bpf.h Reference

Declared in
bpf.h
kpi_interface.h

Overview

Included Headers

  • <sys/param.h>

  • <sys/appleapiopts.h>

  • <sys/types.h>

  • <sys/time.h>

  • <sys/cdefs.h>

  • <stdint.h>

  • <sys/kernel_types.h>

  • <sys/_types/_timeval32.h>

Functions

See the Overview section above for header-level documentation.

bpfattach

extern void bpfattach(
   ifnet_t interface,
   u_int data_link_type,
   u_int header_length);
Parameters
interface

The interface to register with BPF.

data_link_type

The data link type of the interface. See the DLT_* defines in bpf.h.

header_length

The length, in bytes, of the data link header.

Discussion

Registers an interface with BPF. This allows bpf devices to attach to your interface to capture packets. Your interface will be unregistered automatically when your interface is detached.

Availability
  • Available in OS X v10.4 and later.
Declared In
bpf.h

bpf_attach

extern errno_t bpf_attach(
   ifnet_t interface,
   u_int32_t data_link_type,
   u_int32_t header_length,
   bpf_send_func send,
   bpf_tap_func tap);
Parameters
interface

The interface to register with BPF.

data_link_type

The data link type of the interface. See the DLT_* defines in bpf.h.

header_length

The length, in bytes, of the data link header.

send

See the bpf_send_func described above.

tap

See the bpf_tap_func described above.

Discussion

Registers an interface with BPF. This allows bpf devices to attach to your interface to capture and transmit packets. Your interface will be unregistered automatically when your interface is detached. You may register multiple times with different data link types. An 802.11 interface would use this to allow clients to pick whether they want just an ethernet style frame or the 802.11 wireless headers as well. The first dlt you register will be considered the default. Any bpf device attaches that do not specify a data link type will use the default.

Availability
  • Available in OS X v10.5 and later.
Declared In
bpf.h

bpf_tap_in

extern void bpf_tap_in(
   ifnet_t interface,
   u_int32_t dlt,
   mbuf_t packet,
   void *header,
   size_t header_len);
Parameters
interface

The interface the packet was received on.

dlt

The data link type of the packet.

packet

The packet received.

header

An optional pointer to a header that will be prepended.

headerlen

If the header was specified, the length of the header.

Discussion

Call this function when your interface receives a packet. This function will check if any bpf devices need a a copy of the packet.

Availability
  • Available in OS X v10.5 and later.
Declared In
bpf.h

bpf_tap_out

extern void bpf_tap_out(
   ifnet_t interface,
   u_int32_t dlt,
   mbuf_t packet,
   void *header,
   size_t header_len);
Parameters
interface

The interface the packet was or will be transmitted on.

dlt

The data link type of the packet.

packet

The packet received.

header

An optional pointer to a header that will be prepended.

headerlen

If the header was specified, the length of the header.

Discussion

Call this function when your interface trasmits a packet. This function will check if any bpf devices need a a copy of the packet.

Availability
  • Available in OS X v10.5 and later.
Declared In
bpf.h

Callbacks

See the Overview section above for header-level documentation.

bpf_send_func

typedef errno_t ( *bpf_send_func)(
   ifnet_t interface,
   u_int32_t data_link_type,
   mbuf_t packet);

Parameters
interface

The interface the packet is being sent on.

dlt

The data link type the bpf device is attached to.

packet

The packet to be sent.

Discussion

bpf_send_func is called when a bpf file descriptor is used to send a raw packet on the interface. The mbuf and data link type are specified. The callback is responsible for releasing the mbuf whether or not it returns an error.

Availability
  • Available in OS X v10.5 and later.
Declared In
bpf.h

bpf_tap_func

typedef errno_t ( *bpf_tap_func)(
   ifnet_t interface,
   u_int32_t data_link_type,
   bpf_tap_mode direction);

Parameters
interface

The interface being tapped.

dlt

The data link type being tapped.

direction

The direction of the tap.

Discussion

bpf_tap_func is called when the tap state of the interface changes. This happens when a bpf device attaches to an interface or detaches from an interface. The tap mode will join together (bit or) the modes of all bpf devices using that interface for that dlt. If you return an error from this function, the bpf device attach attempt that triggered the tap will fail. If this function was called bacuse the tap state was decreasing (tap in or out is stopping), the error will be ignored.

Availability
  • Available in OS X v10.5 and later.
Declared In
bpf.h

Data Types

See the Overview section above for header-level documentation.

bpf_tap_mode

Mode for tapping. BPF_MODE_DISABLED/BPF_MODE_INPUT_OUTPUT etc.

typedef u_int32_t bpf_tap_mode;
Availability
  • Available in OS X v10.4 and later.
Declared In
bpf.h

Constants

See the Overview section above for header-level documentation.

BPF

Constants defining interface families.

enum {
   BPF_MODE_DISABLED = 0,
   BPF_MODE_INPUT = 1,
   BPF_MODE_OUTPUT = 2,
   BPF_MODE_INPUT_OUTPUT = 3
};
Constants
BPF_MODE_DISABLED

Disable bpf.

Available in OS X v10.4 and later.

Declared in kpi_interface.h.

BPF_MODE_INPUT

Enable input only.

Available in OS X v10.4 and later.

Declared in bpf.h.

BPF_MODE_OUTPUT

Enable output only.

Available in OS X v10.4 and later.

Declared in bpf.h.

BPF_MODE_INPUT_OUTPUT

Enable input and output.

Available in OS X v10.4 and later.

Declared in bpf.h.

Discussion

tap mode