_DEV_BPF
bif->bif_bpf = open(_DEV_BPF, O_RDWR | O_NONBLOCK);
err(1, "%s: open %s", bif->bif_name, _DEV_BPF);