs

bpf_send_func

typedef errno_t ( *bpf_send_func)(
    ifnet_t interface,
    u_int32_t data_link_type, 
    mbuf_t packet);

Parameters

interface
The interface the packet is being sent on.

dlt
The data link type the bpf device is attached to.

packet
The packet to be sent.

Discussion

bpf_send_func is called when a bpf file descriptor is used to send a raw packet on the interface. The mbuf and data link type are specified. The callback is responsible for releasing the mbuf whether or not it returns an error.

bpf_tap_func

typedef errno_t ( *bpf_tap_func)(
    ifnet_t interface,
    u_int32_t data_link_type, 
    bpf_tap_mode direction);

Parameters

interface
The interface being tapped.

dlt
The data link type being tapped.

direction
The direction of the tap.

Discussion

bpf_tap_func is called when the tap state of the interface changes. This happens when a bpf device attaches to an interface or detaches from an interface. The tap mode will join together (bit or) the modes of all bpf devices using that interface for that dlt. If you return an error from this function, the bpf device attach attempt that triggered the tap will fail. If this function was called bacuse the tap state was decreasing (tap in or out is stopping), the error will be ignored.

bpf_tap_mode

Mode for tapping. BPF_MODE_DISABLED/BPF_MODE_INPUT_OUTPUT etc.

typedef u_int32_t bpf_tap_mode;

Enumerations

BPF

Constants defining interface families.

enum { 
    BPF_MODE_DISABLED = 0, 
    BPF_MODE_INPUT = 1, 
    BPF_MODE_OUTPUT = 2, 
    BPF_MODE_INPUT_OUTPUT = 3 
};

Constants

BPF_MODE_DISABLED
Disable bpf.

BPF_MODE_INPUT
Enable input only.

BPF_MODE_OUTPUT
Enable output only.

BPF_MODE_INPUT_OUTPUT
Enable input and output.

Discussion

tap mode

Did this document help you?

Yes: Tell us what works for you.

It’s good, but: Report typos, inaccuracies, and so forth.

It wasn’t helpful: Tell us what would have helped.

Last Updated: 2008-03-13