1@(#) $Header: /tcpdump/master/libpcap/README,v 1.34 2008-12-14 19:44:14 guy Exp $ (LBL) 2 3LIBPCAP 1.x.y 4 5www.tcpdump.org 6 7Please send inquiries/comments/reports to: 8 tcpdump-workers@lists.tcpdump.org 9 10Anonymous Git is available via: 11 git clone git://bpf.tcpdump.org/libpcap 12 13Version 1.x.y of LIBPCAP can be retrieved with the CVS tag "libpcap_1_{x}rel{y}": 14 cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_1_{x}rel{y} libpcap 15 16Please submit patches by forking the branch on GitHub at 17 18 http://github.com/mcr/libpcap/tree/master 19 20and issuing a pull request. 21 22formerly from Lawrence Berkeley National Laboratory 23 Network Research Group <libpcap@ee.lbl.gov> 24 ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4) 25 26This directory contains source code for libpcap, a system-independent 27interface for user-level packet capture. libpcap provides a portable 28framework for low-level network monitoring. Applications include 29network statistics collection, security monitoring, network debugging, 30etc. Since almost every system vendor provides a different interface 31for packet capture, and since we've developed several tools that 32require this functionality, we've created this system-independent API 33to ease in porting and to alleviate the need for several 34system-dependent packet capture modules in each application. 35 36For some platforms there are README.{system} files that discuss issues 37with the OS's interface for packet capture on those platforms, such as 38how to enable support for that interface in the OS, if it's not built in 39by default. 40 41The libpcap interface supports a filtering mechanism based on the 42architecture in the BSD packet filter. BPF is described in the 1993 43Winter Usenix paper ``The BSD Packet Filter: A New Architecture for 44User-level Packet Capture''. A compressed PostScript version can be 45found at 46 47 ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z 48 49or 50 51 http://www.tcpdump.org/papers/bpf-usenix93.ps.Z 52 53and a gzipped version can be found at 54 55 http://www.tcpdump.org/papers/bpf-usenix93.ps.gz 56 57A PDF version can be found at 58 59 http://www.tcpdump.org/papers/bpf-usenix93.pdf 60 61Although most packet capture interfaces support in-kernel filtering, 62libpcap utilizes in-kernel filtering only for the BPF interface. 63On systems that don't have BPF, all packets are read into user-space 64and the BPF filters are evaluated in the libpcap library, incurring 65added overhead (especially, for selective filters). Ideally, libpcap 66would translate BPF filters into a filter program that is compatible 67with the underlying kernel subsystem, but this is not yet implemented. 68 69BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly 70BSD, and Mac OS X; an older, modified and undocumented version is 71standard in AIX. {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the 72packetfilter interface but has been extended to accept BPF filters 73(which libpcap utilizes). Also, you can add BPF filter support to 74Ultrix using the kernel source and/or object patches available in: 75 76 http://www.tcpdump.org/other/bpfext42.tar.Z 77 78Linux, in the 2.2 kernel and later kernels, has a "Socket Filter" 79mechanism that accepts BPF filters; see the README.linux file for 80information on configuring that option. 81 82Note to Linux distributions and *BSD systems that include libpcap: 83 84There's now a rule to make a shared library, which should work on Linux 85and *BSD, among other platforms. 86 87It sets the soname of the library to "libpcap.so.1"; this is what it 88should be, *NOT* libpcap.so.1.x or libpcap.so.1.x.y or something such as 89that. 90 91We've been maintaining binary compatibility between libpcap releases for 92quite a while; there's no reason to tie a binary linked with libpcap to 93a particular release of libpcap. 94 95Problems, bugs, questions, desirable enhancements, etc. should be sent 96to the address "tcpdump-workers@lists.tcpdump.org". Bugs, support 97requests, and feature requests may also be submitted on the GitHub issue 98tracker for libpcap at 99 100 https://github.com/mcr/libpcap/issues 101 102Source code contributions, etc. should be sent to the email address 103above or submitted by forking the branch on GitHub at 104 105 http://github.com/mcr/libpcap/tree/master 106 107and issuing a pull request. 108 109Current versions can be found at www.tcpdump.org. 110 111 - The TCPdump team 112