You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Carsten Larsen 3034926465 Cleanup 2 years ago
SUNOS4 Initial commit 2 years ago
Win32 Initial commit 2 years ago
amigaos-dist Initial commit 2 years ago
bpf/net Initial commit 2 years ago
lbl Initial commit 2 years ago
packaging Initial commit 2 years ago
CHANGES Initial commit 2 years ago
CREDITS Initial commit 2 years ago
FILES Initial commit 2 years ago
GNUmakefile.68k Initial commit 2 years ago
GNUmakefile.os4 Initial commit 2 years ago
INSTALL.txt Initial commit 2 years ago
LICENSE Initial commit 2 years ago
Makefile.in Initial commit 2 years ago
README Cleanup 2 years ago
README.Win32 Initial commit 2 years ago
README.aix Initial commit 2 years ago
README.dag Initial commit 2 years ago
README.hpux Initial commit 2 years ago
README.linux Initial commit 2 years ago
README.tru64 Initial commit 2 years ago
TODO Initial commit 2 years ago
acconfig.h Initial commit 2 years ago
aclocal.m4 Initial commit 2 years ago
amiga_types.h Initial commit 2 years ago
arcnet.h Initial commit 2 years ago
atmuni31.h Initial commit 2 years ago
bpf_dump.c Initial commit 2 years ago
bpf_filter.c Initial commit 2 years ago
bpf_image.c Initial commit 2 years ago
config.cache Initial commit 2 years ago
config.guess Initial commit 2 years ago
config.h Initial commit 2 years ago
config.h.in Initial commit 2 years ago
config.log Initial commit 2 years ago
config.status Initial commit 2 years ago
config.sub Initial commit 2 years ago
configure Initial commit 2 years ago
configure.in Initial commit 2 years ago
etherent.c Initial commit 2 years ago
ethertype.h Initial commit 2 years ago
fad-getad.c Initial commit 2 years ago
fad-gifc.c Initial commit 2 years ago
fad-glifc.c Initial commit 2 years ago
fad-null.c Initial commit 2 years ago
fad-win32.c Initial commit 2 years ago
ffs.c Initial commit 2 years ago
gencode.c Initial commit 2 years ago
gencode.h Initial commit 2 years ago
grammar.c Initial commit 2 years ago
grammar.y Initial commit 2 years ago
inet.c Initial commit 2 years ago
install-sh Initial commit 2 years ago
llc.h Initial commit 2 years ago
mkdep Initial commit 2 years ago
nametoaddr.c Initial commit 2 years ago
nlpid.h Initial commit 2 years ago
optimize.c Initial commit 2 years ago
pcap-bpf.c Initial commit 2 years ago
pcap-bpf.h Initial commit 2 years ago
pcap-dag.c Initial commit 2 years ago
pcap-dag.h Initial commit 2 years ago
pcap-dlpi.c Initial commit 2 years ago
pcap-enet.c Initial commit 2 years ago
pcap-int.h Initial commit 2 years ago
pcap-linux.c Initial commit 2 years ago
pcap-namedb.h Initial commit 2 years ago
pcap-nit.c Initial commit 2 years ago
pcap-nit.h Initial commit 2 years ago
pcap-null.c Initial commit 2 years ago
pcap-pf.c Initial commit 2 years ago
pcap-pf.h Initial commit 2 years ago
pcap-snit.c Initial commit 2 years ago
pcap-snoop.c Initial commit 2 years ago
pcap-stdinc.h Initial commit 2 years ago
pcap-win32.c Initial commit 2 years ago
pcap.3 Initial commit 2 years ago
pcap.c Initial commit 2 years ago
pcap.h Initial commit 2 years ago
pf.h Initial commit 2 years ago
ppp.h Initial commit 2 years ago
rawss7.h Initial commit 2 years ago
savefile.c Initial commit 2 years ago
scanner.c Initial commit 2 years ago
scanner.l Initial commit 2 years ago
sll.h Initial commit 2 years ago
snprintf.c Initial commit 2 years ago
sunatmpos.h Initial commit 2 years ago
tokdefs.h Initial commit 2 years ago
version.c Initial commit 2 years ago
version.h Initial commit 2 years ago

README

LIBPCAP 0.8
Now maintained by "The Tcpdump Group"
See www.tcpdump.org

Please send inquiries/comments/reports to tcpdump-workers@tcpdump.org

Anonymous CVS is available via:
cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master login
(password "anoncvs")
cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout libpcap

Version 0.8 of LIBPCAP can be retrieved with the CVS tag "libpcap_0_8rel1":
cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_0_8rel1 libpcap

Please send patches against the master copy to patches@tcpdump.org.

formerly from

Lawrence Berkeley National Laboratory
Network Research Group <libpcap@ee.lbl.gov>
ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4)

This directory contains source code for libpcap, a system-independent
interface for user-level packet capture. libpcap provides a portable
framework for low-level network monitoring. Applications include
network statistics collection, security monitoring, network debugging,
etc. Since almost every system vendor provides a different interface
for packet capture, and since we've developed several tools that
require this functionality, we've created this system-independent API
to ease in porting and to alleviate the need for several
system-dependent packet capture modules in each application.

Note well: this interface is new and is likely to change.

For some platforms there are README.{system} files that discuss issues
with the OS's interface for packet capture on those platforms, such as
how to enable support for that interface in the OS, if it's not built in
by default.

The libpcap interface supports a filtering mechanism based on the
architecture in the BSD packet filter. BPF is described in the 1993
Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
User-level Packet Capture''. A compressed PostScript version can be
found at

ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z

or

http://www.tcpdump.org/papers/bpf-usenix93.ps.Z

and a gzipped version can be found at

http://www.tcpdump.org/papers/bpf-usenix93.ps.gz

A PDF version can be found at

http://www.tcpdump.org/papers/bpf-usenix93.pdf

Although most packet capture interfaces support in-kernel filtering,
libpcap utilizes in-kernel filtering only for the BPF interface.
On systems that don't have BPF, all packets are read into user-space
and the BPF filters are evaluated in the libpcap library, incurring
added overhead (especially, for selective filters). Ideally, libpcap
would translate BPF filters into a filter program that is compatible
with the underlying kernel subsystem, but this is not yet implemented.

BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD. DEC
OSF/1/Digital UNIX/Tru64 UNIX uses the packetfilter interface but has
been extended to accept BPF filters (which libpcap utilizes). Also, you
can add BPF filter support to Ultrix using the kernel source and/or
object patches available in:

ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.

Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
mechanism that accepts BPF filters; see the README.linux file for
information on configuring that option.

Problems, bugs, questions, desirable enhancements, etc. should be sent
to the address "tcpdump-workers@tcpdump.org". Bugs, support requests,
and feature requests may also be submitted on the SourceForge site for
libpcap at

http://sourceforge.net/projects/libpcap/

Source code contributions, etc. should be sent to the email address
"patches@tcpdump.org", or submitted as patches on the SourceForge site
for libpcap.

Current versions can be found at www.tcpdump.org, or the SourceForge
site for libpcap.

- The TCPdump team