Module org.jnetpcap

Package org.jnetpcap

Class BpFilter

java.lang.Object

org.jnetpcap.BpFilter

All Implemented Interfaces:

AutoCloseable

public final class BpFilter
extends Object
implements AutoCloseable

Berkeley Packet Filter (BPF) program implementation for packet filtering. This class encapsulates a compiled BPF program that can be applied to network packets to determine if they match specific criteria.

Native Structure

Each filter instruction is represented as a 64-bit value that maps to the following C structure from pcap/bpf.h:

 struct bpf_insn {
     u_short     code;     // Operation code
     u_char      jt;       // Jump if true
     u_char      jf;       // Jump if false
     bpf_u_int32 k;       // Generic field
 };
 

Usage Example

 // Create and compile a filter for TCP packets on port 80
 try (BpFilter filter = new BpFilter("tcp port 80")) {
     Pcap pcap = ...;
     pcap.compile(filter, true, 0);
     pcap.setFilter(filter);
 }
 

Memory Management

The class implements AutoCloseable to ensure proper deallocation of native resources. The filter must be explicitly closed when no longer needed to prevent memory leaks.

Author:

Sly Technologies, repos@slytechs.com

See Also:

• Pcap.compile(String, boolean, int)
• PCap-Filter man page

Method Summary

Modifier and Type	Method	Description
void	close()	Deallocates the native BPF program and associated resources.
static void	freeCode(BpFilter bpFilter)	Deallocates a native BPF program.
int	length()	Returns the number of instructions in this BPF program.
String	toString()	Returns the original filter expression string used to create this filter.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Details

freeCode

public static void freeCode(BpFilter bpFilter)

Deallocates a native BPF program. This is a convenience method equivalent to calling close() on the filter.

Parameters:

bpFilter - The filter to deallocate

Throws:

IllegalStateException - if the filter has already been closed

Since:

libpcap 0.6

See Also:

• Pcap.compile(String, boolean, int)
• pcap_freecode

close

public void close()
           throws IllegalStateException

Deallocates the native BPF program and associated resources. After calling this method, the filter can no longer be used.

Specified by:

close in interface AutoCloseable

Throws:

IllegalStateException - if the filter has already been closed

See Also:

• AutoCloseable.close()

length

public int length()

Returns the number of instructions in this BPF program. Each instruction is a 64-bit value containing operation code and parameters.

Returns:

The number of BPF instructions in this filter

toString

public String toString()

Returns the original filter expression string used to create this filter.

Overrides:

toString in class Object

Returns:

The filter expression string