# Berkeley Packet Filter - /dev/bpf Question



## bnyec (Dec 8, 2011)

Hello,

I have done some searching and I can't for the life of me remember/find this info. Running a FreeBSD 8.x system and I see that /dev/bpf0 is symlinked to /dev/bpf.


```
#ls -al /dev/bpf*
crw-r-----  1 root  wheel    0,  13 Dec  8 13:51 /dev/bpf
lrwxr-xr-x  1 root  wheel         3 Dec  8 13:51 /dev/bpf0 -> bpf
#
```
On an older system running FreeBSD 7.x system I see /dev/bpf[0-9].


```
# ls -al /dev/bpf*
crw-------  1 root  wheel    0, 110 May 17  2010 /dev/bpf0
crw-------  1 root  wheel    0, 111 May 17  2010 /dev/bpf1
crw-------  1 root  wheel    0, 119 Dec  7 16:59 /dev/bpf2
crw-------  1 root  wheel    0, 108 Dec  7 16:57 /dev/bpf3
crw-------  1 root  wheel    0, 121 May 17  2010 /dev/bpf4
#
```
Why the change? Is /dev/bpf[0-9] no longer required?

Thanks for the info.


----------



## bnyec (Dec 9, 2011)

Ok, after further searching, I think I found the answer. Please correct me if I'm wrong.  
It is now a "cloning device"?



> Berkeley Packet Filter
> 
> The Berkeley Packet Filter (BPF) (sys/net/bpf.c) provides link layer access to data available on the network through interfaces attached to the system. BPF is used by opening a device node, /dev/bpf and issuing ioctl's to control the operation of the device. A popular example of a tool using BPF is tcpdump.
> 
> ...


----------

