README revision 75107
1@(#) $Header: /tcpdump/master/libpcap/README,v 1.22 2000/07/13 06:24:14 guy Exp $ (LBL) 2 3LIBPCAP 0.5 4Now maintained by "The Tcpdump Group" 5See www.tcpdump.org 6 7Please send inquiries/comments/reports to tcpdump-workers@tcpdump.org 8 9Anonymous CVS is available via: 10 cvs -d cvs.tcpdump.org:/tcpdump/master login 11 (password "anoncvs") 12 cvs -d cvs.tcpdump.org:/tcpdump/master checkout libpcap 13 14Version 0.5 of LIBPCAP can be retrived with the CVS tag "libpcap_0_5": 15 cvs -d cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_0_5 libpcap 16 17Please send patches against the master copy to patches@tcpdump.org. 18 19formerly from Lawrence Berkeley National Laboratory 20 Network Research Group <libpcap@ee.lbl.gov> 21 ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4) 22 23This directory contains source code for libpcap, a system-independent 24interface for user-level packet capture. libpcap provides a portable 25framework for low-level network monitoring. Applications include 26network statistics collection, security monitoring, network debugging, 27etc. Since almost every system vendor provides a different interface 28for packet capture, and since we've developed several tools that 29require this functionality, we've created this system-independent API 30to ease in porting and to alleviate the need for several 31system-dependent packet capture modules in each application. 32 33Note well: this interface is new and is likely to change. 34 35The libpcap interface supports a filtering mechanism based on the 36architecture in the BSD packet filter. BPF is described in the 1993 37Winter Usenix paper ``The BSD Packet Filter: A New Architecture for 38User-level Packet Capture''. A compressed postscript version is in: 39 40 ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z. 41 42Although most packet capture interfaces support in-kernel filtering, 43libpcap utilizes in-kernel filtering only for the BPF interface. 44On systems that don't have BPF, all packets are read into user-space 45and the BPF filters are evaluated in the libpcap library, incurring 46added overhead (especially, for selective filters). Ideally, libpcap 47would translate BPF filters into a filter program that is compatible 48with the underlying kernel subsystem, but this is not yet implemented. 49 50BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD. DEC OSF/1 51uses the packetfilter interface but has been extended to accept BPF 52filters (which libpcap utilizes). Also, you can add BPF filter support 53to Ultrix using the kernel source and/or object patches available in: 54 55 ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z. 56 57Problems, bugs, questions, desirable enhancements, etc. 58should be sent to the address "tcpdump-workers@tcpdump.org". 59 60Source code contributions, etc. should be sent to the email address 61"patches@tcpdump.org". 62 63Current versions can be found at www.tcpdump.org 64 65 - The TCPdump team 66