PROBE::NETFILTER.I(3stap) Networking Tapset PROBE::NETFILTER.I(3stap)

# [NAME](#NAME)

probe::netfilter.ip.forward - Called on an incoming IP packet addressed to some other computer

# [SYNOPSIS](#SYNOPSIS)

```
probe netfilter.ip.forward {}
```

# [VALUES](#VALUES)

*syn*

TCP SYN flag (if protocol is TCP; ipv4 only)

*iphdr*

Address of IP header

*ipproto\_udp*

Constant used to signify that the packet protocol is UDP

*daddr*

A string representing the destination IP address

*nf\_queue*

Constant used to signify a 'queue' verdict

*nf\_drop*

Constant used to signify a 'drop' verdict

*ipproto\_tcp*

Constant used to signify that the packet protocol is TCP

*data\_str*

A string representing the packet buffer contents

*nf\_stolen*

Constant used to signify a 'stolen' verdict

*urg*

TCP URG flag (if protocol is TCP; ipv4 only)

*outdev\_name*

Name of network device packet will be routed to (if known)

*data\_hex*

A hexadecimal string representing the packet buffer contents

*length*

The length of the packet buffer contents, in bytes

*rst*

TCP RST flag (if protocol is TCP; ipv4 only)

*dport*

TCP or UDP destination port (ipv4 only)

*fin*

TCP FIN flag (if protocol is TCP; ipv4 only)

*protocol*

Packet protocol from driver (ipv4 only)

*family*

IP address family

*indev\_name*

Name of network device packet was received on (if known)

*nf\_stop*

Constant used to signify a 'stop' verdict

*nf\_accept*

Constant used to signify an 'accept' verdict

*nf\_repeat*

Constant used to signify a 'repeat' verdict

*psh*

TCP PSH flag (if protocol is TCP; ipv4 only)

*ack*

TCP ACK flag (if protocol is TCP; ipv4 only)

*outdev*

Address of net\_device representing output device, 0 if unknown

*saddr*

A string representing the source IP address

*pf*

Protocol family -- either “ipv4” or “ipv6”

*indev*

Address of net\_device representing input device, 0 if unknown

*sport*

TCP or UDP source port (ipv4 only)

# [SEE ALSO0](#SEE_ALSO0)

[*tapset::netfilter*(3stap)](/man/enterprise-packages/systemtap/tapset::netfilter.3stap)

September 2026 SystemTap Tapset Reference Ver

---

Document: probe::netfilter.ip.forward(3stap) from systemtap 5.6-r0 (Chainguard OS)
Source: https://sourceware.org/git/systemtap.git