…devices. Have a table of routines to do pcap_create() for devices that aren't regular network interfaces. Try each of those in succession until one says "it's mine" (whether it succeeds or fails); if none do, do a pcap_create() for a regular interface. Have those routines do more stringent tests of the name - don't just accept any name that has a particular substring anywhere in it. That reduces the likelihood of a false match (as happened with the CANbus module when somebody renamed their Ethernet interface "canopy"). Have the table also include routines for pcap_findalldevs().
pcap_create() routine, and pcap_activate() calls through the activate_op pointer in a pcap_t.
handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
warnings from newer versions of GCC.
reading packets from a pcap_t, and make "pcap_read()" call it. That removes the last place where we have to check for a pcap_t that refers to a DAG card rather than a live capture, so get rid of the "is_dag" flag.
…andles setting a filter for a pcap_t. Have "pcap_set_datalink()" call it, rather than explicitly calling "pcap_set_datalink_platform()".
handles setting a filter for a pcap_t. Have "pcap_setfilter()" call it, rather than being a per-platform function. The per-platform functions don't need to check for an offline capture any more, as they're not called for an offline capture (and the ones that just call "install_bpf_program()" don't need to exist at all).
getting statistics for a pcap_t. Have "pcap_stats()" call it, rather than being a per-platform function; have stats routines for non-live pcap_t's that return an error.
argument to "pcap_open_live()" a "const" pointer. Constify some additional device name arguments, and update the man page to reflect some arguments that were already consts.
Young <email@example.com>, with some minor changes by Jason R. Thorpe <firstname.lastname@example.org>, and further changes by me to support it on BPF systems lacking BIOCGDLTLIST and other platforms lacking an equivalent feature. Update Jason Thorpe's e-mail address (Zembu is going away, if it hasn't done so already). Add APIs to map DLT names to DLT values and vice versa.
filter, always attach a copy, as "pcap-linux.c" does; that way, after a program uses "pcap_setfilter()", it can safely use "pcap_freecode()" to free up the BPF instructions allocated by "pcap_compile()". Also, always free it up when the "pcap_t" is closed. Get rid of the "pcap_t *" argument to "pcap_freecode()", as it's not necessary. Document "pcap_freecode()", for the benefit of programs that might repeatedly compile filter programs and attach them, so that they can free them up after attaching them and avoid leaking memory for them.
from NetBSD/OpenBSD src/lib/libpcap. use freeifaddrs() if exists.