the LIBpcap interface to various kernel packet capture mechanism
guyharris Make sure the *first* SHB, which we read when opening, isn't too big.
Start out with the 16 MiB maximum block size, check against that when
trying to read the SHB at the beginning of the file, and then increase
the maximum block size if we see an IDB with a snaplen that would result
in a bigger maximum block size.

When reading a block, we don't need to check against the maximum block
size unless we need to increase the block size.
Latest commit 160c60c Sep 18, 2018
Permalink
Failed to load latest commit information.
.github fixup the previous two commits Mar 6, 2017
ChmodBPF To quote Sep 9, 2009
Win32/Prj Rename sf-pcap-ng.[ch] to reflect that the file type is now called pc… Jan 9, 2018
cmake Revert "But that didn't work with CMake 3.9.1 and VS 2015." Sep 13, 2018
doc Update README.dag Sep 11, 2018
lbl Use pcap_snprintf() instead of snprintf(). Nov 3, 2015
missing Clean up the code a bit. Sep 15, 2018
msdos Use HTTPS in the www.tcpdump.org URLs. Jul 9, 2018
pcap Inclue compilers claiming GCC compatibility without being GCC. Sep 15, 2018
rpcapd Squelch a narrowing warning. Sep 15, 2018
testprogs We also need to undefine BPF_JUMP to avoid warnings. Sep 15, 2018
tests Add a libpcap test file. Feb 7, 2018
.appveyor.yml Run parallel builds. Sep 13, 2018
.gitattributes add a GitHub issue template Mar 6, 2017
.gitignore Amend .gitignore after commit 409f229. Aug 26, 2018
.travis-coverity-scan-build.sh Coverity: Build script: Update the upload URL for the framework change Oct 30, 2015
.travis.yml Travis CI: Fold the 'cmake' output Aug 14, 2018
CHANGES Add changes for 1.9.1. Jul 23, 2018
CMakeLists.txt Don't warn about declarations after statements. Sep 15, 2018
CONTRIBUTING.md Use HTTPS in the www.tcpdump.org URLs. Jul 9, 2018
CREDITS fixed email for Paolo Jul 22, 2018
INSTALL.md Update to match reality. Sep 1, 2018
LICENSE Delete trailing spaces/tabs Mar 8, 2015
Makefile-devel-adds Rename configure.in to configure.ac Oct 17, 2016
Makefile.in Add some "what if it's an earlier release" information. Aug 23, 2018
README.md rename/reformat documentation to markdown Jun 25, 2018
TODO Delete trailing spaces/tabs Mar 8, 2015
VERSION Make the next release 1.10 rather than 2.0. Jul 14, 2018
aclocal.m4 Don't warn about declarations after statements. Sep 15, 2018
arcnet.h remove libpcap's own CVS keywords Jan 3, 2014
atmuni31.h remove libpcap's own CVS keywords Jan 3, 2014
bpf_dump.c Do bounds checking on references to the bids array. Apr 26, 2018
bpf_filter.c Clean up the declaration of the packet-filtering routines. Sep 1, 2018
bpf_image.c Squelch warnings due to empty format strings. May 6, 2018
chmod_bpf Update to reflect the name change for Apple's UNIX-for-Macs. Jan 9, 2018
cmake_uninstall.cmake.in Support "make uninstall" for CMake. Sep 28, 2017
cmakeconfig.h.in Merge branch 'master' into breakloop_poll Sep 14, 2018
config.guess Update config.{guess,sub}, timestamps 2018-07-06,2018-07-03 Jul 10, 2018
config.h.in On Linux, check for sys/eventfd.h with autoconf as well. Sep 14, 2018
config.sub Update config.{guess,sub}, timestamps 2018-07-06,2018-07-03 Jul 10, 2018
configure Regenerate the configure script. Sep 15, 2018
configure.ac Warn if AC_PROG_CC_C99 doesn't get the compiler to support C99. Sep 15, 2018
diag-control.h Suppress warnings about the deprecation of gethostbyname(). Sep 15, 2018
dlpisubs.c Clean up the declaration of the packet-filtering routines. Sep 1, 2018
dlpisubs.h remove libpcap's own CVS keywords Jan 3, 2014
etherent.c Squelch warnings. Mar 20, 2018
ethertype.h Recognize 802.1ad nested VLAN tag in vlan filter. Aug 19, 2015
extract.h Don't assume ARM supports unaligned accesses. Sep 10, 2018
fad-getad.c Pass the "get additional flags" function to the findalldevs helpers. Apr 30, 2018
fad-gifc.c Assume we have limits.h. Sep 10, 2018
fad-glifc.c Pass the "get additional flags" function to the findalldevs helpers. Apr 30, 2018
fmtutils.c Fix build with some versions of GNU libc. Nov 24, 2017
fmtutils.h Add a routine to format error messages with an errno-based message at… Nov 15, 2017
ftmacros.h Define _DEFAULT_SOURCE *and* _BSD_SOURCE. Nov 28, 2017
gencode.c Use -Wshorten-64-to-32 if it's available, and fix warnings it shows. Sep 10, 2018
gencode.h Don't say "syntax error" twice. Jul 18, 2018
grammar.y Expand a comment. Sep 3, 2018
ieee80211.h Support OpenBSD's "addr1", "addr2", "addr3", and "addr4" link-layer Nov 18, 2007
install-sh install-sh: Restore a needed tab Mar 8, 2015
libpcap.pc.in Add a pkg-config .pc file for libpcap. Apr 26, 2018
llc.h Add support for filters testing for 802.2 LLC frame types. May 20, 2014
mkdep mkdep: It uses now build environment PATH Jan 17, 2015
