bpf(4) interface


The classic Berkeley Packet Filter
bpf is from 1990, based on even older code from 4.3BSD.

Raw packet capture interface
Is typically used for read-only access.
Write-access is also possible (used by hostapd).

Using BPF filter programs
Other BSDs have just-in-time (JIT) compilers.
OpenBSD has the "FILDROP" extension.
We do have per-DLT write support.