Performs packet-capture-related control operations.
The Berkeley Packet Filter (BPF) ioctl commands perform a variety of packet-capture-related control. The fd argument is a BPF device descriptor. For non-packet-capture descriptors, functions performed by this call are unspecified.
The cmd parameter and an optional third parameter (with varying types) are passed to and interpreted by the BPF ioctl function to perform an appropriate control operation that is specified by the user.
| Item | Description |
|---|---|
| fd | Specifies an open file descriptor that refers to a BPF device created using the open call. |
| cmd | Selects the control function to be performed. |
| arg | Represents additional information that is needed to perform the requested function. The type of the arg parameter is either an integer or a pointer to a BPF-specific data structure, depending on the particular control request. |
In addition to the FIONREAD ioctl command, the following commands can be applied to any open BPF device. The arg parameter is a pointer to the indicated type.
| ioctl command | Type of the arg parameter | Description |
|---|---|---|
| BIOCGBLEN | u_int | Returns the buffer length for reads on BPF devices. |
| BIOCSBLEN | u_int | Sets the buffer length for reads on BPF devices. The buffer parameter must be set before the device is attached to an interface with the BIOCSETIF command. If the requested buffer size cannot be accommodated, the closest allowable size is set and returned in the arg parameter. |
| BIOCGDLT | u_int | Returns the type of the data link layer underlying the attached interface. |
| BIOCPROMISC | N/A | Forces the interface into promiscuous mode. All packets, not just those destined for the local host, are processed. A listener that opened its interface nonpromiscuously can receive packets promiscuously, because more than one device can be listening on a given interface. The problem can be remedied with an appropriate filter. |
| BIOCFLUSH | N/A | Flushes the buffer of incoming packets, and resets the statistics that are returned by the BIOCGSTATS command. |
| BIOCGETIF | struct ifreq | Returns the name of the hardware interface that the device is listening on. The name is returned in the ifr_name field of the ifreq structure. All other fields are undefined. |
| BIOCSETIF | struct ifreq | Sets the hardware interface associate with the device. This command must be performed before any pack-packets can be read. The device is indicated by the name using the ifr_name field of the ifreq structure. Additionally, the command performs the actions of the BIOCFLUSH command. |
| BIOCGRTIMEOUT | struct timeval | Gets the read timeout value. The arg parameter specifies the length of time to wait before a read request times out. This parameter is initialized to zero by an open, indicating no timeout. |
| BIOCSRTIMEOUT | struct timeval | Sets the read timeout value described in the BIOCGRTIMEOUT command. |
| BIOCGSTATS | struct bpf_stat | Returns the a structure of packet statistics. The structure is defined in the net/bpf.h file. |
| BIOCIMMEDIATE | u_int | Enables or disables the immediate mode, based on the truth value of the arg parameter. When the immediate mode is enabled, reads return immediately upon packet reception. Otherwise, a read will be blocked until either the kernel buffer becomes full or a timeout occurs. |
| BIOCSETF | struct bpf_program | Sets the filter program used by the kernel to discard uninteresting packets. The bpf_program structure is defined in the net/bpf.h file. |
| BIOCVERSION | struct bpf_version | Returns the major and minor version numbers of the filter language currently recognized by the kernel. Before installing a filter, applications must check that the current version is compatible with the running kernel. The current version numbers are given by the BPF_MAJOR_VERSION and BPF_MINOR_VERSION variables from the net/bpf.h file. An incompatible filter might result in undefined behavior. |
Upon successful completion, ioctl returns a value of 0. Otherwise, it returns a value of -1 and sets errno to indicate the error.
| Item | Description |
|---|---|
| EINVAL | A command or argument, which is not valid, was specified. |
| ENETDOWN | The underlying interface or network is down. |
| ENXIO | The underlying interface is not found. |
| ENOBUFS | Insufficient memory was available to process the request. |
| EEXIST | The BPF device already exists. |
| ENODEV | The BPF device could not be set up. |
| EINTR | A signal was caught during an ioctl operation. |
| EACCES | The permission was denied for the specified operation. |
| EADDRNOTAVAIL | The specified address is not available for interface. |
| ENOMEM | The available memory is not enough. |
| ESRCH | Such a process does not exist. |