nametoaddr.c Suppress warnings about the deprecation of gethostbyname(). Sep 15, 2018
nametoaddr.h Don't use global state for the BPF compiler. Feb 11, 2016
nlpid.h remove libpcap's own CVS keywords Jan 3, 2014
nomkdep Fix "make depend" in rpcapd if we can't generate dependencies. Nov 25, 2017
optimize.c Clean up the declaration of the packet-filtering routines. Sep 1, 2018
optimize.h Have separate flags for "optimizer debug" and "print DOT graph". May 3, 2018
org.tcpdump.chmod_bpf.plist This is probably the right way to run something once at startup time; it Jun 5, 2008
pcap-bpf.c Squelch more narrowing warnings. Sep 13, 2018
pcap-bpf.h Delete trailing spaces/tabs Mar 8, 2015
pcap-bt-linux.c Squelch more narrowing warnings. Sep 13, 2018
pcap-bt-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-bt-monitor-linux.c Squelch more narrowing warnings. Sep 13, 2018
pcap-bt-monitor-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-common.c added DLT/LINKTYPE for openvizsla.org Sep 1, 2018
pcap-common.h Do all shifts in SWAPSHORT() and SWAPLONG() on unsigned values. Jun 22, 2018
pcap-config.1 update last modified date in man page(s) Dec 18, 2015
pcap-config.in Don't wire the library name into pcap-config. Oct 3, 2017
pcap-dag.c Squelch more narrowing warnings. Sep 13, 2018
pcap-dag.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-dbus.c Squelch more narrowing warnings. Sep 13, 2018
pcap-dbus.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-dll.rc Fixed wrong quote usage in rc files Oct 9, 2017
pcap-dlpi.c Squelch more narrowing warnings. Sep 13, 2018
pcap-dos.c Clean up the declaration of the packet-filtering routines. Sep 1, 2018
pcap-dos.h Delete trailing spaces/tabs Mar 8, 2015
pcap-enet.c Clean up the declaration of the packet-filtering routines. Sep 1, 2018
pcap-filter.manmisc.in Refine references in some man pages, round 1. Jul 17, 2018
pcap-int.h Merge branch 'master' into breakloop_poll Sep 14, 2018
pcap-libdlpi.c Squelch more narrowing warnings. Sep 13, 2018
pcap-linktype.manmisc.in Make more small fixups to the man pages. Jul 19, 2018
pcap-linux.c Squelch some warnings. Sep 15, 2018
pcap-namedb.h remove libpcap's own CVS keywords Jan 3, 2014
pcap-netfilter-linux.c Fix format string. Sep 13, 2018
pcap-netfilter-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-netmap.c Squelch more narrowing warnings. Sep 13, 2018
pcap-netmap.h Add netmap support. May 31, 2017
pcap-new.c Add a routine to format error messages with an errno-based message at… Nov 15, 2017
pcap-nit.c Squelch more narrowing warnings. Sep 13, 2018
pcap-npf.c Squelch more narrowing warnings. Sep 13, 2018
pcap-null.c Pass the "get additional flags" function to the findalldevs helpers. Apr 30, 2018
pcap-pf.c Squelch more narrowing warnings. Sep 13, 2018
pcap-rdmasniff.c Squelch more narrowing warnings. Sep 13, 2018
pcap-rdmasniff.h RDMA sniffing support for pcap Aug 25, 2017
pcap-rpcap-int.h Redo the message processing in the client, add protocol version negot… Oct 31, 2017
pcap-rpcap.c Use -Wshorten-64-to-32 if it's available, and fix warnings it shows. Sep 10, 2018
pcap-rpcap.h Remove the check for HAVE_REMOTE. Mar 21, 2017
pcap-savefile.manfile.in Make more small fixups to the man pages. Jul 19, 2018
pcap-septel.c Squelch more narrowing warnings. Sep 13, 2018
pcap-septel.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-sita.c Squelch more narrowing warnings. Sep 13, 2018
pcap-sita.h remove libpcap's own CVS keywords Jan 3, 2014
pcap-sita.html Again, Git, not CVS. Feb 8, 2010
pcap-snf.c Squelch more narrowing warnings. Sep 13, 2018
pcap-snf.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-snit.c Squelch more narrowing warnings. Sep 13, 2018
pcap-snoop.c Squelch more narrowing warnings. Sep 13, 2018
pcap-tc.c Clean up the declaration of the packet-filtering routines. Sep 1, 2018
pcap-tc.h Update for the new "list of devices" structure. Jan 19, 2017
pcap-tstamp.manmisc.in Make more small fixups to the man pages. Jul 19, 2018
pcap-types.h Get rid of extra blank line. Aug 4, 2018
pcap-usb-linux.c Use the read byte count when scanning through the results of the read. Sep 13, 2018
pcap-usb-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap.3pcap.in Document immediate mode better. Aug 22, 2018
pcap.c Fix a message-formatting call. Sep 15, 2018
pcap.h remove libpcap's own CVS keywords Jan 3, 2014
pcap_activate.3pcap Refine references in some man pages, round 1. Jul 17, 2018
pcap_breakloop.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_can_set_rfmon.3pcap Refine references in some man pages, round 1. Jul 17, 2018
pcap_close.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_compile.3pcap.in Add backward compatibility notes to some man pages. Aug 22, 2018
pcap_create.3pcap Refine references in some man pages, round 1. Jul 17, 2018
