bpf —
Berkeley Packet Filter kernel interface
bpf is called via an operations vector described by the
  following struct:
struct bpf_ops {
        void (*bpf_attach)(struct ifnet *, u_int, u_int, struct bpf_if **);
        void (*bpf_detach)(struct ifnet *);
        void (*bpf_change_type)(struct ifnet *, u_int, u_int);
        void (*bpf_mtap)(struct bpf_if *, struct mbuf *);
        void (*bpf_mtap2)(struct bpf_if *, void *, u_int, struct mbuf *);
        void (*bpf_mtap_af)(struct bpf_if *, uint32_t, struct mbuf *);
        void (*bpf_mtap_et)(struct bpf_if *, uint16_t, struct mbuf *);
        void (*bpf_mtap_sl_in)(struct bpf_if *, u_char *, struct mbuf **);
        void (*bpf_mtap_sl_out)(struct bpf_if *, u_char *, struct mbuf *);
};
 
This vector is found from struct bpf_ops *
    bpf_ops. It is either a “stub”
    implementation or a real implementation, depending on whether
    bpf is absent or present in the kernel,
    respectively.
The bpf implementation is located in
  sys/net/bpf.c, the stub implementation is in
  sys/net/bpf_stub.c, and
  sys/net/bpf.h describes the interface.