Implement a Simple Packet Filter in C

How Packet Filters Work

A packet filter accepts or drops traffic based on rules. For example, "allow TCP to port 80" or "drop ICMP type 8". Firewalls, IDS systems, and tcpdump all use this matching logic. The Berkeley Packet Filter (BPF) runs compiled filter programs in the kernel; this task builds a simplified user-space version.

Common Match Criteria

Protocol: TCP (6), UDP (17), ICMP (1)
IP addresses: source or destination like 192.168.1.0/24
Ports: e.g. destination port 443 for HTTPS
TCP flags: SYN-only for port scanning detection

A first-match policy processes rules in order with an implicit deny-all at the end.

User-Space Implementation

c
Loading…

Parse the IP protocol field, then drill into TCP or UDP headers for port numbers. For ICMP, check type and code instead of ports.

Why This Exercise

This task requires you to implement filter_packet() with protocol and port matching. The BPF you approximate here evolved into Linux eBPF, now powering Kubernetes networking and DDoS mitigation at scale. tcpdump still compiles expressions like tcp port 80 into this same match-and-drop logic before copying packets to user space.

Implement a C program with a filter_packet() function.

Requirements:

Define a simple packet structure containing protocol, src_ip, dst_ip, src_port, dst_port
Implement filter_packet() that returns match or no-match based on criteria
Support filtering by protocol (TCP=6, UDP=17, ICMP=1)
Support filtering by destination port (e.g., 80 for HTTP)
Create at least 4 sample packets with different protocols and ports
Print match/no-match for each packet against each rule
Show the logic in clear if/else or switch statements
Document what a real BPF program would look like in the kernel

Success Criteria:

filter_packet() correctly matches TCP port 80 and ICMP
Both matched and unmatched packets are shown
Rules are documented with comments
Output contains the keywords: filter, match, packet, port

How Packet Filters Work

Common Match Criteria

Protocol: TCP (6), UDP (17), ICMP (1)
IP addresses: source or destination like 192.168.1.0/24
Ports: e.g. destination port 443 for HTTPS
TCP flags: SYN-only for port scanning detection

A first-match policy processes rules in order with an implicit deny-all at the end.

User-Space Implementation

c
Loading…

Parse the IP protocol field, then drill into TCP or UDP headers for port numbers. For ICMP, check type and code instead of ports.

Why This Exercise

Implement a C program with a filter_packet() function.

Requirements:

Define a simple packet structure containing protocol, src_ip, dst_ip, src_port, dst_port
Implement filter_packet() that returns match or no-match based on criteria
Support filtering by protocol (TCP=6, UDP=17, ICMP=1)
Support filtering by destination port (e.g., 80 for HTTP)
Create at least 4 sample packets with different protocols and ports
Print match/no-match for each packet against each rule
Show the logic in clear if/else or switch statements
Document what a real BPF program would look like in the kernel

Success Criteria:

filter_packet() correctly matches TCP port 80 and ICMP
Both matched and unmatched packets are shown
Rules are documented with comments
Output contains the keywords: filter, match, packet, port

Topic Overview

How Packet Filters Work

Common Match Criteria

User-Space Implementation

Why This Exercise

Implementation Task

Progressive Hints

Resources

Open Source

Implement a Simple Packet Filter in C

Topic Overview

How Packet Filters Work

Common Match Criteria

User-Space Implementation

Why This Exercise

Implementation Task

Progressive Hints

Resources

Open Source