IPL(4)                    OpenBSD Programmer's Manual                   IPL(4)

NAME
     ipl - IP packet log device

DESCRIPTION
     The ipl pseudo device's purpose is to provide an easy way to gather pack-
     et headers of packets you wish to log. If a packet header is to be
     logged, either the entire header (including any IP options - TCP/UDP op-
     tions are not included when it calculates header size) is logged or noth-
     ing.  Up to 128 bytes of the packet content are logged after the header.

     Prepending every packet header logged are two structures containing in-
     formation relevant to the packet following and why it was logged. The
     first structure is iplog and the second is ipflog. Both are declared in
     <netinet/ip_fil.h>. and their formats are as follows:

           struct  iplog   {
                   u_long  ipl_magic;      /* IPL_MAGIC 0x49504c4d 'IPLM' */
                   u_long  ipl_sec;
                   u_long  ipl_usec;
                   u_int   ipl_len;
                   u_int   ipl_count;
                   size_t  ipl_dsize;
                   struct  iplog   *ipl_next;
           }

           struct  ipflog  {
                   u_char  fl_ifname[IFNAMSIZ];
                   u_char  fl_plen;        /* extra data after hlen       */
                   u_char  fl_hlen;        /* length of IP headers saved  */
                   u_short fl_rule;        /* assume < 64k rules, total   */
                   u_short fl_group;
                   u_32_t  fl_flags;
           }

     In the case of the header causing the buffer to finish on a non-32-bit
     boundary, padding will be appended to ensure that the next log entry is
     aligned to a 32-bit boundary.

     If the packet content is more than 128 bytes, only the first 128 bytes of
     the packet content are logged. Should the packet content finish on a
     non-32-bit boundary, then the last few bytes are not logged to ensure the
     log entry is aligned to a 32-bit boundary.

     ipl is a read-only (sequential) character pseudo-device.

     The ioctls which are loaded with this device can be found under ipf(4).
     The only ioctl which is used for logging and doesn't affect the filter
     is:

           ioctl(fd, SIOCIPFFB, int *)

     This ioctl flushes the log buffer and returns the number of bytes
     flushed.

     There is currently no support for non-blocking IO with this device, mean-
     ing all read operations should be considered blocking in nature (if there
     is no data to read, it will sleep until some is made available).

FILES
     /dev/ipl  IP packet logging pseudo-device

SEE ALSO
     ipf(4),  ipmon(8)

BUGS
     Packet headers are dropped when the internal buffer (static size) fills.

OpenBSD 2.6                      June 13, 1999                               2
