PROBE::NETFILTER.B(3stap)

💖 PROBE::NETFILTER.B(3stap) 💖

okay bestie, gather round, because this is the netfilter.bridge.forward probe from the Networking Tapset and it's genuinely so much.

---

✨ NAME ✨

probe::netfilter.bridge.forward — fired when an incoming bridging packet shows up that's destined for some other computer. like, it's not for you, it's just passing through, main character energy but make it a bridge 🌉

---

🦋 SYNOPSIS 🦋

probe netfilter.bridge.forward {}

no args, no drama, she just arrives. periodt.

---

🎀 VALUES 🎀

these are all the little goodies this probe hands you. every single one, no skips, we're doing the full tour 🫶

• indev — address of the net_device representing the input device. it's 0 if it's unknown, so don't be weird about it.
• br_mac — bridge MAC address 💅
• pf — protocol family. and it's always "bridge". always. no cap. that's just her brand.
• br_prid — protocol identifier
• br_rmac — root bridge MAC address
• outdev — address of the net_device representing the output device. also 0 if unknown, twin behaviour with indev.
• nf_repeat — constant used to signify a 'repeat' verdict
• nf_accept — constant used to signify an 'accept' verdict
• br_max — max age, measured in 1/256 secs
• br_cost — total cost from transmitting bridge to root
• br_rid — identity of root bridge
• length — the length of the packet buffer contents, in bytes
• nf_stop — constant used to signify a 'stop' verdict
• indev_name — name of the network device the packet was received on (if known) 🍓
• br_poid — port identifier
• protocol — packet protocol
• llcpdu — address of LLC Protocol Data Unit
• nf_stolen — constant used to signify a 'stolen' verdict
• data_str — a string representing the packet buffer contents
• llcproto_stp — constant used to signify a Bridge Spanning Tree Protocol packet 🌈
• br_msg — message age, in 1/256 secs
• data_hex — a hexadecimal string representing the packet buffer contents
• brhdr — address of bridge header
• outdev_name — name of the network device the packet will be routed to (if known)
• nf_drop — constant used to signify a 'drop' verdict 💀
• br_htime — hello time, in 1/256 secs (hi bestie 👋)
• br_flags — BPDU flags
• br_bid — identity of bridge
• nf_queue — constant used to signify a 'queue' verdict
• br_vid — protocol version identifier
• br_type — BPDU type
• br_fd — forward delay, in 1/256 secs

ok real talk though: notice how many of these are nf_* verdict constants and how many are br_* BPDU fields? that's the whole vibe of this probe — you're standing right in the middle of netfilter verdicts and bridge protocol data units at the same time. iconic crossover episode ngl. 🔥

---

👑 SEE ALSO 👑

• tapset::netfilter(3stap)

go read that one next, it's the parent tapset and she's mother. 🧚

---

that's the whole page bestie, you ate 💅

this was the SystemTap Tapset Reference, Version September 2026 — mwah, love u, bye 🎀✨