BPE(4)

💅 BPE(4) — the Kernel Interfaces Manual, but make it make sense 🎀

ok so bestie, this is bpe(4) from the Kernel Interfaces Manual — yes the kernel one, we're going deep today, grab a strawberry 🍓

✨ NAME ✨

bpe — the Backbone Provider Edge pseudo-device. that's it, that's the name, she's iconic 👑

🌸 SYNOPSIS 🌸

pseudo-device bpe

literally one line. we love a low-effort queen 💅

🦋 DESCRIPTION 🦋

okay so the bpe driver makes IEEE 802.1Q Provider Backbone Bridge (PBB) networks happen by acting as a Backbone Edge Bridge (BEB). PBB also goes by mac-in-mac (iykyk), and it was originally specified in IEEE 802.1ah-2008 before becoming part of IEEE 802.1Q-2011. glow-up of the century fr fr ✨

So a Provider Backbone Bridge Network (PBBN) is a bunch of BEBs wired together by Backbone Core Bridges (BCBs) to form an Ethernet network that carries around encapsulated Ethernet packets. Sounds simple. It is not, but stay with me 🫶

Here's the vibe check on the difference: VLAN and SVLAN protocols just add a shim to tell different networks' Ethernet packets apart — but they keep the Ethernet addresses of the encapsulated traffic. PBB? PBB completely encapsulates Ethernet packets before sending them between BEBs on a PBBN. What that buys you: intermediate BCB devices on the backbone network don't have to learn the Ethernet addresses of devices on the encapsulated network at all. What it costs you: every BEB has to maintain its own mapping of addresses on the encapsulated network → peer BEBs. no free lunch bestie 😭

A PBB packet is literally another Ethernet frame containing:

Ethernet addresses for BEBs and the PBB Ethernet protocol type 0x88e7
a 32-bit Backbone Service Instance Tag (I-TAG)
followed by the encapsulated Ethernet frame

and the I-TAG contains a 24-bit Backbone Service Instance Identifier (I-SID) to differentiate different PBBNs on the same backbone network 👑

Now — IEEE 802.1Q describes customer VLANs being encapsulated by PBB, which in turn uses an S-VLAN service. You can absolutely build this with vlan(4) using a bpe interface as the parent, and with the bpe interface using svlan(4) as the parent. but here's the thing: bpe doesn't require this topology at all, which is exactly why deployment and network topologies stay flexible 💖

The bpe driver implements a learning bridge on each interface, and it learns the mapping of BEPs to encapsulated Ethernet address from traffic received from other devices on the backbone network. Traffic headed to broadcast, multicast, or unknown unicast Ethernet addresses gets flooded to a multicast address on the backbone network. And the multicast address for each PBB Service Instance starts with 01:1e:83 as the first three octets, with the I-SID as the last three octets. Example time, because examples slay: a bpe interface with a vnetid of 1024 (0x400 in hex) gets a multicast group address of 01:1e:83:00:04:00 ⭐

important detail, don't skip: the address learning in bpe only uses the Ethernet addresses of encapsulated traffic for its forwarding decisions. it does not use VLAN or S-VLAN tags to differentiate services. periodt 💀

You can create bpe interfaces at runtime with the ifconfig bpeN create command, or by setting up a hostname.if(5) configuration file for netstart(8). The interface itself gets configured with ifconfig(8) — go read its manual page for more, I'll wait 🧚

bpe interfaces must be configured with a parent Ethernet interface to operate, plus a virtual network identifier for use as the I-SID. non-negotiable, bestie 🎀

The I-TAG includes a priority field, and by default the value of the priority field in a transmitted packet is based on the priority of packets sent over the interface — which may be altered via pf.conf(5) (see the prio option for more). Alternatively, txprio can set a specific priority for transmitted packets. your choice, both valid 💜

bpe interfaces support the following ioctl(2)s:

SIOCSIFPARENT struct if_parent * — set the parent interface. heads up: the parent may only be configured while the virtual interface is administratively down.
SIOCGIFPARENT struct if_parent * — get the currently configured parent interface.
SIOCDIFPARENT struct ifreq * — delete the parent interface configuration. again, the parent may only be removed while the virtual interface is administratively down 🙈
SIOCSVNETID struct ifreq * — set the virtual network identifier. valid identifiers are 24-bit values in the range 0 to 16777215.
SIOCGVNETID struct ifreq * — get the currently configured virtual network identifier.

🌈 SEE ALSO 🌈

also, the reading list 📚:

IEEE 802.1Q standard, https://standards.ieee.org/standard/802_1Q-2018.html.
IEEE 802.1ah standard, Provider Backbone Bridges.

🕰️ HISTORY 🕰️

The bpe driver first appeared in OpenBSD 6.5. she's a 2019 baby, technically a 6.5 baby, whatever, she ate 🔥

👑 AUTHORS 👑

David Gwynne <dlg@openbsd.org> — the main character who wrote this. we stan 🫶

and that's the whole page bestie, no cap, every flag, every number, every ioctl, every link — nothing dropped 💖

this cutie was brought to you by the Debian edition of the manpage, dated September 12, 2022, filed under BPE(4) — go forth and encapsulate responsibly ✨🎀

📦 where this page comes from

nixpkgs unstable: cvs-export
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms