README revision 127664 
1@(#) $Header: /tcpdump/master/libpcap/README,v 1.27.2.1 2003/11/15 23:29:19 guy Exp $ (LBL)
2
3LIBPCAP 0.8
4Now maintained by "The Tcpdump Group"
5See 		www.tcpdump.org
6
7Please send inquiries/comments/reports to 	tcpdump-workers@tcpdump.org
8
9Anonymous CVS is available via:
10	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master login
11	(password "anoncvs")
12	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout libpcap
13
14Version 0.8 of LIBPCAP can be retrieved with the CVS tag "libpcap_0_8rel1":
15	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_0_8rel1 libpcap
16
17Please send patches against the master copy to patches@tcpdump.org.
18
19formerly from 	Lawrence Berkeley National Laboratory
20		Network Research Group <libpcap@ee.lbl.gov>
21		ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4)
22
23This directory contains source code for libpcap, a system-independent
24interface for user-level packet capture.  libpcap provides a portable
25framework for low-level network monitoring.  Applications include
26network statistics collection, security monitoring, network debugging,
27etc.  Since almost every system vendor provides a different interface
28for packet capture, and since we've developed several tools that
29require this functionality, we've created this system-independent API
30to ease in porting and to alleviate the need for several
31system-dependent packet capture modules in each application.
32
33Note well: this interface is new and is likely to change.
34
35For some platforms there are README.{system} files that discuss issues
36with the OS's interface for packet capture on those platforms, such as
37how to enable support for that interface in the OS, if it's not built in
38by default.
39
40The libpcap interface supports a filtering mechanism based on the
41architecture in the BSD packet filter.  BPF is described in the 1993
42Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
43User-level Packet Capture''.  A compressed PostScript version can be
44found at
45
46	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z
47
48or
49
50	http://www.tcpdump.org/papers/bpf-usenix93.ps.Z
51
52and a gzipped version can be found at
53
54	http://www.tcpdump.org/papers/bpf-usenix93.ps.gz
55
56A PDF version can be found at
57
58	http://www.tcpdump.org/papers/bpf-usenix93.pdf
59
60Although most packet capture interfaces support in-kernel filtering,
61libpcap utilizes in-kernel filtering only for the BPF interface.
62On systems that don't have BPF, all packets are read into user-space
63and the BPF filters are evaluated in the libpcap library, incurring
64added overhead (especially, for selective filters).  Ideally, libpcap
65would translate BPF filters into a filter program that is compatible
66with the underlying kernel subsystem, but this is not yet implemented.
67
68BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD.  DEC
69OSF/1/Digital UNIX/Tru64 UNIX uses the packetfilter interface but has
70been extended to accept BPF filters (which libpcap utilizes).  Also, you
71can add BPF filter support to Ultrix using the kernel source and/or
72object patches available in:
73
74	ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.
75
76Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
77mechanism that accepts BPF filters; see the README.linux file for
78information on configuring that option.
79
80Problems, bugs, questions, desirable enhancements, etc. should be sent
81to the address "tcpdump-workers@tcpdump.org".  Bugs, support requests,
82and feature requests may also be submitted on the SourceForge site for
83libpcap at
84
85	http://sourceforge.net/projects/libpcap/
86
87Source code contributions, etc. should be sent to the email address
88"patches@tcpdump.org", or submitted as patches on the SourceForge site
89for libpcap.
90
91Current versions can be found at www.tcpdump.org, or the SourceForge
92site for libpcap.
93
94 - The TCPdump team
95