PROBE::NETFILTER.I(3stap)

📦
version 5.6 · 9 versions
, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

💖 PROBE::NETFILTER.I(3stap) 💖

okay bestie, welcome to the Networking Tapset section of the SystemTap Tapset Reference (that's the 3stap manual, iykyk) 🎀

✨ NAME ✨

probe::netfilter.ip.forward — the probe that gets called on an incoming IP packet that's addressed to some other computer 👀 like it's not even for you and you're still watching, main character energy fr fr

🌸 SYNOPSIS 🌸

probe netfilter.ip.forward {}

no args, no drama, she just fires 💅

🦋 VALUES 🦋

okay so this is the whole lineup of values this probe hands you. every single one, no skips, periodt ✨

  • syn — the TCP SYN flag (only if the protocol is TCP; ipv4 only) 🫶
  • iphdr — the address of the IP header
  • ipproto_udp — a constant that means "hey the packet protocol is UDP" 💌
  • daddr — a string holding the destination IP address
  • nf_queue — a constant that means a 'queue' verdict 📬
  • nf_drop — a constant that means a 'drop' verdict 💀
  • ipproto_tcp — a constant that means "hey the packet protocol is TCP" 💌
  • data_str — a string holding the packet buffer contents
  • nf_stolen — a constant that means a 'stolen' verdict 🙈
  • urg — the TCP URG flag (only if the protocol is TCP; ipv4 only)
  • outdev_name — the name of the network device the packet will be routed to (if that's known)
  • data_hex — a hexadecimal string holding the packet buffer contents
  • length — how long the packet buffer contents are, in bytes 📏
  • rst — the TCP RST flag (only if the protocol is TCP; ipv4 only)
  • dport — the TCP or UDP destination port (ipv4 only)
  • fin — the TCP FIN flag (only if the protocol is TCP; ipv4 only)
  • protocol — the packet protocol from the driver (ipv4 only)
  • family — the IP address family
  • indev_name — the name of the network device the packet was received on (if that's known)
  • nf_stop — a constant that means a 'stop' verdict ✋
  • nf_accept — a constant that means an 'accept' verdict ✅
  • nf_repeat — a constant that means a 'repeat' verdict 🔁
  • psh — the TCP PSH flag (only if the protocol is TCP; ipv4 only)
  • ack — the TCP ACK flag (only if the protocol is TCP; ipv4 only)
  • outdev — the address of the net_device representing the output device, 0 if it's unknown
  • saddr — a string holding the source IP address
  • pf — the protocol family — either ipv4 or ipv6 👑
  • indev — the address of the net_device representing the input device, 0 if it's unknown
  • sport — the TCP or UDP source port (ipv4 only)
ngl bestie, the ipv4 only notes are literally everywhere and they are NOT a suggestion, they're a vibe check you gotta respect 💅

🌈 SEE ALSO 🌈

and that's the whole page, you ate that 🍓🧚💜

this was brought to you by the SystemTap Tapset Reference, Ver, dated September 2026 — mwah, go read your other manpages bestie, ily 😭💖

📦 where this page comes from