README revision 26175 
1@(#) $Header: README,v 1.17 96/11/29 01:14:24 leres Exp $ (LBL)
2
3LIBPCAP 0.3
4Lawrence Berkeley National Laboratory
5Network Research Group
6libpcap@ee.lbl.gov
7ftp://ftp.ee.lbl.gov/libpcap.tar.Z
8
9This directory contains source code for libpcap, a system-independent
10interface for user-level packet capture.  libpcap provides a portable
11framework for low-level network monitoring.  Applications include
12network statistics collection, security monitoring, network debugging,
13etc.  Since almost every system vendor provides a different interface
14for packet capture, and since we've developed several tools that
15require this functionality, we've created this system-independent API
16to ease in porting and to alleviate the need for several
17system-dependent packet capture modules in each application.
18
19Note well: this interface is new and is likely to change.
20
21The libpcap interface supports a filtering mechanism based on the
22architecture in the BSD packet filter.  BPF is described in the 1993
23Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
24User-level Packet Capture''.  A compressed postscript version is in:
25
26	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z.
27
28Although most packet capture interfaces support in-kernel filtering,
29libpcap utilizes in-kernel filtering only for the BPF interface.
30On systems that don't have BPF, all packets are read into user-space
31and the BPF filters are evaluated in the libpcap library, incurring
32added overhead (especially, for selective filters).  Ideally, libpcap
33would translate BPF filters into a filter program that is compatible
34with the underlying kernel subsystem, but this is not yet implemented.
35
36BPF is standard in 4.4BSD, BSD/386, NetBSD, and FreeBSD.  DEC OSF/1
37uses the packetfilter interface but has been extended to accept BPF
38filters (which libpcap utilizes).  Also, you can add BPF filter support
39to Ultrix using the kernel source and/or object patches available in:
40
41	ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.
42
43Problems, bugs, questions, desirable enhancements, source code
44contributions, etc., should be sent to the email address
45"libpcap@ee.lbl.gov".
46
47 - Steve McCanne
48   Craig Leres
49   Van Jacobson
50