Repository files navigation

To report a security issue please send an e-mail tosecurity@tcpdump.org.

To report bugs and other problems, contribute patches, request afeature, provide generic feedback etc please see theguidelines for contributing.

Thedocumentation directory has README files about specificoperating systems and options.

Anonymous Git is available via:

https://github.com/the-tcpdump-group/libpcap.git

This directory contains source code for libpcap, a system-independentinterface for user-level packet capture. libpcap provides a portableframework for low-level network monitoring. Applications includenetwork statistics collection, security monitoring, network debugging,etc. Since almost every system vendor provides a different interfacefor packet capture, and since we've developed several tools thatrequire this functionality, we've created this system-independent APIto ease in porting and to alleviate the need for severalsystem-dependent packet capture modules in each application.

formerly fromLawrence Berkeley National LaboratoryNetwork Research Group <libpcap@ee.lbl.gov>ftp://ftp.ee.lbl.gov/old/libpcap-0.4a7.tar.Z

For some platforms there areREADME.{system} files that discuss issueswith the OS's interface for packet capture on those platforms, such ashow to enable support for that interface in the OS, if it's not built inby default.

The libpcap interface supports a filtering mechanism based on thearchitecture in the BSD packet filter. BPF is described in the 1993Winter Usenix paper ``The BSD Packet Filter: A New Architecture forUser-level Packet Capture''(compressed PostScript,gzipped PostScript,PDF).

Although most packet capture interfaces support in-kernel filtering,libpcap utilizes in-kernel filtering only for the BPF interface.On systems that don't have BPF, all packets are read into user-spaceand the BPF filters are evaluated in the libpcap library, incurringadded overhead (especially, for selective filters). Ideally, libpcapwould translate BPF filters into a filter program that is compatiblewith the underlying kernel subsystem, but this is not yet implemented.

BPF is standard in NetBSD, FreeBSD, OpenBSD, DragonFly BSD, macOS, andSolaris 11; an older, modified and undocumented version is standardin AIX.

Linux has a number of BPF based systems, and libpcap does not supportany of the eBPF mechanisms as yet, although it supports many of thememory mapped receive mechanisms.See theLinux-specific README for more information.

There's now a rule to make a shared library, which should work on Linuxand *BSD, among other platforms.

It sets the soname of the library tolibpcap.so.1; this is what itshould be,NOTlibpcap.so.1.x orlibpcap.so.1.x.y or something such asthat.

We've been maintaining binary compatibility between libpcap releases forquite a while; there's no reason to tie a binary linked with libpcap toa particular release of libpcap.