DOKK / manpages / debian 10 / systemtap-doc / probe::netfilter.arp.in.3stap.en
PROBE::NETFILTER.A(3stap) Networking Tapset PROBE::NETFILTER.A(3stap)

probe::netfilter.arp.in - - Called for each incoming ARP packet

netfilter.arp.in 

pf

Protocol family -- always “arp”

ar_pro

Format of protocol address

ar_pln

Length of protocol address

nf_stop

Constant used to signify a 'stop' verdict

length

The length of the packet buffer contents, in bytes

ar_sha

Ethernet+IP only (ar_pro==0x800): source hardware (MAC) address

ar_tha

Ethernet+IP only (ar_pro==0x800): target hardware (MAC) address

ar_data

Address of ARP packet data region (after the header)

outdev_name

Name of network device packet will be routed to (if known)

ar_op

ARP opcode (command)

ar_hln

Length of hardware address

ar_tip

Ethernet+IP only (ar_pro==0x800): target IP address

ar_sip

Ethernet+IP only (ar_pro==0x800): source IP address

ar_hrd

Format of hardware address

indev_name

Name of network device packet was received on (if known)

arphdr

Address of ARP header

indev

Address of net_device representing input device, 0 if unknown

outdev

Address of net_device representing output device, 0 if unknown

data_str

A string representing the packet buffer contents

nf_queue

Constant used to signify a 'queue' verdict

data_hex

A hexadecimal string representing the packet buffer contents

nf_accept

Constant used to signify an 'accept' verdict

nf_repeat

Constant used to signify a 'repeat' verdict

nf_stolen

Constant used to signify a 'stolen' verdict

nf_drop

Constant used to signify a 'drop' verdict

tapset::netfilter(3stap)

October 2018 SystemTap Tapset Reference