the LIBpcap interface to various kernel packet capture mechanism
C M4 HTML Makefile C++ Yacc Other
Latest commit 99acf64 Mar 24, 2017 Joerg Mayer committed with guyharris Make git_version_c.sh look more like gen_version_header.sh
Permalink
Failed to load latest commit information.
.github fixup the previous two commits Mar 6, 2017
ChmodBPF To quote Sep 9, 2009
SUNOS4 Initial revision Oct 7, 1999
Win32 Reflect the disappearance of fad-helpers.c. Mar 13, 2017
bpf/net Squelch warnings for negating an unsigned value. Jul 29, 2016
cmake BUILDING_LIBPCAP -> BUILDING_PCAP. Dec 27, 2015
config Clean up CMake stuff to start to work on UN*X. Sep 27, 2015
lbl Use pcap_snprintf() instead of snprintf(). Nov 3, 2015
missing Add a wrapper for strtok_r(). Aug 11, 2016
msdos Require that version.h be generated. Aug 13, 2016
pcap Reword a comment for Gisle. Mar 23, 2017
rpcapd Define more feature test macros and do so in a separate header file. Mar 20, 2017
tests Use compiler #defines to determine how to handle some function attrib… Mar 19, 2017
.appveyor.yml adjust AppVeyor build version Mar 14, 2017
.gitattributes add a GitHub issue template Mar 6, 2017
.gitignore Add more generated files Mar 23, 2017
.travis-coverity-scan-build.sh Coverity: Build script: Update the upload URL for the framework change Oct 30, 2015
.travis.yml Travis CI: extend the build matrix for rpcap Mar 12, 2017
CHANGES Reflect the recent DAG support changes. Jan 27, 2017
CMakeLists.txt Check for strlcat(). Mar 18, 2017
CONTRIBUTING refine the feedback guidelines Mar 6, 2017
CREDITS Delete trailing spaces/tabs Mar 8, 2015
GenVersion.bat Reflect version.h being renamed to pcap_version.h. Aug 13, 2016
INSTALL.txt fixup the previous two commits Mar 6, 2017
LICENSE Delete trailing spaces/tabs Mar 8, 2015
Makefile-devel-adds Rename configure.in to configure.ac Oct 17, 2016
Makefile.in Move the RPCAP-specific functions to pcap-rpcap.h. Mar 21, 2017
README refine the feedback guidelines Mar 6, 2017
README.Win32 Delete trailing spaces/tabs Mar 8, 2015
README.aix Delete trailing spaces/tabs Mar 8, 2015
README.dag Update README.dag to cover the ERF_DONT_STRIP_FCS environment variable. Jun 7, 2012
README.hpux Delete trailing spaces/tabs Mar 8, 2015
README.linux Delete trailing spaces/tabs Mar 8, 2015
README.macosx Put in a note about the Snow Leopard bug that requires that you have BPF Sep 10, 2009
README.septel fix a typo Jan 26, 2017
README.sita fix a few typos Jan 25, 2017
README.tru64 Delete trailing spaces/tabs Mar 8, 2015
TODO Delete trailing spaces/tabs Mar 8, 2015
VERSION bumped version Jul 21, 2016
aclocal.m4 Use compiler #defines to determine how to handle some function attrib… Mar 19, 2017
arcnet.h remove libpcap's own CVS keywords Jan 3, 2014
atmuni31.h remove libpcap's own CVS keywords Jan 3, 2014
bpf_dump.c Squelch a compiler warning. Dec 31, 2015
bpf_image.c Use pcap_snprintf() instead of snprintf(). Nov 3, 2015
chmod_bpf Add a script to change the permissions of /dev/bpf*, and a launchd plist May 28, 2008
cmakeconfig.h.in Use compiler #defines to determine how to handle some function attrib… Mar 19, 2017
config.guess Update config.{sub,guess}, timestamp='2015-02-2[23]' Mar 1, 2015
config.h.in Use compiler #defines to determine how to handle some function attrib… Mar 19, 2017
config.sub Update config.{sub,guess}, timestamp='2015-02-2[23]' Mar 1, 2015
configure Use compiler #defines to determine how to handle some function attrib… Mar 19, 2017
configure.ac Use compiler #defines to determine how to handle some function attrib… Mar 19, 2017
dlpisubs.c Use DLT_RAW for DL_IPNET devices; that's their default behavior. Dec 18, 2016
dlpisubs.h remove libpcap's own CVS keywords Jan 3, 2014
etherent.c The official #define for 32-bit and 64-bit Windows is _WIN32. Aug 31, 2015
ethertype.h Recognize 802.1ad nested VLAN tag in vlan filter. Aug 19, 2015
extract.h Exclude the <arpa/inet.h> header on Windows Aug 29, 2016
fad-getad.c Rename a routine to match find_or_add_if(). Jan 21, 2017
fad-gifc.c Rename a routine to match find_or_add_if(). Jan 21, 2017
fad-glifc.c Rename a routine to match find_or_add_if(). Jan 21, 2017
ftmacros.h Define more feature test macros and do so in a separate header file. Mar 20, 2017
funcattrs.h Update comments. Mar 20, 2017
gen_version_c.sh Make git_version_c.sh look more like gen_version_header.sh Mar 24, 2017
gen_version_header.sh Call libpcap's version header pcap_version.h. Aug 13, 2016
gencode.c Put back the greasy "save the capture filter string so we can tweak i… Mar 9, 2017
gencode.h Fix a Windows compile error after commit c4b0e2b. Mar 20, 2017
