Everything about Berkeley Packet Filter
Interface to data link layers on a Unix-like system
The Berkeley Packet Filter is a network tap mechanism and packet filter which permits computer network packets to be captured and filtered at the operating system level. It provides a raw interface to data link layers, permitting raw link-layer packets to be sent and received, and allows a userspace process to supply a filter program that specifies which packets it wants to receive. For example, a tcpdump process may want to receive only packets that initiate a TCP connection. BPF returns only packets that pass the filter that the process supplies. This avoids copying unwanted packets from the operating system kernel to the process, greatly improving performance. The filter program is in the form of instructions for a virtual machine, which are interpreted, or compiled into machine code by a just-in-time (JIT) mechanism and executed, in the kernel. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Berkeley Packet FilterA 5-minute orientation
- Pick up a classic book: The UNIX operating systemThe most-reprinted book on the subject
- Read the landmark paper: Extended Berkeley Packet Filter: An Application PerspectiveCited 46 times
- Go sideways: Netsniff-ngA closely related topic
- Go sideways: NgrepA closely related topic
📖 Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
Extended Berkeley Packet Filter: An Application Perspective
Enhancing intrusion detection against denial of service and distributed denial of service attacks: Leveraging extended Berkeley packet filter and machine learning algorithms
MODELS AND TOOLS OF THE AUTOMATED SYSTEM FOR COMPUTER NETWORK TRAFFIC INVESTIGATION USING BERKELEY PACKET FILTER
Cloud Workload Protection with eBPF: Harnessing Extended Berkeley Packet Filter for Threat Detection
Bridging the Semantic Gap in Virtual Machines with Host-Injected Extended Berkeley Packet Filter Code
📚 Books worth reading
The UNIX operating systemChristian, Kaare, Kaare Christian · 1983
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Netsniff-ng netsniff-ng is a free Linux network analyzer and networking toolkit originally written by Daniel Borkmann. Its gain of performance is reached by zero-copy…
- Ngrep ngrep (network grep) is a network packet analyzer written by Jordan Ritter. It has a command-line interface, and relies upon the pcap library and the GNU…
- Tcpdump tcpdump is a data-network packet analyzer computer program that runs under a command line interface. It allows the user to display TCP/IP and other packets…
- EBPF eBPF is a technology that can run programs in a privileged context such as the operating system kernel. It is the successor to the Berkeley Packet Filter…
- Network scheduler A network scheduler, also called packet scheduler, queueing discipline (qdisc) or queueing algorithm, is an arbiter on a node in a packet switching communicatio…
- Seccomp seccomp (short for secure computing) is a computer security facility in the Linux kernel. seccomp allows a process to make a one-way transition into a…
- Wireshark Wireshark is free and open-source packet analyzer software. It is used for computer network analysis and troubleshooting, software and communications protocol…
- Pcap In the field of computer network administration, pcap is an application programming interface (API) for capturing network traffic. While the name is an…