PROBE::NETFILTER.I(3stap)

💖 PROBE::NETFILTER.I(3stap) 💖

okay bestie, sit down, hydrate, and let's talk about a lil networking tapset probe from the SystemTap Tapset Reference (manual section 3stap, iykyk). This one is literally called:

✨ NAME ✨

probe::netfilter.ip.pre_routing — it fires before an IP packet is routed. that's the whole vibe. pre-routing. before the routing happens. the packet is just standing there, un-routed, waiting for its moment. main character energy fr.

---

🌸 SYNOPSIS 🌸

probe netfilter.ip.pre_routing {}

no args, no drama, just a little probe with empty braces. she's simple. she's iconic. 💅

---

🦋 VALUES 🦋

these are all the lil variables you get to peek at inside the probe. alphabetically listed, no cap, and every single one of them is here:

• pf — the protocol family, and it's either 'ipv4' or 'ipv6'. pick your fighter 🥊
• indev — the address of the net_device representing the input device. if it's unknown, it's 0. not me being unknown 😭
• sport — the TCP or UDP source port (ipv4 only)
• ack — the TCP ACK flag, and only if the protocol is TCP (ipv4 only)
• psh — the TCP PSH flag, again only if the protocol is TCP (ipv4 only)
• nf_accept — a constant that means an 'accept' verdict 🫶
• nf_repeat — a constant that means a 'repeat' verdict 🔁
• outdev — the address of the net_device representing the output device, 0 if it's unknown
• saddr — a string holding the source IP address ✨
• data_hex — a hexadecimal string of the packet buffer contents 🔥
• outdev_name — the name of the network device the packet will be routed to, if known
• nf_stolen — a constant that means a 'stolen' verdict 👀
• urg — the TCP URG flag, only if the protocol is TCP (ipv4 only)
• data_str — a string of the packet buffer contents 🍓
• ipproto_tcp — a constant that means the packet protocol is TCP
• nf_stop — a constant that means a 'stop' verdict ✋
• protocol — the packet protocol from the driver (ipv4 only)
• fin — the TCP FIN flag, if the protocol is TCP (ipv4 only)
• indev_name — the name of the network device the packet was received on, if known
• family — the IP address family 🌈
• dport — the TCP or UDP destination port (ipv4 only)
• rst — the TCP RST flag, if the protocol is TCP (ipv4 only)
• length — the length of the packet buffer contents, in bytes 📏
• ipproto_udp — a constant that means the packet protocol is UDP
• syn — the TCP SYN flag, if the protocol is TCP (ipv4 only)
• iphdr — the address of the IP header 👑
• nf_drop — a constant that means a 'drop' verdict 💀
• nf_queue — a constant that means a 'queue' verdict 🧚
• daddr — a string holding the destination IP address 💜

lowkey obsessed with how many of these are ipv4 only. like bestie, ipv6 said "not today" for the TCP flags and the ports and the protocol field. that's just how it is, no editorializing, just facts 🎀

---

💫 SEE ALSO 💫

• tapset::netfilter(3stap)

go read that one too, bestie, it's the whole netfilter tapset family reunion 🌸

---

and that's the page!! this came from the SystemTap Tapset Reference, version September 2026, and it's filed under PROBE::NETFILTER.I(3stap) in section 3stap. mwah, slay, go trace some packets 💅✨🦋