grammar.y Check for, and squelch, signed vs. unsigned comparison errors. Jul 25, 2016
ieee80211.h Support OpenBSD's "addr1", "addr2", "addr3", and "addr4" link-layer Nov 18, 2007
inet.c Fix pcap_lookupnet() on Windows. Mar 13, 2017
install-sh install-sh: Restore a needed tab Mar 8, 2015
llc.h Add support for filters testing for 802.2 LLC frame types. May 20, 2014
mkdep mkdep: It uses now build environment PATH Jan 17, 2015
nametoaddr.c Cope with the NetBSD issue in a different way. Aug 7, 2016
nametoaddr.h Don't use global state for the BPF compiler. Feb 11, 2016
nlpid.h remove libpcap's own CVS keywords Jan 3, 2014
optimize.c Rename a variable to avoid a warning. Aug 12, 2016
org.tcpdump.chmod_bpf.plist This is probably the right way to run something once at startup time; it Jun 5, 2008
pcap-bpf.c Support setting non-blocking mode before activating. Feb 26, 2017
pcap-bpf.h Delete trailing spaces/tabs Mar 8, 2015
pcap-bt-linux.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-bt-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-bt-monitor-linux.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-bt-monitor-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-common.c Add a linktype for IBM SDLC frames containing SNA PDUs. Mar 21, 2017
pcap-common.h Byte-swap the T and L in TLVs as necessary when reading an NFLOG file. Feb 3, 2014
pcap-config.1 update last modified date in man page(s) Dec 18, 2015
pcap-config.in Use config.status to generate pcap-config. Dec 1, 2010
pcap-dag.c Support setting non-blocking mode before activating. Feb 26, 2017
pcap-dag.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-dbus.c Support setting non-blocking mode before activating. Feb 26, 2017
pcap-dbus.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-dlpi.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-dos.c Support setting non-blocking mode before activating. Feb 26, 2017
pcap-dos.h Delete trailing spaces/tabs Mar 8, 2015
pcap-enet.c remove libpcap's own CVS keywords Jan 3, 2014
pcap-filter.manmisc.in refine the feedback guidelines Mar 6, 2017
pcap-int.h Move the RPCAP-specific functions to pcap-rpcap.h. Mar 21, 2017
pcap-libdlpi.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-linktype.manmisc.in update last modified date in man page(s) Dec 18, 2015
pcap-linux.c Support setting non-blocking mode before activating. Feb 26, 2017
pcap-namedb.h remove libpcap's own CVS keywords Jan 3, 2014
pcap-netfilter-linux.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-netfilter-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-new.c Move the RPCAP-specific functions to pcap-rpcap.h. Mar 21, 2017
pcap-nit.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-null.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-pf.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-rpcap-int.h Make rpcap_sendauth() static. Mar 14, 2017
pcap-rpcap.c Move the RPCAP-specific functions to pcap-rpcap.h. Mar 21, 2017
pcap-rpcap.h Remove the check for HAVE_REMOTE. Mar 21, 2017
pcap-savefile.manfile.in update last modified date in man page(s) Dec 18, 2015
pcap-septel.c Support setting non-blocking mode before activating. Feb 26, 2017
pcap-septel.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-sita.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-sita.h remove libpcap's own CVS keywords Jan 3, 2014
pcap-sita.html Again, Git, not CVS. Feb 8, 2010
pcap-snf.c Use add_addr_to_dev() to add an address based on the device name. Mar 2, 2017
pcap-snf.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-snit.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-snoop.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-stdinc.h Move definition of HAVE_SNPRINTF to portability.h. Aug 2, 2016
pcap-tc.c Support setting non-blocking mode before activating. Feb 26, 2017
pcap-tc.h Update for the new "list of devices" structure. Jan 19, 2017
pcap-tstamp.manmisc.in improve some man pages formatting Jan 25, 2017
pcap-usb-linux.c Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-usb-linux.h Have a pcap_if_list_t structure for use by the findalldevs code. Jan 18, 2017
pcap-win32.c Cast to 'PVOID' to supress warning. Mar 16, 2017
pcap.3pcap.in refine the feedback guidelines Mar 6, 2017
pcap.c Add a linktype for IBM SDLC frames containing SNA PDUs. Mar 21, 2017
pcap.h remove libpcap's own CVS keywords Jan 3, 2014
pcap_activate.3pcap Remove trailing spaces/tabs Aug 20, 2016
pcap_breakloop.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_can_set_rfmon.3pcap Give a better discussion of possible errors. Aug 1, 2016
