PROBE::NETFILTER.B(3stap)

💖 PROBE::NETFILTER.B 💖

okay bestie, so this one lives in the Networking Tapset of the SystemTap Tapset Reference (yes the 3stap girlies, we love her), and she's about one specific little moment in bridge-land 💅

---

✨ NAME ✨

probe::netfilter.bridge.local_in — Called on a bridging packet destined for the local computer 🫶

---

✨ SYNOPSIS ✨

probe netfilter.bridge.local_in {}

like, that's it. that's the whole invocation. no args, no drama, just vibes ✨

---

✨ VALUES ✨

okay this is the part where she spills ALL the tea, so grab a snack 🍓 — every one of these is a value this probe hands you:

• nf_queue — Constant used to signify a 'queue' verdict
• br_vid — Protocol version identifier
• br_bid — Identity of bridge
• br_flags — BPDU flags
• nf_drop — Constant used to signify a 'drop' verdict
• br_htime — Hello time in 1/256 secs
• br_type — BPDU type
• br_fd — Forward delay in 1/256 secs
• length — The length of the packet buffer contents, in bytes
• br_rid — Identity of root bridge
• br_cost — Total cost from transmitting bridge to root
• llcpdu — Address of LLC Protocol Data Unit
• protocol — Packet protocol
• br_poid — Port identifier
• indev_name — Name of network device packet was received on (if known)
• nf_stop — Constant used to signify a 'stop' verdict
• llcproto_stp — Constant used to signify Bridge Spanning Tree Protocol packet
• data_str — A string representing the packet buffer contents
• br_msg — Message age in 1/256 secs
• nf_stolen — Constant used to signify a 'stolen' verdict
• outdev_name — Name of network device packet will be routed to (if known)
• brhdr — Address of bridge header
• data_hex — A hexadecimal string representing the packet buffer contents
• outdev — Address of net_device representing output device, 0 if unknown
• br_rmac — Root bridge MAC address
• br_prid — Protocol identifier
• nf_accept — Constant used to signify an 'accept' verdict
• nf_repeat — Constant used to signify a 'repeat' verdict
• br_max — Max age in 1/256 secs
• indev — Address of net_device representing input device, 0 if unknown
• pf — Protocol family -- always “bridge”
• br_mac — Bridge MAC address

ngl those verdict constants (nf_queue, nf_drop, nf_stop, nf_stolen, nf_accept, nf_repeat) are giving "the netfilter girlies deciding your packet's fate" 💀 and the bridge ones are all lowkey just STP BPDU lore 🧚

---

🌈 SEE ALSO 🌈

• tapset::netfilter(3stap) — go read the whole tapset bestie, it's iconic 👑

---

and that's the page fr fr 💖 written up for the SystemTap Tapset Reference, dated September 2026 — main character energy from start to finish, periodt ✨🎀🦋