Dose anyone has the complete information about BPF,cause my work need to know well about it.
Thx very much.

Don't you mean bpf? Google is your friend there, or a bookstore would be an even better friend. TCP/IP Illustrated, Volume 1: The Protocols has some very good information about bpf. Since it's used in just about every major networking monitoring or manipulation application there is a lot of information available on the web.

Thx for you reply,but I don't have much time(only 10 days left),so come here for help

By the way, it's Berkley Packet Filter.

Linux Questions doesn't exist for us to do your homework for you. If you're trying to get something setup and you're getting errors or need some advice, you will find tons of help here. If you want to sit there and give us your assignment and ask the LQ members to do your work for you, well that is not going to happen.

We will be very happy to help explain answers to specific questions. If you have something more specific than "tell me everything about ____" then we can help.

By the way, 10 days is tons of time to read. You could finish a small book in 10 days, or read dozens of websites. Do yourself a favor and do some reading so you know what questions to ask.

MY dissertation's to capture packets and analyse them under Linux(I use RedHat now),just like the TCPDUMP(I don't think mine is like it,it's huge for me,and I don't have enough time).
At the beginning,I read the books I think which would help me to finish my dissertation like :
TCP/IP Illustrated, Volume 1: The Protocols,
TCP/IP Illustrated,Volume 2:The Implementation(not finish)
UNIX Network Programming Volume 1(not finish)
Beginning LINUX Programming 2nd Edition
Linux Socket Programming by Example
Advanced Linux Programming
Advanced Programming in the UNIX Environment(not finish)
When I prepair to start my dissertation and want to use BPF,But I found the BPF's used under Unix not Linux,oh god.That means no BPF device in my Linux system,and is that means if I want to use it and I must firt install it(I have bpf.c, bpf.h, bpf_compat.h, bpf_filter.c, bpfdesc.h which from 4.4BSD-Lite.tar.gz)
Some guys suggest me to use the SOCK_RAW.But I know little about it.
So I want to use BPF to implement it though I am use Linux.Is that possible???
Or could I just add "pseudo-device bpfilter 4" to my kernel and recompile it?
Does it work?

Now I know Linux also has "BPF",it call LPF(Linux Packet Filter:Ethertap),but the GENERIC kernel does not has in it,so I must recompile a new kernel,a alternative would be to use a raw socket to send data and
use libpcap to receive it,and I decide to use this to complete my dissertation.
Anyway thank you chort.