nfbpf_compile man page

nfbpf_compile ā€” generate bytecode for use with xt_bpf

Synopsis

nfbpf_compile [ LLTYPE ] PROGRAM

LLTYPE := { EN10MB | RAW | SLIP | ... }

Description

The nfbpf_compile utility aids in generating BPF byte code suitable for passing to the iptables bpf match.

Options

LLTYPE

Link-layer header type to operate on. This is a name as defined in <pcap/dlt.h> but with the leading DLT_ prefix stripped. For use with iptables, RAW should be the right choice (it's also the default if not specified).

PROGRAM

The BPF expression to compile, see pcap-filter(7) for a description of the language.

Exit Status

The program returns 0 on success, 1 otherwise.

Example

Match incoming TCP packets with size bigger than 100 bytes:

bpf=$(nfbpf_compile 'tcp and greater 100')
iptables -A INPUT -m bpf --bytecode "$bpf" -j ACCEPT

The description of bpf match in iptables-extensions(8) lists a few more examples.

See Also

iptables-extensions(8), pcap-filter(7)

Info

iptables 1.8.3