pf
Protocol family -- always “arp”
ar_pro
Format of protocol address
ar_pln
Length of protocol address
nf_stop
Constant used to signify a 'stop' verdict
length
The length of the packet buffer contents, in bytes
ar_sha
Ethernet+IP only (ar_pro==0x800): source hardware (MAC)
address
ar_tha
Ethernet+IP only (ar_pro==0x800): target hardware (MAC)
address
ar_data
Address of ARP packet data region (after the
header)
outdev_name
Name of network device packet will be routed to (if
known)
ar_op
ARP opcode (command)
ar_hln
Length of hardware address
ar_tip
Ethernet+IP only (ar_pro==0x800): target IP address
ar_sip
Ethernet+IP only (ar_pro==0x800): source IP address
ar_hrd
Format of hardware address
indev_name
Name of network device packet was received on (if
known)
arphdr
Address of ARP header
indev
Address of net_device representing input device, 0 if
unknown
outdev
Address of net_device representing output device, 0 if
unknown
data_str
A string representing the packet buffer contents
nf_queue
Constant used to signify a 'queue' verdict
data_hex
A hexadecimal string representing the packet buffer
contents
nf_accept
Constant used to signify an 'accept' verdict
nf_repeat
Constant used to signify a 'repeat' verdict
nf_stolen
Constant used to signify a 'stolen' verdict
nf_drop
Constant used to signify a 'drop' verdict