PROBE::NETFILTER.I(3stap)

📦
version 5.6 · 9 versions
, in centos-stream 10, centos-stream 9, fedora 43, fedora 44

✨ PROBE::NETFILTER.I(3stap) ✨

okay bestie, welcome to the Networking Tapset corner of the SystemTap Tapset Reference 💖 this is the manual page for a probe called probe::netfilter.ip.post_routing, and no cap, it's a good one.

🌸 NAME 🌸

probe::netfilter.ip.post_routing — called immediately before an outgoing IP packet leaves the computer 🦋

like. literally right at the door. the packet is putting its shoes on. that's when you get pinged. 💅

🎀 SYNOPSIS 🎀

probe netfilter.ip.post_routing {}

that's it, that's the whole vibe. no args, no drama, just the probe. periodt ✨

👑 VALUES 👑

these are all the goodies you get handed inside the probe. every single one, in order, no skips 🫶

  • syn — the TCP SYN flag, but only if the protocol is TCP, and ipv4 only bestie
  • iphdr — the address of the IP header
  • ipproto_udp — a constant that means "this packet's protocol is UDP" 💙
  • daddr — a string holding the destination IP address
  • nf_queue — a constant used to signify a 'queue' verdict
  • nf_drop — a constant used to signify a 'drop' verdict 💀
  • ipproto_tcp — a constant that means "this packet's protocol is TCP"
  • data_str — a string representing the packet buffer contents
  • nf_stolen — a constant used to signify a 'stolen' verdict 🙈
  • urg — the TCP URG flag, if protocol is TCP, ipv4 only
  • outdev_name — name of the network device the packet will be routed to (if it's known, that is)
  • data_hex — a hexadecimal string representing the packet buffer contents
  • length — how long the packet buffer contents are, in bytes
  • dport — the TCP or UDP destination port (ipv4 only)
  • rst — the TCP RST flag, if protocol is TCP, ipv4 only
  • fin — the TCP FIN flag, if protocol is TCP, ipv4 only
  • indev_name — name of the network device the packet was received on (if known)
  • family — the IP address family
  • protocol — packet protocol from the driver (ipv4 only)
  • nf_stop — a constant used to signify a 'stop' verdict
  • nf_accept — a constant used to signify an 'accept' verdict ✅
  • nf_repeat — a constant used to signify a 'repeat' verdict
  • ack — the TCP ACK flag, if protocol is TCP, ipv4 only
  • psh — the TCP PSH flag, if protocol is TCP, ipv4 only
  • outdev — the address of the net_device representing the output device, or 0 if it's unknown
  • saddr — a string representing the source IP address
  • pf — the protocol family, and it's either "ipv4" or "ipv6" — those are the only two options bestie
  • indev — the address of the net_device representing the input device, or 0 if it's unknown
  • sport — the TCP or UDP source port (ipv4 only)
heads up: a whole bunch of these are tagged ipv4 only, so don't come crying to me when they're not there on a v6 packet 😭 the manpage said it, not me.

🔥 SEE ALSO 🔥

and that's the whole page, bestie!! 🌈 go forth and trace those outgoing packets, you absolute icon 👑

SystemTap Tapset Reference · September 2026 · page PROBE::NETFILTER.I(3stap) — mwah, take care of her 💖✨🎀

📦 where this page comes from