BPF (Berkeley Packet Filter)
Definition
A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF expressions such as 'port 443' or 'host 10.0.0.1' reduce capture file size and focus collection on relevant traffic. The filter runs in the kernel before packets reach user space, minimising CPU load.
- Level
- Kernel-level packet filtering
- Used by
- tcpdump, Wireshark, capture tools
- Example expression
- port 443, host 10.0.0.1
- Benefit
- Reduces capture size, minimises CPU load
Common questions
Why does filtering in the kernel matter compared to filtering after capture?+
A BPF filter discards unwanted packets before they are copied to user space, so on a busy link it avoids the disk I/O and CPU cost of writing and later filtering out traffic that was never relevant to the investigation.
Can a BPF capture filter miss evidence if written incorrectly?+
Yes, an overly narrow filter can silently drop packets an investigator later needs, which is why many forensic workflows favour capturing broadly and applying a display filter afterward for analysis, reserving strict BPF capture filters for high-volume or storage-constrained situations.
Is BPF the same thing as a firewall rule?+
They serve different purposes: BPF selects which packets a capture tool records or a program inspects, while a firewall rule decides whether a packet is allowed to pass through the network at all, though both use similar match syntax.
Related terms
- Network Tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- Promiscuous Mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...
- JA3 / JA3S
- An MD5 fingerprint of the ordered fields of a TLS Client Hello (JA3) or Server Hello (JA3S). Allows identification of client software...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- PCAP / PCAPng
- The standard file formats for storing captured packets. PCAP (libpcap format) is the legacy standard supported by virtually all tools. PCAPng (Next...
- PCAPng
- PCAP Next Generation file format. Block-structured (SHB, IDB, EPB, ISB, DSB), supports multiple interfaces in one file, per-packet comments, name resolution, and...
- Ring Buffer Capture
- A capture mode in which the tool writes successive PCAP files of a fixed size or duration, overwriting the oldest when the...
- SPAN Port (Port Mirroring)
- A switch feature that copies frames from one or more source ports or VLANs to a designated destination port, where a capture...
Explained in these topics
- Live Packet Capture, Traffic Analysis and Deep Packet InspectionThe kernel-level filter language used by libpcap, tcpdump, Wireshark capture filters, Zeek and many flow exporters. Operates before the packet hits user space,...
- Packet Capture Tools and Methods