Example shows how to filter rtnetlink messages by ifindex & oper state.
Signed-off-by: Vadim Kochan <[email protected]> --- bpfc.8 | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/bpfc.8 b/bpfc.8 index 1cde888..8a99e2e 100644 --- a/bpfc.8 +++ b/bpfc.8 @@ -305,6 +305,30 @@ words, some small example filter programs: ret #-1 drop: ret #0 .PP +.SS Filter rtnetlink messages +.PP + ldh #proto /* A = skb->protocol */ + + jneq #0, skip /* check for NETLINK_ROUTE */ + ldb [4] /* A = nlmsg_type */ + + jneq #0x10, skip /* check type == RTNL_NEWLINK */ + ldx #16 /* X = offset(ifinfomsg) */ + + ldb [x + 4] /* offset(ifi_index) */ + jneq #0x3, skip /* check ifindex == 3 */ + + ld #32 /* A = len(nlmsghdr) + len(ifinfomsg), payload offset */ + ldx #16 /* X = IFLA_OPERSTATE */ + ld #nla /* A = offset(IFLA_OPERSTATE) */ + jeq #0, skip + tax + ldb [x + 4] /* A = value(IFLA_OPERSTATE) */ + jneq #0x6, skip /* check oper state is UP */ + + ret #-1 + skip: ret #0 +.PP .SH USAGE EXAMPLE .PP .SS bpfc fubar -- 2.6.2 -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
