Mac Developer Library

Developer

bpf.h Reference

Options
Deployment Target:

On This Page

bpf.h Reference

Included Headers

  • <sys/param.h>

  • <sys/appleapiopts.h>

  • <sys/types.h>

  • <sys/time.h>

  • <sys/cdefs.h>

  • <stdint.h>

  • <sys/kernel_types.h>

  • <sys/_types/_timeval32.h>

Functions

  • Declaration

    extern errno_t bpf_attach( ifnet_t interface, u_int32_t data_link_type, u_int32_t header_length, bpf_send_func send, bpf_tap_func tap);

    Parameters

    interface

    The interface to register with BPF.

    data_link_type

    The data link type of the interface. See the DLT_* defines in bpf.h.

    header_length

    The length, in bytes, of the data link header.

    send

    See the bpf_send_func described above.

    tap

    See the bpf_tap_func described above.

    Discussion

    Registers an interface with BPF. This allows bpf devices to attach to your interface to capture and transmit packets. Your interface will be unregistered automatically when your interface is detached. You may register multiple times with different data link types. An 802.11 interface would use this to allow clients to pick whether they want just an ethernet style frame or the 802.11 wireless headers as well. The first dlt you register will be considered the default. Any bpf device attaches that do not specify a data link type will use the default.

  • Declaration

    extern void bpf_tap_in( ifnet_t interface, u_int32_t dlt, mbuf_t packet, void *header, size_t header_len);

    Parameters

    interface

    The interface the packet was received on.

    dlt

    The data link type of the packet.

    packet

    The packet received.

    header

    An optional pointer to a header that will be prepended.

    headerlen

    If the header was specified, the length of the header.

    Discussion

    Call this function when your interface receives a packet. This function will check if any bpf devices need a a copy of the packet.

  • Declaration

    extern void bpf_tap_out( ifnet_t interface, u_int32_t dlt, mbuf_t packet, void *header, size_t header_len);

    Parameters

    interface

    The interface the packet was or will be transmitted on.

    dlt

    The data link type of the packet.

    packet

    The packet received.

    header

    An optional pointer to a header that will be prepended.

    headerlen

    If the header was specified, the length of the header.

    Discussion

    Call this function when your interface trasmits a packet. This function will check if any bpf devices need a a copy of the packet.

  • Declaration

    extern void bpfattach( ifnet_t interface, u_int data_link_type, u_int header_length);

    Parameters

    interface

    The interface to register with BPF.

    data_link_type

    The data link type of the interface. See the DLT_* defines in bpf.h.

    header_length

    The length, in bytes, of the data link header.

    Discussion

    Registers an interface with BPF. This allows bpf devices to attach to your interface to capture packets. Your interface will be unregistered automatically when your interface is detached.

Callbacks

  • Declaration

    typedef errno_t ( *bpf_send_func)( ifnet_t interface, u_int32_t data_link_type, mbuf_t packet);

    Parameters

    interface

    The interface the packet is being sent on.

    dlt

    The data link type the bpf device is attached to.

    packet

    The packet to be sent.

    Discussion

    bpf_send_func is called when a bpf file descriptor is used to send a raw packet on the interface. The mbuf and data link type are specified. The callback is responsible for releasing the mbuf whether or not it returns an error.

  • Declaration

    typedef errno_t ( *bpf_tap_func)( ifnet_t interface, u_int32_t data_link_type, bpf_tap_mode direction);

    Parameters

    interface

    The interface being tapped.

    dlt

    The data link type being tapped.

    direction

    The direction of the tap.

    Discussion

    bpf_tap_func is called when the tap state of the interface changes. This happens when a bpf device attaches to an interface or detaches from an interface. The tap mode will join together (bit or) the modes of all bpf devices using that interface for that dlt. If you return an error from this function, the bpf device attach attempt that triggered the tap will fail. If this function was called bacuse the tap state was decreasing (tap in or out is stopping), the error will be ignored.

Data Types

See the Overview section above for header-level documentation.

  • Mode for tapping. BPF_MODE_DISABLED/BPF_MODE_INPUT_OUTPUT etc.

    Declaration

    typedef u_int32_t bpf_tap_mode;

    Import Statement

Constants

See the Overview section above for header-level documentation.

  • BPF

    Constants defining interface families.

    Declaration

    enum { BPF_MODE_DISABLED = 0, BPF_MODE_INPUT = 1, BPF_MODE_OUTPUT = 2, BPF_MODE_INPUT_OUTPUT = 3 };

    Constants

    • BPF_MODE_DISABLED

      Disable bpf.

    • BPF_MODE_INPUT

      Enable input only.

    • BPF_MODE_OUTPUT

      Enable output only.

    • BPF_MODE_INPUT_OUTPUT

      Enable input and output.

    Discussion

    tap mode