| @(#) $Header: /tcpdump/master/libpcap/README,v 1.34 2008-12-14 19:44:14 guy Exp $ (LBL) |
| |
| LIBPCAP 1.x.y |
| |
| www.tcpdump.org |
| |
| Please send inquiries/comments/reports to: |
| tcpdump-workers@lists.tcpdump.org |
| |
| Anonymous Git is available via: |
| git clone git://bpf.tcpdump.org/libpcap |
| |
| Version 1.x.y of LIBPCAP can be retrieved with the CVS tag "libpcap_1_{x}rel{y}": |
| cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_1_{x}rel{y} libpcap |
| |
| Please submit patches against the master copy to the libpcap project on |
| sourceforge.net. |
| |
| formerly from Lawrence Berkeley National Laboratory |
| Network Research Group <libpcap@ee.lbl.gov> |
| ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4) |
| |
| This directory contains source code for libpcap, a system-independent |
| interface for user-level packet capture. libpcap provides a portable |
| framework for low-level network monitoring. Applications include |
| network statistics collection, security monitoring, network debugging, |
| etc. Since almost every system vendor provides a different interface |
| for packet capture, and since we've developed several tools that |
| require this functionality, we've created this system-independent API |
| to ease in porting and to alleviate the need for several |
| system-dependent packet capture modules in each application. |
| |
| For some platforms there are README.{system} files that discuss issues |
| with the OS's interface for packet capture on those platforms, such as |
| how to enable support for that interface in the OS, if it's not built in |
| by default. |
| |
| The libpcap interface supports a filtering mechanism based on the |
| architecture in the BSD packet filter. BPF is described in the 1993 |
| Winter Usenix paper ``The BSD Packet Filter: A New Architecture for |
| User-level Packet Capture''. A compressed PostScript version can be |
| found at |
| |
| ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z |
| |
| or |
| |
| http://www.tcpdump.org/papers/bpf-usenix93.ps.Z |
| |
| and a gzipped version can be found at |
| |
| http://www.tcpdump.org/papers/bpf-usenix93.ps.gz |
| |
| A PDF version can be found at |
| |
| http://www.tcpdump.org/papers/bpf-usenix93.pdf |
| |
| Although most packet capture interfaces support in-kernel filtering, |
| libpcap utilizes in-kernel filtering only for the BPF interface. |
| On systems that don't have BPF, all packets are read into user-space |
| and the BPF filters are evaluated in the libpcap library, incurring |
| added overhead (especially, for selective filters). Ideally, libpcap |
| would translate BPF filters into a filter program that is compatible |
| with the underlying kernel subsystem, but this is not yet implemented. |
| |
| BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly |
| BSD, and Mac OS X; an older, modified and undocumented version is |
| standard in AIX. {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the |
| packetfilter interface but has been extended to accept BPF filters |
| (which libpcap utilizes). Also, you can add BPF filter support to |
| Ultrix using the kernel source and/or object patches available in: |
| |
| http://www.tcpdump.org/other/bpfext42.tar.Z |
| |
| Linux, in the 2.2 kernel and later kernels, has a "Socket Filter" |
| mechanism that accepts BPF filters; see the README.linux file for |
| information on configuring that option. |
| |
| Note to Linux distributions and *BSD systems that include libpcap: |
| |
| There's now a rule to make a shared library, which should work on Linux |
| and *BSD, among other platforms. |
| |
| It sets the soname of the library to "libpcap.so.1"; this is what it |
| should be, *NOT* libpcap.so.1.x or libpcap.so.1.x.y or something such as |
| that. |
| |
| We've been maintaining binary compatibility between libpcap releases for |
| quite a while; there's no reason to tie a binary linked with libpcap to |
| a particular release of libpcap. |
| |
| Problems, bugs, questions, desirable enhancements, etc. should be sent |
| to the address "tcpdump-workers@lists.tcpdump.org". Bugs, support |
| requests, and feature requests may also be submitted on the SourceForge |
| site for libpcap at |
| |
| http://sourceforge.net/projects/libpcap/ |
| |
| Source code contributions, etc. should be sent to the email address |
| submitted as patches on the SourceForge site for libpcap. |
| |
| Current versions can be found at www.tcpdump.org, or the SourceForge |
| site for libpcap. |
| |
| - The TCPdump team |