Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

I am doing some research to figure out what distro's of linux contain kernel packet filtering and are compatible with BPF.

http://kernelnewbies.org/Linux_3.0

http://lwn.net/Articles/437981/

These two articles lead me to believe there is a package somewhere taht includes the libraries, and binaries?

I am specifically looking for the "pfctl" command like I have in FreeBSD

Thanks

share|improve this question

migrated from stackoverflow.com Jul 31 '12 at 2:26

1 Answer

up vote 9 down vote accepted

I think you have mixed two different things:

  1. The OpenBSD packet filter facilities (sometimes called pf, and mostly controlled by pfctl). These are the basis of OpenBSD firewalling, the Linux equivalent is netfilter, mostly controlled by the iptables command. Comparable, but not compatible (and most say that OpenBSD is superior to Linux in this aspect).

  2. The (Berkeley) packet filter (mostly controlled by the libpcap library). This is a feature of the kernel that allows an application to be notified of packets flowing through a network interface. Since usually any client is only interested in a subset of all packets, most of the library is about filtering which packets should be forwarded to the application and which shouldn't. It's used for network analyzers like tcpdump and Wireshark.

The articles you link are not about a port of the OpenBSD pf, instead they describe a new JIT that optimizes the kernel-resident filters used by libpcap.

share|improve this answer
Thanks for the explanation. Does this essentially mean that any kind of network program must be explicitly ported between linux variations and BSD variations (FreeBSD in my case)? I guess the code I have looked at included some of the bpf headers, but the rules and such were set up with pfctl. I think the mix is what was confusing me. – Derek Jul 31 '12 at 0:55
2  
There's a big gap between the firewall configuration utility and "Any kind of network program". Linux network programming interfaces are basically the same as BSD in most ways, including BPF (the one that has nothing to do with pfctl) – Alan Curry Jul 31 '12 at 1:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.