the LIBpcap interface to various kernel packet capture mechanism
C Shell C++ Other
Pull request Compare This branch is 465 commits ahead of ambyal:master.
Permalink
Failed to load latest commit information.
ChmodBPF To quote Sep 9, 2009
SUNOS4 Initial revision Oct 7, 1999
Win32 Fixes to compile WinPcap under MINGW32 and MINGW64. Oct 15, 2010
bpf/net In userland, sign extend the offset for JA instructions. May 5, 2011
doc documentation for proposed pcap format Apr 5, 2004
lbl Get rid of a bogus */ in the middle of a comment. Aug 2, 2002
missing Move "snprintf.c" to the "missing" directory, as that's where Apr 5, 2004
msdos From Gisle Vanem: Apr 22, 2008
packaging Update to handle pcap.h being in /usr/include/pcap. Jun 8, 2012
pcap Add LINKTYPE_SCTP/DLT_SCTP - SCTP atop nothing at all. Nov 27, 2012
tests added compile test skeleton Feb 5, 2013
.cvsignore More files to ignore. Oct 23, 2008
.gitignore Ignore os-proto.h - it might be a symlink to os/os-XXX.h for some XXX. Feb 1, 2011
.travis.yml Add .travis.yml for Travis CI Nov 28, 2012
CHANGES updated CHANGES for 1.4 release Feb 19, 2013
CREDITS added note about Itojun Award Sep 5, 2012
INSTALL.txt Update the NeXTStEP, SCO UNIX/SCO OpenServer, and UnixWare information. Jun 12, 2008
LICENSE added license file Oct 9, 2000
Makefile.in Put the CANUSB stuff into EXTRA_DIST, so it shows up in the release t… Feb 1, 2012
README Update README to reflect current reality. Aug 5, 2011
README.Win32 Again, we're using Git now. Feb 8, 2010
README.aix Fix more patches@tcpdump.org references to point to the SourceForge May 30, 2008
README.dag Update README.dag to cover the ERF_DONT_STRIP_FCS environment variable. Jun 7, 2012
README.hpux Add to the beginning a note from Rick Jones that 11i (11.11) and later Jan 15, 2005
README.linux Fix typoes, fix tabs (tabs are 8 spaces on UN*Xes - such as Linux). Aug 5, 2011
README.macosx Put in a note about the Snow Leopard bug that requires that you have BPF Sep 10, 2009
README.septel From Gilbert Hoyek <gil_hoyek@hotmail.com>: support for capturing SS7 Jun 20, 2005
README.sita The SITA code in pcap-linux.c shares very little with the Linux code; Jan 6, 2008
README.tru64 Pick up the "README.tru64" file from Ethereal, and change it to refer to Jan 24, 2001
TODO Again, we're using Git now. Feb 8, 2010
VERSION There's now a 1.3 branch; update VERSION. Apr 27, 2012
aclocal.m4 OpenBSD requires -fPIC on 64-bit SPARC as well. Dec 10, 2012
arcnet.h Fix up the RCS ID, and put in a line indicating the NetBSD header file Apr 24, 2001
atmuni31.h Use VCI_ as a prefix for all the VCI values, rather than just prefixing Oct 22, 2007
bpf_dump.c Make some arguments const pointers if that makes sense. Jan 2, 2008
bpf_image.c Squelch format vs. argument warnings from clang. Nov 30, 2012
chmod_bpf Add a script to change the permissions of /dev/bpf*, and a launchd plist May 28, 2008
config.guess Update config.guess and config.sub to the latest versions. Jan 8, 2010
config.h.in Work around people who use --without-flex and --without-bison. Jun 30, 2012
config.sub Update config.guess and config.sub to the latest versions. Jan 8, 2010
configure OpenBSD requires -fPIC on 64-bit SPARC as well. Dec 10, 2012
configure.in Compile pcap by attributes not lib versions Add libnl3 include dir Mar 6, 2013
dlpisubs.c Don't define pcap_stream_err() if we're not going to use it. Jun 29, 2009
dlpisubs.h From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t Apr 4, 2008
etherent.c Include headers that should cause u_int64_t to be defined. Jan 27, 2010
ethertype.h When checking for VLAN tags, check for QinQ tags as well. Nov 20, 2011
fad-getad.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
fad-gifc.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
fad-glifc.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
fad-null.c Add _U_ to "rcsid[]" definitions, to eliminate "unused variable" Nov 15, 2003
fad-sita.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
fad-win32.c Add pcap_platform_finddevs() to WinPcap. Sep 25, 2007
gencode.c No IPv6 support, no struct in6_addr, and no calls to routines that us… Nov 30, 2012
gencode.h Make some counts unsigned ("counts" as in "they're always >= 0"). Dec 10, 2011
grammar.y Work around people who use --without-flex and --without-bison. Jun 30, 2012
