diff --git a/include/ircd/net/acceptor.h b/include/ircd/net/acceptor.h
index 95cf56434..9c6c28b8f 100644
--- a/include/ircd/net/acceptor.h
+++ b/include/ircd/net/acceptor.h
@@ -46,6 +46,7 @@ ircd::net::acceptor
 	size_t backlog;
 	listener::callback cb;
 	listener::proffer pcb;
+	bpf::prog filter;
 	asio::ssl::context ssl;
 	ip::tcp::endpoint ep;
 	ip::tcp::acceptor a;
diff --git a/ircd/net_listener.cc b/ircd/net_listener.cc
index 471675e6d..e8a399419 100644
--- a/ircd/net_listener.cc
+++ b/ircd/net_listener.cc
@@ -324,6 +324,13 @@ try
 		std::move(pcb):
 		proffer_default
 }
+,filter
+{
+	const_buffer
+	{
+		nullptr, nullptr
+	},
+}
 ,ssl
 {
 	asio::ssl::context::method::sslv23_server
@@ -388,10 +395,22 @@ ircd::net::acceptor::open()
 	a.non_blocking(true);
 	log::debug
 	{
-		log, "%s opened listener socket",
-		loghead(*this)
+		log, "%s opened listener socket:%d",
+		loghead(*this),
+		int(a.native_handle()),
 	};
 
+	if(filter)
+	{
+		net::attach(a.native_handle(), filter.fd);
+		log::debug
+		{
+			log, "%s attach filter fd:%d",
+			loghead(*this),
+			int(filter.fd),
+		};
+	}
+
 	a.bind(ep);
 	log::debug
 	{