PROBE::NETFILTER.A(3stap)

💖 PROBE::NETFILTER.A(3stap) — Networking Tapset 💖

okay bestie, pull up a chair, we're looking at probe::netfilter.arp.in 🎀

---

✨ NAME ✨

probe::netfilter.arp.in — Called for each incoming ARP packet</p> 💌 like literally every single one that shows up at the door.

---

🌸 SYNOPSIS 🌸

probe netfilter.arp.in {}

that's it, that's the whole vibe check 👑

---

🦋 VALUES 🦋

so this probe hands you a whole goodie bag of variables. here's every single one, no skipping, no cap 💅

• ar_op — the ARP opcode, aka the command. the "what are we even doing here" field 🫶
• nf_queue — a constant that means a 'queue' verdict. it's giving "hold on, let me think" 😭
• ar_sip — Ethernet+IP only (when ar_pro==0x800): the source IP address. who sent this ✨
• nf_drop — a constant that means a 'drop' verdict. yeah we're not doing this one, bye 💀
• length — how long the packet buffer contents are, in bytes. the size tag, fr fr 📏
• indev_name — name of the network device the packet was received on (if known). the little nameplate 🎀
• nf_stop — a constant that means a 'stop' verdict. full stop, periodt ✋
• data_str — a string that represents the packet buffer contents. the packet, but make it readable 💖
• ar_tip — Ethernet+IP only (when ar_pro==0x800): the target IP address. who's it for 👀
• nf_stolen — a constant that means a 'stolen' verdict. someone else took it, not me 🙈
• outdev_name — name of the network device the packet will be routed to (if known). the destination's nameplate 🌈
• data_hex — a hexadecimal string that represents the packet buffer contents. same packet, hex edition, lowkey iconic ⭐
• outdev — address of the net_device representing the output device, 0 if unknown. the actual outgoing device object 🧚
• ar_pln — length of the protocol address 📐
• ar_data — address of the ARP packet data region, i.e. after the header. the payload's home address 🏠
• ar_sha — Ethernet+IP only (when ar_pro==0x800): the source hardware (MAC) address. sender's MAC, slay 💅
• nf_accept — a constant that means an 'accept' verdict. come on in bestie 🫶
• ar_hln — length of the hardware address 📏
• ar_pro — format of the protocol address. yes it matters, 0x800 girlies know 😌
• nf_repeat — a constant that means a 'repeat' verdict. run it back 🔁
• ar_hrd — format of the hardware address 🔧
• indev — address of the net_device representing the input device, 0 if unknown. the actual incoming device object ✨
• ar_tha — Ethernet+IP only (when ar_pro==0x800): the target hardware (MAC) address. receiver's MAC, we see you 👑
• pf — protocol family — always “arp”. always. no exceptions. periodt 💜
• arphdr — address of the ARP header. where the header actually lives 📍

ngl the "Ethernet+IP only" ones are only populated when ar_pro==0x800, so don't be shocked if they're empty on other protocol formats, bestie 🍓

---

🔥 SEE ALSO 🔥

• tapset::netfilter(3stap) — go read the whole family, iykyk 💖

---

mwah, that's the page!! this was the SystemTap Tapset Reference, version-wise it's Ver and date-wise it's September 2026, and the manual page is PROBE::NETFILTER.A(3stap). go forth and sniff those ARP packets, you absolute icon 🦋✨