ieee80211.h Support OpenBSD's "addr1", "addr2", "addr3", and "addr4" link-layer Nov 18, 2007
inet.c Don't set errbuf to an error message if pcap_findalldevs() returns 0. Mar 24, 2011
install-sh Initial revision Oct 7, 1999
llc.h Add a "netbeui" keyword, which selects NetBEUI packets (LLC packets with Jan 28, 2001
mkdep In some Solaris distributions, gcc is in /usr/sfw/bin. Look there for Oct 16, 2007
nametoaddr.c Fix memory leak. Nov 30, 2012
nlpid.h add BPF_ filters for misc. IS-IS PDU Types Dec 6, 2002
optimize.c Use prototype syntax in function definitions. Oct 6, 2012
org.tcpdump.chmod_bpf.plist This is probably the right way to run something once at startup time; it Jun 5, 2008
pcap-bpf.c Correct comment on label representation. Dec 9, 2012
pcap-bpf.h Add RCS IDs. Apr 1, 2007
pcap-bt-linux.c And un-constify some others. Jun 11, 2012
pcap-bt-linux.h Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-can-linux.c And un-constify some others. Jun 11, 2012
pcap-can-linux.h Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-canusb-linux.c experimental patch from Jakub Zawadzki <darkjames-ws@darkjames.pl> Sep 3, 2012
pcap-canusb-linux.h added missing ( to pcap-canusb-linux.h Sep 3, 2012
pcap-common.c Add LINKTYPE_SCTP/DLT_SCTP - SCTP atop nothing at all. Nov 27, 2012
pcap-common.h Byte-swap the extra fields in the "version 1" USB monitor header. Jan 25, 2010
pcap-config.1 Add a --additional-libs flag to pcap-config, to write out any additional May 22, 2009
pcap-config.in Use config.status to generate pcap-config. Dec 1, 2010
pcap-dag.c And un-constify some others. Jun 11, 2012
pcap-dag.h Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-dlpi.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-dos.c From Gisle Vanem: Apr 22, 2008
pcap-dos.h From Gisle Vanem: MS-DOS support. Dec 18, 2004
pcap-enet.c Put the public libpcap headers into a pcap subdirectory in both the Oct 4, 2006
pcap-filter.manmisc.in Remove AUTHORS section - it's in pcap(3PCAP). Dec 13, 2012
pcap-int.h Handle VLAN tags in cooked mode. Aug 19, 2012
pcap-libdlpi.c Fix presumed typo. (This couldn't have compiled.) Jul 5, 2012
pcap-linktype.manmisc.in Just point to the tcpdump.org Web page for descriptions of link-layer Mar 13, 2011
pcap-linux.c Compile pcap by attributes not lib versions Add libnl3 include dir Mar 6, 2013
pcap-namedb.h Add a cautionary note to OS vendors here as well. Oct 4, 2006
pcap-netfilter-linux.c Add netfilter/nfqueue interface. Jun 30, 2012
pcap-netfilter-linux.h Add netfilter/nfqueue interface. Jun 30, 2012
pcap-nit.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-null.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-pf.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-savefile.manfile.in Add LINKTYPE_ names to the pcap-linktype man page, and include the Oct 24, 2008
pcap-septel.c Constify some variables. Jun 11, 2012
pcap-septel.h Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-sita.c Add sanity checking for malloc, etc Sep 5, 2012
pcap-sita.h The SITA code in pcap-linux.c shares very little with the Linux code; Jan 6, 2008
pcap-sita.html Again, Git, not CVS. Feb 8, 2010
pcap-snf.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-snf.h Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-snit.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-snoop.c Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-stdinc.h Don't define or use any of the SIZEOF_ values. Apr 4, 2010
pcap-tstamp.manmisc.in Give the names, as well as the #defines, for time stamp types. Aug 23, 2010
pcap-usb-linux.c And un-constify some others. Jun 11, 2012
pcap-usb-linux.h Have non-interface modules take responsibility for identifying their … Jun 11, 2012
pcap-win32.c Fix pcap_[gs]etnonblock() to fill in the supplied errbuf. Jul 5, 2012
pcap.3pcap.in Remove the "last LBL release" stuff. Dec 11, 2012
pcap.c Have the capture_source_types[] array end with a terminator element. Nov 30, 2012
pcap.h Put the public libpcap headers into a pcap subdirectory in both the Oct 4, 2006
pcap1.h Fix more patches@tcpdump.org references to point to the SourceForge May 30, 2008
pcap_activate.3pcap Return PCAP_ERROR_PROMISC_PERM_DENIED if you have permission to open the Sep 21, 2010
pcap_breakloop.3pcap Fix up boldfacing. Dec 11, 2012
pcap_can_set_rfmon.3pcap Add some additional SEE ALSO references. Aug 22, 2010
