PROBE::NETFILTER.I(3stap)

💖 PROBE::NETFILTER.I(3stap) 💖

okay bestie, welcome to the Networking Tapset — this one's probe::netfilter.ip.local_in and it is literally the moment an incoming IP packet shows up addressed to your own computer. main character packet energy fr fr. 🦋

---

✨ NAME ✨

probe::netfilter.ip.local_in — called on an incoming IP packet addressed to the local computer. that's it, that's the vibe. 👑

---

🌸 SYNOPSIS 🌸

probe netfilter.ip.local_in {}

no arguments, no drama, just vibes and a curly brace. 💅

---

🎀 VALUES 🎀

okay so these are all the goodies you can peek at inside this probe. every single one, no skips, we're doing the full tour:

• outdev — address of the net_device representing the output device, or 0 if it's unknown. 🙈
• saddr — a string holding the source IP address.
• nf_accept — the constant that means an 'accept' verdict. slay, let it through. ✨
• nf_repeat — the constant that means a 'repeat' verdict.
• ack — the TCP ACK flag (only if the protocol is TCP; ipv4 only).
• psh — the TCP PSH flag (only if the protocol is TCP; ipv4 only).
• indev — address of the net_device representing the input device, or 0 if it's unknown.
• sport — TCP or UDP source port (ipv4 only).
• pf — protocol family — either "ipv4" or "ipv6". pick your fighter. 🥊
• daddr — a string holding the destination IP address.
• nf_queue — the constant that means a 'queue' verdict.
• nf_drop — the constant that means a 'drop' verdict. bye bestie 💀
• syn — the TCP SYN flag (only if the protocol is TCP; ipv4 only).
• iphdr — address of the IP header. the blueprint, the blueprint. 📋
• ipproto_udp — the constant that means the packet protocol is UDP.
• length — the length of the packet buffer contents, in bytes.
• rst — the TCP RST flag (only if the protocol is TCP; ipv4 only).
• dport — TCP or UDP destination port (ipv4 only).
• protocol — the packet protocol from the driver (ipv4 only).
• fin — the TCP FIN flag (only if the protocol is TCP; ipv4 only).
• family — the IP address family.
• indev_name — the name of the network device the packet was received on (if known). 🫶
• nf_stop — the constant that means a 'stop' verdict.
• data_str — a string representing the packet buffer contents.
• ipproto_tcp — the constant that means the packet protocol is TCP.
• urg — the TCP URG flag (only if the protocol is TCP; ipv4 only).
• nf_stolen — the constant that means a 'stolen' verdict. not me stealing packets 🙈
• outdev_name — the name of the network device the packet will be routed to (if known).
• data_hex — a hexadecimal string representing the packet buffer contents.

heads up babes: the TCP flag ones (ack, psh, syn, rst, fin, urg) and the port ones (sport, dport) only show up if the protocol is TCP and ipv4 only. protocol is ipv4 only too. don't come for me when they're not there. 😭

---

🌈 SEE ALSO 🌈

• tapset::netfilter(3stap) — go read the whole family, iykyk. 💜

---

that's the whole page bestie, you ate. 💅 this was the SystemTap Tapset Reference, dated September 2026 — mwah, sending you off with a forehead kiss and a probe netfilter.ip.local_in {} 🎀💖⭐