probelabs/goreplay · error

filters out of range 0-%d

Error message

filters out of range 0-%d

What it means

SetBPFFilter refuses to attach when pcap.CompileBPFFilter returns more instructions than fit in a uint16 (the kernel sock_fprog filter count limit), so the expression is too complex for a classic BPF attachment.

Source

Thrown at internal/capture/sock_linux.go:226

func (sock *SockRaw) GetSnapLen() int {
	sock.mu.Lock()
	defer sock.mu.Unlock()
	return sock.snaplen
}

// SetBPFFilter compiles and sets a BPF filter for the socket handle.
func (sock *SockRaw) SetBPFFilter(expr string) error {
	sock.mu.Lock()
	defer sock.mu.Unlock()
	if expr == "" {
		return unix.SetsockoptInt(sock.fd, unix.SOL_SOCKET, unix.SO_DETACH_FILTER, 0)
	}
	filter, err := pcap.CompileBPFFilter(layers.LinkTypeEthernet, sock.snaplen, expr)
	if err != nil {
		return err
	}
	if len(filter) > int(^uint16(0)) {
		return fmt.Errorf("filters out of range 0-%d", ^uint16(0))
	}
	if len(filter) == 0 {
		return unix.SetsockoptInt(sock.fd, unix.SOL_SOCKET, unix.SO_DETACH_FILTER, 0)
	}
	fprog := &unix.SockFprog{
		Len:    uint16(len(filter)),
		Filter: &(*(*[]unix.SockFilter)(unsafe.Pointer(&filter)))[0],
	}
	return unix.SetsockoptSockFprog(sock.fd, unix.SOL_SOCKET, unix.SO_ATTACH_FILTER, fprog)
}

// SetPromiscuous sets promiscuous mode to the required value. for better result capture on all interfaces instead.
// If it is enabled, traffic not destined for the interface will also be captured.
func (sock *SockRaw) SetPromiscuous(b bool) error {
	sock.mu.Lock()
	defer sock.mu.Unlock()
	mreq := unix.PacketMreq{
		Ifindex: int32(sock.ifindex),

View on GitHub (pinned to 251e45abd2)

Solutions

1. Simplify the BPF expression (fewer/shorter clauses, use CIDR notation)
2. Split filtering across a simpler kernel filter plus user-space filtering
3. Check for generated/loop-built filters that accidentally duplicate clauses

When it happens

Trigger: Thrown at internal/capture/sock_linux.go:226 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of probelabs/goreplay@251e45abd2 (2026-09-02). Data as JSON: /api/errors/2574c03998848cb9. Report an issue: GitHub.