Mac Developer Library

Developer

bpf.h Reference

Options
Deployment Target:

On This Page

bpf.h Reference

Inheritance


Not Applicable

Conforms To


Not Applicable

Import Statement


Not Applicable

Objective-C

@import Kernel;

Included Headers

  • <sys/param.h>

  • <sys/appleapiopts.h>

  • <sys/types.h>

  • <sys/time.h>

  • <sys/cdefs.h>

  • <stdint.h>

  • <sys/kernel_types.h>

  • <sys/_types/_timeval32.h>

Functions

  • Declaration

    Objective-C

    errno_t bpf_attach ( ifnet_t interface, u_int32_t data_link_type, u_int32_t header_length, bpf_send_func send, bpf_tap_func tap );

    Parameters

    interface

    The interface to register with BPF.

    data_link_type

    The data link type of the interface. See the DLT_* defines in bpf.h.

    header_length

    The length, in bytes, of the data link header.

    send

    See the bpf_send_func described above.

    tap

    See the bpf_tap_func described above.

    Discussion

    Registers an interface with BPF. This allows bpf devices to attach to your interface to capture and transmit packets. Your interface will be unregistered automatically when your interface is detached. You may register multiple times with different data link types. An 802.11 interface would use this to allow clients to pick whether they want just an ethernet style frame or the 802.11 wireless headers as well. The first dlt you register will be considered the default. Any bpf device attaches that do not specify a data link type will use the default.

    Import Statement

    Objective-C

    #include <bpf.h>;

    Availability

    Available in OS X v10.5 and later.

  • Declaration

    Objective-C

    void bpf_tap_in ( ifnet_t interface, u_int32_t dlt, mbuf_t packet, void *header, size_t header_len );

    Parameters

    interface

    The interface the packet was received on.

    dlt

    The data link type of the packet.

    packet

    The packet received.

    header

    An optional pointer to a header that will be prepended.

    headerlen

    If the header was specified, the length of the header.

    Discussion

    Call this function when your interface receives a packet. This function will check if any bpf devices need a a copy of the packet.

    Import Statement

    Objective-C

    #include <bpf.h>;

    Availability

    Available in OS X v10.5 and later.

  • Declaration

    Objective-C

    void bpf_tap_out ( ifnet_t interface, u_int32_t dlt, mbuf_t packet, void *header, size_t header_len );

    Parameters

    interface

    The interface the packet was or will be transmitted on.

    dlt

    The data link type of the packet.

    packet

    The packet received.

    header

    An optional pointer to a header that will be prepended.

    headerlen

    If the header was specified, the length of the header.

    Discussion

    Call this function when your interface trasmits a packet. This function will check if any bpf devices need a a copy of the packet.

    Import Statement

    Objective-C

    #include <bpf.h>;

    Availability

    Available in OS X v10.5 and later.

  • Declaration

    Objective-C

    void bpfattach ( ifnet_t interface, u_int data_link_type, u_int header_length );

    Parameters

    interface

    The interface to register with BPF.

    data_link_type

    The data link type of the interface. See the DLT_* defines in bpf.h.

    header_length

    The length, in bytes, of the data link header.

    Discussion

    Registers an interface with BPF. This allows bpf devices to attach to your interface to capture packets. Your interface will be unregistered automatically when your interface is detached.

    Import Statement

    Objective-C

    #include <bpf.h>;

    Availability

    Available in OS X v10.4 and later.

Callbacks

  • Declaration

    Objective-C

    typedef errno_t ( *bpf_send_func)( ifnet_t interface, u_int32_t data_link_type, mbuf_t packet);

    Parameters

    interface

    The interface the packet is being sent on.

    dlt

    The data link type the bpf device is attached to.

    packet

    The packet to be sent.

    Discussion

    bpf_send_func is called when a bpf file descriptor is used to send a raw packet on the interface. The mbuf and data link type are specified. The callback is responsible for releasing the mbuf whether or not it returns an error.

    Import Statement

    Objective-C

    #include <bpf.h>;

    Availability

    Available in OS X v10.5 and later.

  • Declaration

    Objective-C

    typedef errno_t ( *bpf_tap_func)( ifnet_t interface, u_int32_t data_link_type, bpf_tap_mode direction);

    Parameters

    interface

    The interface being tapped.

    dlt

    The data link type being tapped.

    direction

    The direction of the tap.

    Discussion

    bpf_tap_func is called when the tap state of the interface changes. This happens when a bpf device attaches to an interface or detaches from an interface. The tap mode will join together (bit or) the modes of all bpf devices using that interface for that dlt. If you return an error from this function, the bpf device attach attempt that triggered the tap will fail. If this function was called bacuse the tap state was decreasing (tap in or out is stopping), the error will be ignored.

    Import Statement

    Objective-C

    #include <bpf.h>;

    Availability

    Available in OS X v10.5 and later.

Data Types

See the Overview section above for header-level documentation.

  • Mode for tapping. BPF_MODE_DISABLED/BPF_MODE_INPUT_OUTPUT etc.

    Declaration

    Objective-C

    typedef u_int32_t bpf_tap_mode;

    Import Statement

    Objective-C

    #include <bpf.h>;

    Availability

    Available in OS X v10.4 and later.

Constants

See the Overview section above for header-level documentation.

  • BPF

    Constants defining interface families.

    Declaration

    Objective-C

    enum { BPF_MODE_DISABLED = 0, BPF_MODE_INPUT = 1, BPF_MODE_OUTPUT = 2, BPF_MODE_INPUT_OUTPUT = 3 };

    Constants

    • BPF_MODE_DISABLED

      BPF_MODE_DISABLED

      Disable bpf.

      Available in OS X v10.4 and later.

    • BPF_MODE_INPUT

      BPF_MODE_INPUT

      Enable input only.

      Available in OS X v10.4 and later.

    • BPF_MODE_OUTPUT

      BPF_MODE_OUTPUT

      Enable output only.

      Available in OS X v10.4 and later.

    • BPF_MODE_INPUT_OUTPUT

      BPF_MODE_INPUT_OUTPUT

      Enable input and output.

      Available in OS X v10.4 and later.

    Discussion

    tap mode