pcap_datalink.3pcap.in Refine references in some man pages, round 3. Jul 17, 2018
pcap_datalink_name_to_val.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_datalink_val_to_name.3pcap Make more small fixups to the man pages. Jul 19, 2018
pcap_dump.3pcap Refine references in some man pages, round 1. Jul 17, 2018
pcap_dump_close.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_dump_file.3pcap Refine references in some man pages, round 1. Jul 17, 2018
pcap_dump_flush.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_dump_ftell.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_dump_open.3pcap.in Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_file.3pcap Make more small fixups to the man pages. Jul 19, 2018
pcap_fileno.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_findalldevs.3pcap Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_freecode.3pcap Refine references in some man pages, round 2. Jul 17, 2018
pcap_get_required_select_timeout.3pcap Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_get_selectable_fd.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_get_tstamp_precision.3pcap.in Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_geterr.3pcap Update the timestamp in some man pages. Jul 11, 2018
pcap_inject.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_is_swapped.3pcap Refine references in some man pages, round 2. Jul 17, 2018
pcap_lib_version.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_list_datalinks.3pcap.in Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_list_tstamp_types.3pcap.in Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_lookupdev.3pcap Refine references in some man pages, round 2. Jul 17, 2018
pcap_lookupnet.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_loop.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_major_version.3pcap Update the timestamp in some man pages. Jul 11, 2018
pcap_next_ex.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_offline_filter.3pcap Refine references in some man pages, round 2. Jul 17, 2018
pcap_open_dead.3pcap.in Refine references in some man pages, round 2. Jul 17, 2018
pcap_open_live.3pcap Make more small fixups to the man pages. Jul 19, 2018
pcap_open_offline.3pcap.in Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_set_buffer_size.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_datalink.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_set_immediate_mode.3pcap.in Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_set_promisc.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_protocol_linux.3pcap More BACKWARD COMPATIBILITY sections. Aug 22, 2018
pcap_set_rfmon.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_snaplen.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_timeout.3pcap Refine references in some man pages, round 4. Jul 18, 2018
pcap_set_tstamp_precision.3pcap.in Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_set_tstamp_type.3pcap.in Add some "what if it's an earlier release" information. Aug 23, 2018
pcap_setdirection.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_setfilter.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_setnonblock.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_snapshot.3pcap Fixup a reference in pcap_snapshot.3pcap. Jul 18, 2018
pcap_stats.3pcap Spell PCAP_ERROR and PCAP_ERROR_BREAK in the man pages. Jul 25, 2018
pcap_statustostr.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_strerror.3pcap Make more small fixups to the man pages. Jul 19, 2018
pcap_tstamp_type_name_to_val.3pcap Add backward compatibility notes to some man pages. Aug 22, 2018
pcap_tstamp_type_val_to_name.3pcap Add backward compatibility notes to some man pages. Aug 22, 2018
portability.h Avoid redefining HAVE_SNPRINTF Mar 15, 2018
ppp.h remove libpcap's own CVS keywords Jan 3, 2014
rpcap-protocol.c Fix a few warnings that came up after turning on a dozen more warnings Apr 4, 2018
rpcap-protocol.h Squelch some more narrowing warnings. Sep 13, 2018
savefile.c Squelch more narrowing warnings. Sep 13, 2018
scanner.l Suppress warnings in Flex-generated code. Mar 21, 2018
sf-pcap.c Squelch more narrowing warnings. Sep 13, 2018
sf-pcap.h Replace the _nsectime routines with _with_tstamp_precision routines. Jul 1, 2013
sf-pcapng.c Make sure the *first* SHB, which we read when opening, isn't too big. Sep 18, 2018
sf-pcapng.h Rename sf-pcap-ng.[ch] to reflect that the file type is now called pc… Jan 9, 2018
sockutils.c Squelch some shortening warnings. Sep 13, 2018
sockutils.h Use -Wshorten-64-to-32 if it's available, and fix warnings it shows. Sep 10, 2018
sunatmpos.h remove libpcap's own CVS keywords Jan 3, 2014
varattrs.h Use compiler tests to determine how to define _U_. Nov 15, 2017

