PROBE::NETFILTER.I(3stap)

📦
version 5.6 · 9 versions
, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

💅 PROBE::NETFILTER.I 💅

okay bestie, welcome to the Networking Tapset corner of the SystemTap manual — this is probe::netfilter.ip.local_out(3stap) and she is, lowkey, the main character of every outgoing packet's little story. 🦋

✨ NAME ✨

probe::netfilter.ip.local_out — the probe that gets called on an outgoing IP packet. yes. every time a packet leaves, she's there. she's always there. 🫶

🎀 SYNOPSIS 🎀

probe netfilter.ip.local_out {}

that's it. that's the whole thing. no arguments, no drama, just vibes. 💅

🌸 VALUES 🌸

these are all the lil variables you get handed inside the probe. read them, love them, they're your children now. ✨

  • nf_repeat — a constant that means the verdict is 'repeat'. she said run it back. 🔁
  • nf_accept — a constant that means the verdict is 'accept'. the packet is getting through, periodt. ✅
  • ack — the TCP ACK flag. only exists if the protocol is TCP, and ipv4 only. acknowledging you, always. 👑
  • psh — the TCP PSH flag (if protocol is TCP; ipv4 only). push it, push it. 💅
  • saddr — a string holding the source IP address. where it came from. her origin story. 🌱
  • outdev — the address of the net_device representing the output device, or 0 if it's unknown. it's giving "idk her". 🙈
  • pf — the protocol family, and it's literally either "ipv4" or "ipv6". pick a lane bestie. 🌈
  • sport — the TCP or UDP source port (ipv4 only). the lil door number it left through. 🚪
  • indev — the address of the net_device representing the input device, or 0 if unknown. mystery machine energy. 🕵️
  • ipproto_udp — a constant meaning the packet protocol is UDP. no handshake, just send it. 📨
  • iphdr — the address of the IP header. the receipts, basically. 🧾
  • syn — the TCP SYN flag (if protocol is TCP; ipv4 only). the iconic opener, the "hey stranger". 👋
  • nf_queue — a constant meaning the verdict is 'queue'. get in line, babe. 🚶‍♀️
  • nf_drop — a constant meaning the verdict is 'drop'. it's over. she's not coming. 💀
  • daddr — a string holding the destination IP address. where she's headed. her five year plan. 🗺️
  • outdev_name — the name of the network device the packet will be routed to (if it's known, no promises ✨).
  • data_hex — a hexadecimal string of the packet buffer contents. hexadecimal is so slay, iykyk. 🔥
  • ipproto_tcp — a constant meaning the packet protocol is TCP. three way handshake, three course meal. 🤝
  • data_str — a plain old string of the packet buffer contents. the same tea, different mug. ☕
  • nf_stolen — a constant meaning the verdict is 'stolen'. somebody took it. not me though. 🙈
  • urg — the TCP URG flag (if protocol is TCP; ipv4 only). urgent!! like my need for snacks. 🍓
  • protocol — the packet protocol from the driver (ipv4 only). straight from the source, no filter. 📸
  • fin — the TCP FIN flag (if protocol is TCP; ipv4 only). goodbye forever, or at least until the next connection. 😭
  • family — the IP address family. the whole family tree, together at last. 👨‍👩‍👧
  • indev_name — the name of the network device the packet was received on (if known).
  • nf_stop — a constant meaning the verdict is 'stop'. halt. cease. no more. ✋
  • length — the length of the packet buffer contents, in bytes. size matters, allegedly. 📏
  • dport — the TCP or UDP destination port (ipv4 only). the door she's knocking on. 🚪✨
  • rst — the TCP RST flag (if protocol is TCP; ipv4 only). the dramatic exit. slamming the door on the way out. 💅
ngl bestie, a bunch of these are tagged ipv4 only — so if you're living your ipv6 truth, don't go looking for those. they simply won't be there. 🧚

🦋 SEE ALSO 🦋

okay that's the whole page!! 🎀 this was the SystemTap Tapset Reference, version September 2026 — drink some water, go touch grass, and remember: your packets love you. bye bestie!! 🌈👑💜

📦 where this page comes from