probe::netfilter.arp.in — - Called for each incoming ARP packet
netfilter.arp.in
ar_tipEthernet+IP only (ar_pro==0x800): target IP address
nf_stolenConstant used to signify a 'stolen' verdict
pfProtocol family -- always “arp”
ar_dataAddress of ARP packet data region (after the header)
ar_thaEthernet+IP only (ar_pro==0x800): target hardware (MAC) address
ar_proFormat of protocol address
ar_sipEthernet+IP only (ar_pro==0x800): source IP address
indevAddress of net_device representing input device, 0 if unknown
ar_opARP opcode (command)
ar_hlnLength of hardware address
nf_repeatConstant used to signify a 'repeat' verdict
ar_hrdFormat of hardware address
ar_shaEthernet+IP only (ar_pro==0x800): source hardware (MAC) address
ar_plnLength of protocol address
data_strA string representing the packet buffer contents
nf_acceptConstant used to signify an 'accept' verdict
data_hexA hexadecimal string representing the packet buffer contents
nf_queueConstant used to signify a 'queue' verdict
arphdrAddress of ARP header
outdevAddress of net_device representing output device, 0 if unknown
nf_dropConstant used to signify a 'drop' verdict
nf_stopConstant used to signify a 'stop' verdict
lengthThe length of the packet buffer contents, in bytes
indev_nameName of network device packet was received on (if known)
outdev_nameName of network device packet will be routed to (if known)