| Message ID | 1470856987-101558-1-git-send-email-willemdebruijn.kernel@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Wed, Aug 10, 2016 at 03:23:07PM -0400, Willem de Bruijn wrote: > From: Willem de Bruijn <willemb@google.com> > > The xt_bpf module applies BPF bytecode to the packet. Depending on > where the module is invoked, the kernel may pass a packet with or > without link layer header. Iptables has no such header. > > A common `tcpdump -ddd <string>` compilation command may revert to > a physical device that generates code for packets starting from the > mac layer up (e.g., E10MB data link type: Ethernet). > > Clarify in the man page that when using this tool for code generation, > a suitable target device must be chosen. > > Netfilter Bugzilla Bug #1048 Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libxt_bpf.man b/extensions/libxt_bpf.man index 5b1d042..302e010 100644 --- a/extensions/libxt_bpf.man +++ b/extensions/libxt_bpf.man @@ -31,4 +31,17 @@ Or instead, you can invoke the nfbpf_compile utility. .IP iptables \-A OUTPUT \-m bpf \-\-bytecode "`nfbpf_compile RAW 'ip proto 6'`" \-j ACCEPT .PP +Or use tcpdump -ddd. In that case, generate BPF targeting a device with the +same data link type as the xtables match. Iptables passes packets from the +network layer up, without mac layer. Select a device with data link type RAW, +such as a tun device: +.IP +ip tuntap add tun0 mode tun +.br +ip link set tun0 up +.br +tcpdump -ddd -i tun0 ip proto 6 +.PP +See tcpdump -L -i $dev for a list of known data link types for a given device. +.PP You may want to learn more about BPF from FreeBSD's bpf(4) manpage.