nfbpf_compile8
Generate bytecode for use with xt_bpf
Usage
nfbpf_compile [LLTYPE]
PROGRAM
LLTYPE :=
{EN10MB | RAW | SLIP | }
Overview
The nfbpf_compile utility aids in generating BPF byte code suitable for passing to the iptables bpf match.
Options
- LLTYPE
-
Link-layer header type to operate on. This is a name as defined in <
pcap/dlt.h> but with the leadingDLT_prefix stripped. For use with iptables, RAW should be the right choice (it's also the default if not specified).
- PROGRAM
-
The BPF expression to compile, see pcap-filter(7) for a description of the language.
Exit status
The program returns 0 on success, 1 otherwise.
Examples
Match incoming TCP packets with size bigger than 100 bytes:
bpf=$(nfbpf_compile 'tcp and greater 100')
iptables -A INPUT -m bpf --bytecode "$bpf" -j ACCEPT
The description of bpf match in iptables-extensions(8) lists a few more examples.