pcap_close.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_compile.3pcap.in Note that pcap_compile() in 1.8.0 and later is newly thread-safe. Mar 24, 2017
pcap_create.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_datalink.3pcap.in update last modified date in man page(s) Dec 18, 2015
pcap_datalink_name_to_val.3pcap Clarify what the return values are for both success and failure. Oct 12, 2016
pcap_datalink_val_to_name.3pcap Clarify what the return values are for both success and failure. Oct 12, 2016
pcap_dump.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_dump_close.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_dump_file.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_dump_flush.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_dump_ftell.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_dump_open.3pcap.in improve some man pages formatting Jan 25, 2017
pcap_file.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_fileno.3pcap improve some man pages formatting Jan 25, 2017
pcap_findalldevs.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_freecode.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_get_selectable_fd.3pcap Call the timeout the "packet buffer timeout" rather than the "read ti… Jan 20, 2017
pcap_get_tstamp_precision.3pcap.in update last modified date in man page(s) Dec 18, 2015
pcap_geterr.3pcap Make the second argument to pcap_perror() const. Jan 15, 2016
pcap_inject.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_is_swapped.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_lib_version.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_list_datalinks.3pcap.in update last modified date in man page(s) Dec 18, 2015
pcap_list_tstamp_types.3pcap.in update last modified date in man page(s) Dec 18, 2015
pcap_lookupdev.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_lookupnet.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_loop.3pcap Call the timeout the "packet buffer timeout" rather than the "read ti… Jan 20, 2017
pcap_major_version.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_next_ex.3pcap Call the timeout the "packet buffer timeout" rather than the "read ti… Jan 20, 2017
pcap_offline_filter.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_open_dead.3pcap.in improve some man pages formatting Jan 25, 2017
pcap_open_live.3pcap Call the timeout the "packet buffer timeout" rather than the "read ti… Jan 20, 2017
pcap_open_offline.3pcap.in update last modified date in man page(s) Dec 18, 2015
pcap_set_buffer_size.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_datalink.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_immediate_mode.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_promisc.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_rfmon.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_snaplen.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_set_timeout.3pcap improve some man pages formatting Jan 25, 2017
pcap_set_tstamp_precision.3pcap.in update last modified date in man page(s) Dec 18, 2015
pcap_set_tstamp_type.3pcap.in fix a few typos Jan 25, 2017
pcap_setdirection.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_setfilter.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_setnonblock.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_snapshot.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_stats.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_statustostr.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_strerror.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_tstamp_type_name_to_val.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_tstamp_type_val_to_name.3pcap update last modified date in man page(s) Dec 18, 2015
pcap_version.h.in Call libpcap's version header pcap_version.h. Aug 13, 2016
portability.h Define more feature test macros and do so in a separate header file. Mar 20, 2017
ppp.h remove libpcap's own CVS keywords Jan 3, 2014
rpcap-protocol.h Clean up whitespace, fix comments. Mar 14, 2017
savefile.c Support setting non-blocking mode before activating. Feb 26, 2017
scanner.l Add ECE and CWR bits for TCP header, defined in RFC 3168. Feb 13, 2017
sf-pcap-ng.c Get rid of RCS ID. Mar 19, 2017
sf-pcap-ng.h Replace the _nsectime routines with _with_tstamp_precision routines. Jul 1, 2013
sf-pcap.c Get rid of RCS ID. Mar 19, 2017
sf-pcap.h Replace the _nsectime routines with _with_tstamp_precision routines. Jul 1, 2013
sockutils.c Define more feature test macros and do so in a separate header file. Mar 20, 2017
sockutils.h Don't call a socket variable "socket". Mar 20, 2017
sunatmpos.h remove libpcap's own CVS keywords Jan 3, 2014

