PROBE::NETFILTER.A(3stap) Networking Tapset PROBE::NETFILTER.A(3stap)

# [NAME](#NAME)

probe::netfilter.arp.forward - - Called for each ARP packet to be forwarded

# [SYNOPSIS](#SYNOPSIS)

```
probe netfilter.arp.forward {}
```

# [VALUES](#VALUES)

*nf\_stolen*

Constant used to signify a 'stolen' verdict

*ar\_tip*

Ethernet+IP only (ar\_pro==0x800): target IP address

*data\_str*

A string representing the packet buffer contents

*data\_hex*

A hexadecimal string representing the packet buffer contents

*outdev\_name*

Name of network device packet will be routed to (if known)

*length*

The length of the packet buffer contents, in bytes

*nf\_stop*

Constant used to signify a 'stop' verdict

*indev\_name*

Name of network device packet was received on (if known)

*ar\_op*

ARP opcode (command)

*nf\_drop*

Constant used to signify a 'drop' verdict

*ar\_sip*

Ethernet+IP only (ar\_pro==0x800): source IP address

*nf\_queue*

Constant used to signify a 'queue' verdict

*pf*

Protocol family -- always “arp”

*ar\_tha*

Ethernet+IP only (ar\_pro==0x800): target hardware (MAC) address

*arphdr*

Address of ARP header

*indev*

Address of net\_device representing input device, 0 if unknown

*nf\_repeat*

Constant used to signify a 'repeat' verdict

*nf\_accept*

Constant used to signify an 'accept' verdict

*ar\_pro*

Format of protocol address

*ar\_hln*

Length of hardware address

*ar\_hrd*

Format of hardware address

*outdev*

Address of net\_device representing output device, 0 if unknown

*ar\_sha*

Ethernet+IP only (ar\_pro==0x800): source hardware (MAC) address

*ar\_data*

Address of ARP packet data region (after the header)

*ar\_pln*

Length of protocol address

# [SEE ALSO0](#SEE_ALSO0)

[*tapset::netfilter*(3stap)](/man/enterprise-packages/systemtap/tapset::netfilter.3stap)

September 2026 SystemTap Tapset Reference Ver

---

Document: probe::netfilter.arp.forward(3stap) from systemtap 5.6-r1 (Chainguard OS)
Source: https://sourceware.org/git/systemtap.git