bpf Devices - What's Using Them?

[Drew Tomlinson]

I have a 4.8 machine with bpf compiled in the kernel.  'll /dev/bpf*'
shows:

crw-------  1 root  wheel   23,   0 Sep 26 06:22 bpf0
crw-------  1 root  wheel   23,   1 Mar 14  2003 bpf1
crw-------  1 root  wheel   23,   2 Mar 14  2003 bpf2
crw-------  1 root  wheel   23,   3 Mar 14  2003 bpf3

If I attempt to run nmap, I get this error:

pcap_open_live: (no devices found) /dev/bpf4: No such file or directory

I know I can make more bpf devices but how can I find what using the
ones that are already there?  I do have 3 NICs on this machine and am
running ntop sniffing all NICs so I assume that accounts for 3 bpf
devices.  What might be using the fourth?

Thanks,

Drew