pcap_close.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_compile.3pcap.in Fix man page typoes. Mar 8, 2011
pcap_create.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_datalink.3pcap.in Consistently use "link-layer header type". Aug 22, 2010
pcap_datalink_name_to_val.3pcap Consistently use "link-layer header type". Aug 22, 2010
pcap_datalink_val_to_name.3pcap Consistently use "link-layer header type". Aug 22, 2010
pcap_dump.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_dump_close.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_dump_file.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_dump_flush.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_dump_ftell.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_dump_open.3pcap.in Add a man page describing the pcap file format. Oct 23, 2008
pcap_file.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_fileno.3pcap Fix typo. May 13, 2011
pcap_findalldevs.3pcap Further emphasize that you *MUST* check sa_family. May 5, 2011
pcap_freecode.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_get_selectable_fd.3pcap Improve the description of the BPF select() issue. Jul 23, 2011
pcap_geterr.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_inject.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_is_swapped.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_lib_version.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_list_datalinks.3pcap.in Consistently use "link-layer header type". Aug 22, 2010
pcap_list_tstamp_types.3pcap.in Add support for setting the time stamp type for a capture. Aug 22, 2010
pcap_lookupdev.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_lookupnet.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_loop.3pcap Fix documentation of return values. Jul 4, 2012
pcap_major_version.3pcap Note that file version numbers are file-type-dependent. Dec 21, 2011
pcap_next_ex.3pcap Fix man page typoes. Mar 8, 2011
pcap_offline_filter.3pcap Constify the filter argument to pcap_offline_filter(). Nov 25, 2012
pcap_open_dead.3pcap.in Don't hard-wire section 4 as the section for the pcap-filter and Oct 21, 2008
pcap_open_live.3pcap Fix man page typoes. Mar 8, 2011
pcap_open_offline.3pcap.in Mention that we can read some pcap-ng files. Jan 10, 2010
pcap_set_buffer_size.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_set_datalink.3pcap Consistently use "link-layer header type". Aug 22, 2010
pcap_set_promisc.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_set_rfmon.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_set_snaplen.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_set_timeout.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_set_tstamp_type.3pcap.in If the specified time stamp type isn't supported, treat that as a war… Aug 23, 2010
pcap_setdirection.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_setfilter.3pcap Pick up pcap_offline_filter() from WinPcap. May 13, 2008
pcap_setnonblock.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_snapshot.3pcap Document the new API's, move a bunch of information about libpcap Apr 6, 2008
pcap_stats.3pcap From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Sep 7, 2009
pcap_statustostr.3pcap Rename pcap_errtostr() to pcap_statustostr(), and have it handle Apr 9, 2008
pcap_strerror.3pcap Include <pcap/pcap.h> in the SUMMARY sections - as long as we're going Apr 5, 2008
pcap_tstamp_type_name_to_val.3pcap Add support for setting the time stamp type for a capture. Aug 22, 2010
pcap_tstamp_type_val_to_name.3pcap Add support for setting the time stamp type for a capture. Aug 22, 2010
ppp.h The DLT_LINUX_PPP_WITHDIRECTION is also used for pppd on some BSDs, so Feb 8, 2005
runlex.sh Add --nounput if Flex supports the --noFUNCTION options, as at least Dec 31, 2007
savefile.c Pass the right packet data pointer to bpf_filter(). Dec 1, 2011
scanner.l Support what IPv6 stuff we can without IPv6 address resolution support. Sep 28, 2012
sf-pcap-ng.c Get rid of an unneeded variable. Dec 9, 2011
sf-pcap-ng.h Add limited support for reading pcap-ng files. Jan 10, 2010
sf-pcap.c Assorted header changes. Jan 12, 2011
sf-pcap.h Add limited support for reading pcap-ng files. Jan 10, 2010
sunatmpos.h Add SunATM support, based on code from Yen Yen Lim at North Dakota State Jul 11, 2002

