The filter program is in the form of instructions for a virtual machine, which are interpreted, or compiled into machine code by a just-in-time (JIT) mechanism and executed, in the kernel.īPF is sometimes used to refer to just the filtering mechanism, rather than to the entire interface. This avoids copying unwanted packets from the operating system kernel to the process, greatly improving performance. BPF returns only packets that pass the filter that the process supplies. For example, a tcpdump process may want to receive only packets that initiate a TCP connection. In addition, if the driver for the network interface supports promiscuous mode, it allows the interface to be put into that mode so that all packets on the network can be received, even those destined to other hosts.īPF supports filtering packets, allowing a userspace process to supply a filter program that specifies which packets it wants to receive. It provides a raw interface to data link layers, permitting raw link-layer packets to be sent and received. The Berkeley Packet Filter ( BPF) is a technology used in certain computer operating systems for programs that need to, among other things, analyze network traffic.

Unix-like ( FreeBSD, OpenBSD, NetBSD, DragonFly BSD, macOS, Oracle Solaris 11 and later, AIX, Tru64, Linux, Orbis), Windows Interface to data link layers on a Unix-like system Berkeley Packet Filter Developer(s)

Wireshark android device filter