README revision 190225
1@(#) $Header: /tcpdump/master/libpcap/README,v 1.30.4.3 2008-10-17 10:39:20 ken Exp $ (LBL) 2 3LIBPCAP 1.0.0 4 5www.tcpdump.org 6 7Please send inquiries/comments/reports to: 8 tcpdump-workers@lists.tcpdump.org 9 10Anonymous CVS is available via: 11 cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master login 12 (password "anoncvs") 13 cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout libpcap 14 15Version 1.0.0 of LIBPCAP can be retrieved with the CVS tag "libpcap_1_0": 16 cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_1_0 libpcap 17 18Please submit patches against the master copy to the libpcap project on 19sourceforge.net. 20 21formerly from Lawrence Berkeley National Laboratory 22 Network Research Group <libpcap@ee.lbl.gov> 23 ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4) 24 25This directory contains source code for libpcap, a system-independent 26interface for user-level packet capture. libpcap provides a portable 27framework for low-level network monitoring. Applications include 28network statistics collection, security monitoring, network debugging, 29etc. Since almost every system vendor provides a different interface 30for packet capture, and since we've developed several tools that 31require this functionality, we've created this system-independent API 32to ease in porting and to alleviate the need for several 33system-dependent packet capture modules in each application. 34 35For some platforms there are README.{system} files that discuss issues 36with the OS's interface for packet capture on those platforms, such as 37how to enable support for that interface in the OS, if it's not built in 38by default. 39 40The libpcap interface supports a filtering mechanism based on the 41architecture in the BSD packet filter. BPF is described in the 1993 42Winter Usenix paper ``The BSD Packet Filter: A New Architecture for 43User-level Packet Capture''. A compressed PostScript version can be 44found at 45 46 ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z 47 48or 49 50 http://www.tcpdump.org/papers/bpf-usenix93.ps.Z 51 52and a gzipped version can be found at 53 54 http://www.tcpdump.org/papers/bpf-usenix93.ps.gz 55 56A PDF version can be found at 57 58 http://www.tcpdump.org/papers/bpf-usenix93.pdf 59 60Although most packet capture interfaces support in-kernel filtering, 61libpcap utilizes in-kernel filtering only for the BPF interface. 62On systems that don't have BPF, all packets are read into user-space 63and the BPF filters are evaluated in the libpcap library, incurring 64added overhead (especially, for selective filters). Ideally, libpcap 65would translate BPF filters into a filter program that is compatible 66with the underlying kernel subsystem, but this is not yet implemented. 67 68BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD. DEC 69OSF/1/Digital UNIX/Tru64 UNIX uses the packetfilter interface but has 70been extended to accept BPF filters (which libpcap utilizes). Also, you 71can add BPF filter support to Ultrix using the kernel source and/or 72object patches available in: 73 74 ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z. 75 76Linux, in the 2.2 kernel and later kernels, has a "Socket Filter" 77mechanism that accepts BPF filters; see the README.linux file for 78information on configuring that option. 79 80Note to Linux distributions and *BSD systems that include libpcap: 81 82There's now a rule to make a shared library, which should work on Linux 83and *BSD (and OS X). 84 85It sets the soname of the library to "libpcap.so.1"; this is what it 86should be, *NOT* libpcap.so.1.0 or libpcap.so.1.0.0 or something such as 87that. 88 89We've been maintaining binary compatibility between libpcap releases for 90quite a while; there's no reason to tie a binary linked with libpcap to 91a particular release of libpcap. 92 93Problems, bugs, questions, desirable enhancements, etc. should be sent 94to the address "tcpdump-workers@lists.tcpdump.org". Bugs, support 95requests, and feature requests may also be submitted on the SourceForge 96site for libpcap at 97 98 http://sourceforge.net/projects/libpcap/ 99 100Source code contributions, etc. should be sent to the email address 101submitted as patches on the SourceForge site for libpcap. 102 103Current versions can be found at www.tcpdump.org, or the SourceForge 104site for libpcap. 105 106 - The TCPdump team 107