pflang—Packet Filter Language introduced by tcpdump/libpcap

tcpdump uses a small domain-specific language (DSL) to specify which part of the traffic the user is interested in, in the form of a packet filter. In the decades since, many other tools have adopted that language, often extending it somewhat. This DSL is also known under the name Berkeley Packet Filter (BPF).


  • tcpdump/libpcap
  • pflua, which generates high-performance packet filters by compiling pflang to Lua and then compiling that using the LuaJIT just-in-time compiler
  • NFDUMP/NfSen uses a variant of pflang to filter flows rather than packets
  • Wireshark (also has its own different filter language)
  • and many others...

-- SimonLeinen - 2015-07-18

Topic revision: r1 - 2015-07-18 - SimonLeinen
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2004-2009 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.