kernel - Are Berkeley Packet Filter opcode values implementation defined? -


are berkeley packet filter opcode values implementation defined?

i thought of tcpdump/libpcap authoritative in bpf arena. noticed linux kernel , tcpdump read bpf filters differently. bpf mnemonics , behavior same, actual opcode values seem different. went looking on internets "the standard", i've found has mnemonics.

no, other instructions bpf interpreters/jits support others don't, have same binary values. compare, example, current libpcap pcap/bpf.h with, @ least, linux linux/bpf_common.h , linux/filter.h in 3.19 kernel, , note comment in linux/filter.h reads:

/*  *      try , keep these values , structures similar bsd,  *      bpf code definitions need match can share filters  */ 

and code in libpcap uses same compiler generate bpf code linux kernel, *bsd/os x/solaris 11/etc. kernels, , userland bpf interpreter, small code changes deal fetching packet metadata (rather packet data).


Comments

Popular posts from this blog

Magento/PHP - Get phones on all members in a customer group -

php - .htaccess mod_rewrite for dynamic url which has domain names -

Website Login Issue developed in magento -