BPF(9) Kernel Developer's Manual BPF(9)
NAME
bpfBerkeley Packet Filter kernel interface
SYNOPSIS
#include <sys/mbuf.h>
#include <net/bpf.h>
DESCRIPTION
bpf is called via an operations vector described by the following struct:
 
struct bpf_ops { void (*bpf_attach)(struct ifnet *, u_int, u_int, struct bpf_if **); void (*bpf_detach)(struct ifnet *); void (*bpf_change_type)(struct ifnet *, u_int, u_int); void (*bpf_tap)(struct bpf_if *, u_char *, u_int); void (*bpf_mtap)(struct bpf_if *, struct mbuf *); void (*bpf_mtap2)(struct bpf_if *, void *, u_int, struct mbuf *); void (*bpf_mtap_af)(struct bpf_if *, uint32_t, struct mbuf *); void (*bpf_mtap_et)(struct bpf_if *, uint16_t, struct mbuf *); void (*bpf_mtap_sl_in)(struct bpf_if *, u_char *, struct mbuf **); void (*bpf_mtap_sl_out)(struct bpf_if *, u_char *, struct mbuf *); };
 
This vector is found from struct bpf_ops * bpf_ops. It is either a “stub” implementation or a real implementation, depending on whether bpf is absent or present in the kernel, respectively.
CODE REFERENCES
This section describes places within the NetBSD source tree where the implementation can be found. All pathnames are relative to /usr/src.
 
The bpf implementation is located in sys/net/bpf.c, the stub implementation is in sys/net/bpf_stub.c, and sys/net/bpf.h describes the interface.