Each process specifies what packets it's interested in receiving by downloading a packet filter. Currently, the most specific filter gets a packet if filters overlap.
Filters are specified by building up a collection of <offset, value> pairs. The offset corresponds to byte offsets into an incoming packet and value corresponds to the value that must be found. Here's an example that matches IP packets coming in over ethernet:
dpf_begin (&ir);
dpf_eq16 (&ir, eth_offset(proto), htons(EP_IP)); /* eth proto = ip */
dpf_eq32 (&ir, eth_sz + ip_offset(destination), ip); /* ip dst = us */
demux_id = sys_self_dpf_insert (CAP_ROOT, &ir, ringid);
demux_id is a handle to the filter that can be used in future calls to manipulate the filter. ringid specifies the packet ring that matching packets should be copied into. See the following section for more details about packet rings.