bpf


bpf gets its data thru various "tap" functions

for pkthdr mbufs: bpf_mtap_hdr

bpf filters applied

eventually data passing the filter is copied into a flat buffer

that buffer eventually consumed by userland