README

@(#) $Header: /tcpdump/master/libpcap/README,v 1.34 2008-12-14 19:44:14 guy Exp $ (LBL)

LIBPCAP 1.x.y

www.tcpdump.org

Please send inquiries/comments/reports to:
	tcpdump-workers@lists.tcpdump.org

Anonymous Git is available via:
	git clone git://bpf.tcpdump.org/libpcap

Version 1.x.y of LIBPCAP can be retrieved with the CVS tag "libpcap_1_{x}rel{y}":
	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_1_{x}rel{y} libpcap

Please submit patches against the master copy to the libpcap project on
sourceforge.net.

formerly from 	Lawrence Berkeley National Laboratory
		Network Research Group <libpcap@ee.lbl.gov>
		ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4)

This directory contains source code for libpcap, a system-independent
interface for user-level packet capture.  libpcap provides a portable
framework for low-level network monitoring.  Applications include
network statistics collection, security monitoring, network debugging,
etc.  Since almost every system vendor provides a different interface
for packet capture, and since we've developed several tools that
require this functionality, we've created this system-independent API
to ease in porting and to alleviate the need for several
system-dependent packet capture modules in each application.

For some platforms there are README.{system} files that discuss issues
with the OS's interface for packet capture on those platforms, such as
how to enable support for that interface in the OS, if it's not built in
by default.

The libpcap interface supports a filtering mechanism based on the
architecture in the BSD packet filter.  BPF is described in the 1993
Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
User-level Packet Capture''.  A compressed PostScript version can be
found at

	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z

or

	http://www.tcpdump.org/papers/bpf-usenix93.ps.Z

and a gzipped version can be found at

	http://www.tcpdump.org/papers/bpf-usenix93.ps.gz

A PDF version can be found at

	http://www.tcpdump.org/papers/bpf-usenix93.pdf

Although most packet capture interfaces support in-kernel filtering,
libpcap utilizes in-kernel filtering only for the BPF interface.
On systems that don't have BPF, all packets are read into user-space
and the BPF filters are evaluated in the libpcap library, incurring
added overhead (especially, for selective filters).  Ideally, libpcap
would translate BPF filters into a filter program that is compatible
with the underlying kernel subsystem, but this is not yet implemented.

BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly
BSD, and Mac OS X; an older, modified and undocumented version is
standard in AIX.  {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the
packetfilter interface but has been extended to accept BPF filters
(which libpcap utilizes).  Also, you can add BPF filter support to
Ultrix using the kernel source and/or object patches available in:

	http://www.tcpdump.org/other/bpfext42.tar.Z

Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
mechanism that accepts BPF filters; see the README.linux file for
information on configuring that option.

Note to Linux distributions and *BSD systems that include libpcap:

There's now a rule to make a shared library, which should work on Linux 
and *BSD, among other platforms.

It sets the soname of the library to "libpcap.so.1"; this is what it 
should be, *NOT* libpcap.so.1.x or libpcap.so.1.x.y or something such as 
that.

We've been maintaining binary compatibility between libpcap releases for 
quite a while; there's no reason to tie a binary linked with libpcap to 
a particular release of libpcap.

Problems, bugs, questions, desirable enhancements, etc. should be sent
to the address "tcpdump-workers@lists.tcpdump.org".  Bugs, support
requests, and feature requests may also be submitted on the SourceForge
site for libpcap at

	http://sourceforge.net/projects/libpcap/

Source code contributions, etc. should be sent to the email address
submitted as patches on the SourceForge site for libpcap.

Current versions can be found at www.tcpdump.org, or the SourceForge
site for libpcap.

 - The TCPdump team