README

To report a security issue please send an e-mail to security@tcpdump.org.

To report bugs and other problems, contribute patches, request a
feature, provide generic feedback etc please see the file
CONTRIBUTING in the libpcap source tree root.

LIBPCAP 1.x.y
Now maintained by "The Tcpdump Group"
www.tcpdump.org

Anonymous Git is available via:
	git clone git://bpf.tcpdump.org/libpcap

formerly from 	Lawrence Berkeley National Laboratory
		Network Research Group <libpcap@ee.lbl.gov>
		ftp://ftp.ee.lbl.gov/old/libpcap-0.4a7.tar.Z

This directory contains source code for libpcap, a system-independent
interface for user-level packet capture.  libpcap provides a portable
framework for low-level network monitoring.  Applications include
network statistics collection, security monitoring, network debugging,
etc.  Since almost every system vendor provides a different interface
for packet capture, and since we've developed several tools that
require this functionality, we've created this system-independent API
to ease in porting and to alleviate the need for several
system-dependent packet capture modules in each application.

For some platforms there are README.{system} files that discuss issues
with the OS's interface for packet capture on those platforms, such as
how to enable support for that interface in the OS, if it's not built in
by default.

The libpcap interface supports a filtering mechanism based on the
architecture in the BSD packet filter.  BPF is described in the 1993
Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
User-level Packet Capture''.  A compressed PostScript version can be
found at

	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z

or

	http://www.tcpdump.org/papers/bpf-usenix93.ps.Z

and a gzipped version can be found at

	http://www.tcpdump.org/papers/bpf-usenix93.ps.gz

A PDF version can be found at

	http://www.tcpdump.org/papers/bpf-usenix93.pdf

Although most packet capture interfaces support in-kernel filtering,
libpcap utilizes in-kernel filtering only for the BPF interface.
On systems that don't have BPF, all packets are read into user-space
and the BPF filters are evaluated in the libpcap library, incurring
added overhead (especially, for selective filters).  Ideally, libpcap
would translate BPF filters into a filter program that is compatible
with the underlying kernel subsystem, but this is not yet implemented.

BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly
BSD, and Mac OS X; an older, modified and undocumented version is
standard in AIX.  {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the
packetfilter interface but has been extended to accept BPF filters
(which libpcap utilizes).  Also, you can add BPF filter support to
Ultrix using the kernel source and/or object patches available in:

	http://www.tcpdump.org/other/bpfext42.tar.Z

Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
mechanism that accepts BPF filters; see the README.linux file for
information on configuring that option.

Note to Linux distributions and *BSD systems that include libpcap:

There's now a rule to make a shared library, which should work on Linux
and *BSD, among other platforms.

It sets the soname of the library to "libpcap.so.1"; this is what it
should be, *NOT* libpcap.so.1.x or libpcap.so.1.x.y or something such as
that.

We've been maintaining binary compatibility between libpcap releases for
quite a while; there's no reason to tie a binary linked with libpcap to
a particular release of libpcap.

Current versions can be found at www.tcpdump.org.

 - The TCPdump team