BPF Instructions

Table of Contents

Quicklinks: Linux Kernel Docs: Berkeley Packet Filter

At first glance, capture filters might seem like the ugly twin of display filters. You are not able to filter for most protocols or expert information. If you are used to working with display filters, the syntax can feel less expressive.

The reason we use capture filters is that they are fast. They can literally compile to a code that the Linux kernel understands. This code is called BPF, or “Berkeley Packet Filter”. It tells the kernel whether to drop or allow packets and is based on the BSD version. Some people refer to “capture filter syntax” as “BPF syntax”, and this is why.

In this article, we will explore how to generate BPF code with a capture filter. Our weapon of choice is dumpcap -d.

Example: “tcp port 443”

print generated BPF code for capture filter.

In this example, let’s use “tcp port 443”, as http is just a little popular these days.

BPF Instructions

dumpcap -d -f "tcp port 443"
Capturing on 'Wi-Fi: en0'
(000) ldh      [12]
(001) jeq      #0x86dd          jt 2    jf 8
(002) ldb      [20]
(003) jeq      #0x6             jt 4    jf 19
(004) ldh      [54]
(005) jeq      #0x1bb           jt 18   jf 6
(006) ldh      [56]
(007) jeq      #0x1bb           jt 18   jf 19
(008) jeq      #0x800           jt 9    jf 19
(009) ldb      [23]
(010) jeq      #0x6             jt 11   jf 19
(011) ldh      [20]
(012) jset     #0x1fff          jt 19   jf 13
(013) ldxb     4*([14]&0xf)
(014) ldh      [x + 14]
(015) jeq      #0x1bb           jt 18   jf 16
(016) ldh      [x + 16]
(017) jeq      #0x1bb           jt 18   jf 19
(018) ret      #524288
(019) ret      #0

If this looks like Greek to you, BPF is documented and has a section dedicated to explaining instructions.

BPF Instructions, Explained

Putting this in a table:

BPF Diagram

Visualizing this with a flowchart, it may be more apparent what is happening. Given that IPv4 has a variable-length header, figuring out how long it is takes a couple extra steps (11-13).

BPF Hex Adventure

Another way to look at this is through a hexdump. We can print the hex of one TCP packet from an existing capture:

bash$ tshark -r existing.pcapng -Y "tcp" -c 1 -x
0000  34 97 f6 b5 5b 30 6c 96 cf d8 7f e7 08 00 45 00   4...[0l.......E.
0010  00 28 9c 64 00 00 40 06 18 13 c0 a8 01 c1 23 ba   .(.d..@.......#.
0020  e0 35 c7 93 01 bb ff 59 1b 42 1b e9 f5 e6 50 10   .5.....Y.B....P.
0030  20 0c d3 b4 00 00

This packet is available for download if you want to play around with it. Based on the data found in this packet, the order of processing should be 0 -> 1 -> 8 -> 9 -> 10 -> 11 -> 13 -> 14 -> 15 -> 16 -> 17 -> 18. Port 433 is 0x1bb in hex.

We can then use the power of MS Paint to follow the BPF code as it loads and skips to various bytes.

Further Reading

If you liked parsing capture filters, imagine how much fun deconstructing display filters could be!

• LWN.net, BPF and bounded loops
• Julia Evans, Notes on BPF and eBPF
• BPF resource list