PROBE::NETFILTER.A(3stap)

💖 PROBE::NETFILTER.ARP.FORWARD 💖

okay bestie, we're diving into probe::netfilter.arp.forward from the Networking Tapset of the SystemTap Tapset Reference, and honestly? she's giving "tiny hook, huge lore" energy. ✨

---

🌸 NAME 🌸

probe::netfilter.arp.forward</p> — called for each ARP packet that's about to be forwarded. yes, every single one. she does not skip. 💅

---

🦋 SYNOPSIS 🦋

probe netfilter.arp.forward {}

that's it. that's the whole vibe. no arguments, no drama, just a probe that fires and hands you a whole goodie bag of values. 🎀

---

✨ VALUES ✨

so when this probe goes off, here's everything you get to peek at. no cap, there are a LOT of them:

• nf_stolen — constant used to signify a 'stolen' verdict 🫶
• ar_tip — Ethernet+IP only (that's when ar_pro==0x800): target IP address
• data_str — a string representing the packet buffer contents
• data_hex — a hexadecimal string representing the packet buffer contents
• outdev_name — name of the network device the packet will be routed to (if it's known, that is) 👑
• length — the length of the packet buffer contents, in bytes
• nf_stop — constant used to signify a 'stop' verdict
• indev_name — name of the network device the packet was received on (if known)
• ar_op — ARP opcode (that's the command, iykyk)
• nf_drop — constant used to signify a 'drop' verdict 💀
• ar_sip — Ethernet+IP only (when ar_pro==0x800): source IP address
• nf_queue — constant used to signify a 'queue' verdict
• pf — protocol family — and it is always “arp” (she's committed, fr fr)
• ar_tha — Ethernet+IP only (when ar_pro==0x800): target hardware (MAC) address
• arphdr — address of the ARP header
• indev — address of the net_device representing the input device, 0 if unknown
• nf_repeat — constant used to signify a 'repeat' verdict
• nf_accept — constant used to signify an 'accept' verdict ✅
• ar_pro — format of the protocol address
• ar_hln — length of the hardware address
• ar_hrd — format of the hardware address
• outdev — address of the net_device representing the output device, 0 if unknown
• ar_sha — Ethernet+IP only (when ar_pro==0x800): source hardware (MAC) address
• ar_data — address of the ARP packet data region (that's the part after the header, bestie)
• ar_pln — length of the protocol address

lowkey obsessed with how many fields this one probe hands you. main character energy for real. 💜

---

🧚 SEE ALSO 🧚

• tapset::netfilter(3stap) — go read the whole family, she's got siblings 💖

---

and that's the whole page, bestie!! shoutout to the SystemTap Tapset Reference, September 2026 edition, for being the source of all this knowledge — you ate that. mwah 💋✨🌈