From owner-freebsd-net@freebsd.org Wed Dec 30 08:43:33 2015 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1F634A55477 for ; Wed, 30 Dec 2015 08:43:33 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id F32171E9F for ; Wed, 30 Dec 2015 08:43:32 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from Julian-MBP3.local (ppp121-45-250-125.lns20.per4.internode.on.net [121.45.250.125]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id tBU8hMUH033256 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Wed, 30 Dec 2015 00:43:25 -0800 (PST) (envelope-from julian@freebsd.org) Subject: Re: BPF Berkeley Packet Filter To: Juan Herrera , freebsd-net@freebsd.org References: From: Julian Elischer Message-ID: <56839925.5030907@freebsd.org> Date: Wed, 30 Dec 2015 16:43:17 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2015 08:43:33 -0000 On 30/12/2015 6:26 AM, Juan Herrera wrote: > Hello, > > I have a question regarding Berkeley Packet filter, which is Can I read an > incoming packet length with BPF, I am working on a project that requires to > filter the receiving packets in the kernel before they get to userspace, > but I need to be able to read the packet length when applying BPF because I > (previously) encapsulated the packet with my own metadata before sending it > to the machine with BPF so I want to read packet length to decapsulate as I > know the value for the metadata at the end of the packet? https://www.freebsd.org/cgi/man.cgi?bpf%284%29 should show you what you need. there is a structure prepended to the packet that includes the original length. or do you want to know the length BEFORE reading it? or do you want your filter to know the length? what do you mean by "applying BPF"? > > > Thank you in advance! > _______________________________________________ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >