[tcpdump-workers] BPF Extended: addressing BPF's shortcomings

Paul "LeoNerd" Evans leonerd at leonerd.org.uk
Wed Jun 10 11:08:33 EDT 2015

On Wed, 10 Jun 2015 23:17:20 +1000
Darren Reed <darrenr at netbsd.org> wrote:

> BPF & IPv6
> ----------
> The problem with IPv6 and BPF is that the transport header (TCP,
> UDP, etc) can have a number of extension headers between it and
> the network header that is present for IPv6. There's no hints in
> the IPv6 header as to how many of these extension headers there
> are, or how many bytes the extension header(s) take up. This leaves
> BPF in a precarious situation because it cannot be reliably used to
> match on layer 4 packets. What's missing is the ability to either
> find a specific header after the IPv6 network header or just to
> determine what the last one is.

If you're considering extending BPF to better suit IPv6, have you seen
either of my proposed ideas?

 1) Add a LOOP instruction that allows certain kinds of
    backward-directed jumps, in order to efficiently implement the IPv6
    header-chain walking without needing manual loop unrolling, while
    still giving static guarantees about eventual termination of the

 2) A few more AD constants added to the Linux "auxdata" area, giving
    information about the transport layer.

Both of these ideas are ones I've tried to point either Linux or
FreeBSD in the direction of, and received almost total silence on. If
you did want to make some direct impact on making IPv6 easier to
handle, I'd suggest either or both of these would make a great start.

Paul "LeoNerd" Evans

leonerd at leonerd.org.uk
http://www.leonerd.org.uk/  |  https://metacpan.org/author/PEVANS

More information about the tcpdump-workers mailing list