path: root/extensions/
diff options
authorWillem de Bruijn <>2016-08-10 15:23:07 -0400
committerPablo Neira Ayuso <>2016-08-12 12:46:26 +0200
commitbd1f88bf85100554d35e74273d907db1fdcd250f (patch)
tree6bbf358fd8dba3157872d43a1d0f23a58372a1f4 /extensions/
parenta44bee8c3582cb72868a3b7f703494dd2b24bf7d (diff)
extensions/ clarify BPF code generation with tcpdump
The xt_bpf module applies BPF bytecode to the packet. Depending on where the module is invoked, the kernel may pass a packet with or without link layer header. Iptables has no such header. A common `tcpdump -ddd <string>` compilation command may revert to a physical device that generates code for packets starting from the mac layer up (e.g., E10MB data link type: Ethernet). Clarify in the man page that when using this tool for code generation, a suitable target device must be chosen. Netfilter Bugzilla Bug #1048 Reported-by: Lorenzo Pistone <> Signed-off-by: Willem de Bruijn <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'extensions/')
1 files changed, 13 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
index 5b1d0424..302e0103 100644
--- a/extensions/
+++ b/extensions/
@@ -31,4 +31,17 @@ Or instead, you can invoke the nfbpf_compile utility.
iptables \-A OUTPUT \-m bpf \-\-bytecode "`nfbpf_compile RAW 'ip proto 6'`" \-j ACCEPT
+Or use tcpdump -ddd. In that case, generate BPF targeting a device with the
+same data link type as the xtables match. Iptables passes packets from the
+network layer up, without mac layer. Select a device with data link type RAW,
+such as a tun device:
+ip tuntap add tun0 mode tun
+ip link set tun0 up
+tcpdump -ddd -i tun0 ip proto 6
+See tcpdump -L -i $dev for a list of known data link types for a given device.
You may want to learn more about BPF from FreeBSD's bpf(4) manpage.