README revision 56889
1@(#) $Header: /tcpdump/master/libpcap/README,v 1.18.1.1 1999/10/07 23:46:40 mcr Exp $ (LBL) 2 3LIBPCAP 0.4 4Lawrence Berkeley National Laboratory 5Network Research Group 6libpcap@ee.lbl.gov 7ftp://ftp.ee.lbl.gov/libpcap.tar.Z 8 9This directory contains source code for libpcap, a system-independent 10interface for user-level packet capture. libpcap provides a portable 11framework for low-level network monitoring. Applications include 12network statistics collection, security monitoring, network debugging, 13etc. Since almost every system vendor provides a different interface 14for packet capture, and since we've developed several tools that 15require this functionality, we've created this system-independent API 16to ease in porting and to alleviate the need for several 17system-dependent packet capture modules in each application. 18 19Note well: this interface is new and is likely to change. 20 21The libpcap interface supports a filtering mechanism based on the 22architecture in the BSD packet filter. BPF is described in the 1993 23Winter Usenix paper ``The BSD Packet Filter: A New Architecture for 24User-level Packet Capture''. A compressed postscript version is in: 25 26 ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z. 27 28Although most packet capture interfaces support in-kernel filtering, 29libpcap utilizes in-kernel filtering only for the BPF interface. 30On systems that don't have BPF, all packets are read into user-space 31and the BPF filters are evaluated in the libpcap library, incurring 32added overhead (especially, for selective filters). Ideally, libpcap 33would translate BPF filters into a filter program that is compatible 34with the underlying kernel subsystem, but this is not yet implemented. 35 36BPF is standard in 4.4BSD, BSD/386, NetBSD, and FreeBSD. DEC OSF/1 37uses the packetfilter interface but has been extended to accept BPF 38filters (which libpcap utilizes). Also, you can add BPF filter support 39to Ultrix using the kernel source and/or object patches available in: 40 41 ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z. 42 43Problems, bugs, questions, desirable enhancements, source code 44contributions, etc., should be sent to the email address 45"libpcap@ee.lbl.gov". 46 47 - Steve McCanne 48 Craig Leres 49 Van Jacobson 50