PROBE::NETFILTER.A(3stap)

📦
version 5.6 · 9 versions
, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

🦋 probe::netfilter.arp.out — a SystemTap tapset page, bestie edition 💖

okay so this is PROBE::NETFILTER.A(3stap), from the Networking Tapset chapter of the SystemTap Tapset Reference. It's a probe point, it's about ARP, and it's literally going to tell you everything you ever wanted to know about outgoing ARP packets. slay. 🎀

✨ NAME ✨

probe::netfilter.arp.out — Called for each outgoing ARP packet 🫶

that's it. that's the whole vibe. every single time an ARP packet goes out the door, this probe is there. main character energy fr fr. 👑

✨ SYNOPSIS ✨

probe netfilter.arp.out {}

no arguments, no parameters, no drama. she takes nothing and gives you everything. iconic. 💅

✨ VALUES ✨

bestie these are the local variables you get handed inside the probe body. there's like twenty-five of them, so grab a snack, we're going through all of them, no skipping, no cap. 🍓

  • indev — the address of the net_device that represents the input device. and if nobody knows which one it is? it's just 0. 🤷
  • arphdr — the address of the ARP header. that's where the header lives. that's the address. 💜
  • pf — the protocol family. and it's always "arp". always. every time. it's giving commitment. 🌸
  • ar_tha — Ethernet+IP only (i.e. when ar_pro==0x800): the target hardware (MAC) address. 🎀
  • ar_sha — Ethernet+IP only (i.e. when ar_pro==0x800): the source hardware (MAC) address. 💖
  • ar_data — the address of the ARP packet data region, which is the part after the header. yes, after. 🦋
  • ar_pln — the length of the protocol address. 📏
  • outdev — the address of the net_device representing the output device. unknown? 0. again. consistency queen. ✨
  • ar_hrd — the format of the hardware address. 🧚
  • nf_repeat — a constant used to signify a 'repeat' verdict. 🔁
  • ar_pro — the format of the protocol address. 💫
  • nf_accept — a constant used to signify an 'accept' verdict. ✅
  • ar_hln — the length of the hardware address. 📐
  • nf_stop — a constant used to signify a 'stop' verdict. 🛑
  • indev_name — the name of the network device the packet was received on, if known. 🙈
  • length — the length of the packet buffer contents, measured in bytes. 🔢
  • data_hex — a hexadecimal string representing the packet buffer contents. hex girl summer. 🌈
  • outdev_name — the name of the network device the packet will be routed to, if known. 🛣️
  • nf_stolen — a constant used to signify a 'stolen' verdict. 😳
  • ar_tip — Ethernet+IP only (i.e. when ar_pro==0x800): the target IP address. 🎯
  • data_str — a string representing the packet buffer contents. 📝
  • nf_drop — a constant used to signify a 'drop' verdict. 💀
  • ar_sip — Ethernet+IP only (i.e. when ar_pro==0x800): the source IP address. 📬
  • nf_queue — a constant used to signify a 'queue' verdict. ⏳
  • ar_op — the ARP opcode, aka the command. 🕹️
heads up bestie: ar_tha, ar_sha, ar_tip and ar_sip only show up for the Ethernet+IP situation where ar_pro==0x800. everything else is there for the ride. don't get caught lacking. 💅

✨ SEE ALSO ✨

and that's the page!! thanks for coming to my ted talk. now go probe some ARP packets and be normal about it. 🌟

this was the SystemTap Tapset Reference, version-y bits as of September 2026, and the manual is PROBE::NETFILTER.A(3stap). mwah. bye bestie, go be iconic 💖✨🎀🦋🌸

📦 where this page comes from