This tool, BPF Exam, illustrates the theory of Berkeley Packet Filter compilation and the practice of its reference implementation in libpcap. It can be used for troubleshooting and debugging as well. To understand what it does, just press the "examine" button below, see some outputs and continue reading.

Compilation of a BPF expression consists of several steps. The first step translates the expression string into a control flow graph (CFG). The second step is conditional, as specified using the optimize argument to pcap_compile(3PCAP); it optimizes the CFG as discussed in detail in this document. The third step translates the CFG into binary bytecode, which can be used by the OS kernel.

Given a set of input parameters below, BPF Exam tries to produce a number of outputs. The first output, which is specific to the DLT_EN10MB link-layer header type only, is a filter expression that should have the same effect as the input filter expression, but includes all the implied predicates explicitly as determined using Caper, which implements the theory set out in this document. The second output, also produced using Caper, is present only if the first output is present and is an automatic English interpretation of the filter expression. Then follows the compiled filter (also known as "filter program" or "packet-matching code") as a sequence of BPF instructions in three formats: an output of tcpdump -d (which is explained in detail in this document), a disassembly produced by Radare2 and a version generated by Caper (again, for DLT_EN10MB only). BPF Exam also tries to reconstruct the final CFG using Radare2 and Graphviz. All these outputs stand for the unoptimized compilation of the filter.

Then, if the optimization attempt has not failed (which can happen, for example, because the filter rejects all packets), BPF Exam displays respective outputs for the optimized compilation plus a snapshot of the CFG for every step of the optimization procedure. The procedure may be internally skipped by libpcap code for some link-layer header types or filter keywords, in which case the unoptimized and the optimized outputs are exactly the same and there are no step-by-step CFG snapshots.

The default filter expression is simple, but representative of everyday BPF usage. You are welcome to experiment with different filter expressions and link-layer header types. If you have any feedback about this tool, please send it to the mailing list.

Input parameters