Adding additional bpf device files

There is an option in the config file to specify the number of bpf (berkeley packet filter devices). I believe it is usually 4 so it won't be a limiting factor until you want to monitor 4 interfaces. But our systems come up with one berkeley packet filter device created (/dev/bpf0) so when you try to start a second tcpdump it fails with a message about /dev/bpf1. The way to add another bpf device file manually is:

mknod /dev/bpf1 c 23 1 

# Notes:
# mknod builds a device special file
# create /dev/bpf1 as a character ('c') device
# major device number = 23 (that's the assigned number for bpf devices)
# - this tells the kernel which device driver entry point to use
# - see /usr/src/sys/i386/conf/majors.i386 for complete listing
# minor device number = 1 (because there's already a 0 /dev/bpf0)

# change the ownership, etc.

chown root.wheel /dev/bpf1 
chmod 600 /dev/bpf1 

If you want regular users to be able to do tcpdump, then you can change the group and group permissions to make it available to the group. (This should be carefully restricted due to security and privacy considerations.)


Mark Parris, edited by David Ott 11/27/98