NPF is a layer 3 packet filter, supporting stateful packet inspection, IPv6, NAT, IP sets, extensions and many more. It uses BPF as its core engine and it was designed with a focus on high performance, scalability, multi-threading and modularity. NPF was written from scratch in 2009. It is written in C99 and distributed under the 2-clause BSD license.
NPF is provided as a userspace library to be used in a bespoke application to process packets. It can run on Linux, typically, in combination with such frameworks like Data Plane Development Kit (DPDK) or netmap.
NPF offers the traditional set of features provided by packet filters. Some key features are:
For a full set of features and their description, see the NPF documentation and other manual pages.
You can try NPF-Router as a demo NPF+DPDK application, running a virtual test network with Docker containers.
git clone https://github.com/rmind/nvlist
git clone https://github.com/rmind/thmap
git clone https://github.com/rmind/libqsbr
git clone https://github.com/rmind/liblpm
git clone https://github.com/rmind/bpfjit
git clone https://github.com/rmind/libcdb
Each repository provides the build files for RPM (
cd pkg && make rpm)
and DEB (
cd pkg && make deb) packages. You can also check the
Travis file for an example of how to build everything.
app/ - NPF-Router demo application (NPF + DPDK + Docker) docs/ - documentation source src/ - root source code directory kern/ - the kernel component (npfkern library) lib/ - extension libraries complementing npfctl libnpf/ - library to manage the NPF configuration npfctl/ - command line user interface to control NPF npftest/ - unit tests and a tool to debug NPF pkg/ - packaging files (RPM and DEB) misc/ - auxiliary helper scripts
To build the libnpf library (link using the
cd pkg && make rpm
cd pkg && make deb