BPF filter

["Liuhy" <solar_liu () fescomail net>]

Hello everyone,

    In the option of snort command line, there is a "-F", which is followed by a BPF filter file. I have googled it, I 
only know that it is  the abbreviation of "Berkley Packet Filtering", these cann't give me the answer that I want to 
get. My questions are: 

1. What is BPF filter? (not introduced in "man tcpdump", "man snort", I cann't enter "man 4 bpf in linux)
2. How can I write BPF filter file? what is the rules to write it?
3. In snort FAQ, there is an example as following: snort <options> ``not ( (icmp[0] = 8 or icmp[0] = 0) and host 
<foo>)''
    It's similar to a snort command line, is it right? what is the relation of them?

Thanks in advance!

Liuhy
2003/4/21