probe::netfilter.arp.forward

Length of hardware address

Constant used to signify a 'stop' verdict

Name of network device packet will be routed to (if known)

Ethernet+IP only (ar_pro==0x800): target hardware (MAC) address

Constant used to signify an 'accept' verdict

Address of ARP packet data region (after the header)

Name of network device packet was received on (if known)

Address of ARP header

Address of net_device representing output device, 0 if unknown

Constant used to signify a 'repeat' verdict

The length of the packet buffer contents, in bytes

Constant used to signify a 'stolen' verdict

Length of protocol address

Protocol family -- always “arp”

Ethernet+IP only (ar_pro==0x800): source hardware (MAC) address

Address of net_device representing input device, 0 if unknown

Constant used to signify a 'drop' verdict

Format of protocol address

Ethernet+IP only (ar_pro==0x800): source IP address

Ethernet+IP only (ar_pro==0x800): target IP address

Format of hardware address

Constant used to signify a 'queue' verdict

ARP opcode (command)