WinDis 32 Berkeley Packet Filter (BPF) Programming

Remarks

Several PCAUSA customers have asked for additional information concerning development of BPF programs. Unfortunately, there is not a lot of additional information available.

This PCAUSA KB Article attempts to provide a little more information.

Additional BPF Program Fragments

The BPF Samples file contains some additional BPF program fragments.

Building BPF programs

The BPF mechanism is extremely useful. However, it is a little difficult to understand.

Most of the information about programming the BPF is contained these documents:

Conceptually, the BPF pseudo-machine is a software emulation of a very simple processor with just enough capability to be useful in filtering packets. There's currently no compiler or interpretive language to assist in building BPF programs available on the Windows platform (at least, not from PCAUSA). However, there is a macro language. WinDis 32 includes a function which allows a BPF program to be displayed in various ways to help understand the data flow (see the HookPeek /d, /dd and /ddd options and the bpf_dump function).

The HookPeek application includes several sample BPF filters. In fact, the filters include: IP, TCP, UDP, ICMP, IGMP, ARP, RARP, AppleTalk, NETBIOS and SPX/IPX. The reason for providing so many is not to actually attempt to make HookPeek be a useful program. Instead, these filters are intended to provide several different BPF samples to aid developers in understanding how the BPF can be used.

Example BPF Filter

The following provides an additional example of building a BPF filter program using the BPF macros defined in BPF.H. The example starts out with the customer's requirement:

"We want to get all TCP packets with source port #A or destination port #B"

The following steps illustrate building a BPF program which meets this requirement

Setp 1. Accept Ethernet Internet Protocol (IP) Packets

On Ethernet packets are demultiplexed using the Ethernet type field, which is a two-byte value starting at offset 12 in the Ethernet link header. Internet Protocol (IP) packets have an Ethernet type of 0x0800.

The following set of BPF pseudo-machine instructions implements a simple filter which accepts Ethernet IP packets:

Step 2. Accept IP Transmission Control Protocol (TCP) Packets

The Internet Protocol (IP) encapsulates several IP protocols, notably including TCP, UDP, ICMP and IGMP. IP protocols are differentiated by the IP protocol type, which is a one-byte field at offset 9 into the IP header. The Ethernet link address header is 14 bytes long, so on Ethernet the IP protocol type is at offset 23 into the Ethernet packet.

The following set of BPF pseudo-machine instructions implements a simple filter which accepts IP packets which have the TCP IP protocol type. The first two BPF pseudo-machine instructions make the test to determine if the packet has Ethernet type 0x0800; these instructions are the same as those used in the simple IP filter described in the preceding section - EXCEPT that the false condition jump offset is increased by two to account for the two extra BFP instructions necessary to test for TCP.

The second two BPF pseudo machine instructions are executed ONLY if the packet is an IP packet. They check the IP protocol type byte at offset 14 + 9 = 23 into the Ethernet packet.

Step 3. Reject All But First Fragment

TCP port numbers are found in the TCP header, and the TCP header is only present in the first fragment. So, it is necessary to reject all packets IP packets with a non-zero fragment offset. Two more BPF instructions must be added to test the fragment offset word at offset 14 + 6 = 20 into the Ethernet packet and reject the packet, if necessary.

The following set of BPF pseudo-machine instructions implements a simple filter which accepts IP packets which have the TCP IP protocol type and have the TCP header present (i.e., first fragment):

Step 4. Accept Packets With A Specified TCP Source Port

The following set of BPF pseudo-machine instructions implements a simple filter which accepts IP packets which have the TCP IP protocol type and have the TCP header present and the TCP source port is Echo (7):

Step 5. Accept Packets With A Specified TCP Source Port Or Specified TCP Destination Port

The following set of BPF pseudo-machine instructions implements a simple filter which accepts IP packets which have the TCP IP protocol type and have the TCP header present and the TCP source port or TCP destination port is Echo (7):

Status

Mailing Lists  · PCAUSA Newsletter · PCAUSA Discussion List
· Privacy Statement · 

WinDis 32 is a trademark of Printing Communications Assoc., Inc. (PCAUSA).
Rawether for Windows and Rawether .NET are trademarks of Printing Communications Assoc., Inc. (PCAUSA).
Microsoft, MS, Windows, Windows 95, Windows 98, Windows Millennium, Windows 2000, Windows XP, and Win32 are registered trademarks and Visual C++ and Windows NT are trademarks of the Microsoft Corporation.
Send mail to rawether-webmaster@pcausa.com with questions or comments about this web site.
Copyright © 1996-2008 Printing Communications Assoc., Inc. (PCAUSA).
All rights reserved.
Last modified: December 31, 2007