README.md

To report a security issue please send an e-mail to security@tcpdump.org.

To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the file CONTRIBUTING in the libpcap source tree root.

The directory doc/ has README files about specific operating systems and options.

LIBPCAP 1.x.y Now maintained by "The Tcpdump Group" https://www.tcpdump.org

Anonymous Git is available via: https://github.com/the-tcpdump-group/libpcap.git

formerly from Lawrence Berkeley National Laboratory Network Research Group libpcap@ee.lbl.gov ftp://ftp.ee.lbl.gov/old/libpcap-0.4a7.tar.Z

This directory contains source code for libpcap, a system-independent interface for user-level packet capture. libpcap provides a portable framework for low-level network monitoring. Applications include network statistics collection, security monitoring, network debugging, etc. Since almost every system vendor provides a different interface for packet capture, and since we've developed several tools that require this functionality, we've created this system-independent API to ease in porting and to alleviate the need for several system-dependent packet capture modules in each application.

For some platforms there are README.{system} files that discuss issues with the OS's interface for packet capture on those platforms, such as how to enable support for that interface in the OS, if it's not built in by default.

The libpcap interface supports a filtering mechanism based on the architecture in the BSD packet filter. BPF is described in the 1993 Winter Usenix paper ``The BSD Packet Filter: A New Architecture for User-level Packet Capture''. A compressed PostScript version can be found at

ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z

or

https://www.tcpdump.org/papers/bpf-usenix93.ps.Z

and a gzipped version can be found at

https://www.tcpdump.org/papers/bpf-usenix93.ps.gz

A PDF version can be found at

https://www.tcpdump.org/papers/bpf-usenix93.pdf

Although most packet capture interfaces support in-kernel filtering, libpcap utilizes in-kernel filtering only for the BPF interface. On systems that don't have BPF, all packets are read into user-space and the BPF filters are evaluated in the libpcap library, incurring added overhead (especially, for selective filters). Ideally, libpcap would translate BPF filters into a filter program that is compatible with the underlying kernel subsystem, but this is not yet implemented.

BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly BSD, and macOS; an older, modified and undocumented version is standard in AIX. {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the packetfilter interface but has been extended to accept BPF filters (which libpcap utilizes). Also, you can add BPF filter support to Ultrix using the kernel source and/or object patches available in:

https://www.tcpdump.org/other/bpfext42.tar.Z

Linux has a number of BPF based systems, and libpcap does not support any of the eBPF mechanisms as yet, although it supports many of the memory mapped receive mechanisms. See the README.linux file for more information.

Note to Linux distributions and *BSD systems that include libpcap:

There's now a rule to make a shared library, which should work on Linux and *BSD, among other platforms.

It sets the soname of the library to "libpcap.so.1"; this is what it should be, NOT libpcap.so.1.x or libpcap.so.1.x.y or something such as that.

We've been maintaining binary compatibility between libpcap releases for quite a while; there's no reason to tie a binary linked with libpcap to a particular release of libpcap.

Current versions can be found at https://www.tcpdump.org.

  • The TCPdump group