README
1@(#) $Header: /tcpdump/master/libpcap/README,v 1.30 2004/10/12 02:02:28 guy Exp $ (LBL)
2
3LIBPCAP 0.9
4Now maintained by "The Tcpdump Group"
5See www.tcpdump.org
6
7Please send inquiries/comments/reports to tcpdump-workers@tcpdump.org
8
9Anonymous CVS is available via:
10 cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master login
11 (password "anoncvs")
12 cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout libpcap
13
14Version 0.9 of LIBPCAP can be retrieved with the CVS tag "libpcap_0_9rel1":
15 cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_0_9rel1 libpcap
16
17Please send patches against the master copy to patches@tcpdump.org.
18
19formerly from Lawrence Berkeley National Laboratory
20 Network Research Group <libpcap@ee.lbl.gov>
21 ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4)
22
23This directory contains source code for libpcap, a system-independent
24interface for user-level packet capture. libpcap provides a portable
25framework for low-level network monitoring. Applications include
26network statistics collection, security monitoring, network debugging,
27etc. Since almost every system vendor provides a different interface
28for packet capture, and since we've developed several tools that
29require this functionality, we've created this system-independent API
30to ease in porting and to alleviate the need for several
31system-dependent packet capture modules in each application.
32
33Note well: this interface is new and is likely to change.
34
35For some platforms there are README.{system} files that discuss issues
36with the OS's interface for packet capture on those platforms, such as
37how to enable support for that interface in the OS, if it's not built in
38by default.
39
40The libpcap interface supports a filtering mechanism based on the
41architecture in the BSD packet filter. BPF is described in the 1993
42Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
43User-level Packet Capture''. A compressed PostScript version can be
44found at
45
46 ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z
47
48or
49
50 http://www.tcpdump.org/papers/bpf-usenix93.ps.Z
51
52and a gzipped version can be found at
53
54 http://www.tcpdump.org/papers/bpf-usenix93.ps.gz
55
56A PDF version can be found at
57
58 http://www.tcpdump.org/papers/bpf-usenix93.pdf
59
60Although most packet capture interfaces support in-kernel filtering,
61libpcap utilizes in-kernel filtering only for the BPF interface.
62On systems that don't have BPF, all packets are read into user-space
63and the BPF filters are evaluated in the libpcap library, incurring
64added overhead (especially, for selective filters). Ideally, libpcap
65would translate BPF filters into a filter program that is compatible
66with the underlying kernel subsystem, but this is not yet implemented.
67
68BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD. DEC
69OSF/1/Digital UNIX/Tru64 UNIX uses the packetfilter interface but has
70been extended to accept BPF filters (which libpcap utilizes). Also, you
71can add BPF filter support to Ultrix using the kernel source and/or
72object patches available in:
73
74 ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.
75
76Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
77mechanism that accepts BPF filters; see the README.linux file for
78information on configuring that option.
79
80Problems, bugs, questions, desirable enhancements, etc. should be sent
81to the address "tcpdump-workers@tcpdump.org". Bugs, support requests,
82and feature requests may also be submitted on the SourceForge site for
83libpcap at
84
85 http://sourceforge.net/projects/libpcap/
86
87Source code contributions, etc. should be sent to the email address
88"patches@tcpdump.org", or submitted as patches on the SourceForge site
89for libpcap.
90
91Current versions can be found at www.tcpdump.org, or the SourceForge
92site for libpcap.
93
94 - The TCPdump team
95
README.linux
1In order for libpcap to be able to capture packets on a Linux system,
2the "packet" protocol must be supported by your kernel. If it is not,
3you may get error messages such as
4
5 modprobe: can't locate module net-pf-17
6
7in "/var/adm/messages", or may get messages such as
8
9 socket: Address family not supported by protocol
10
11from applications using libpcap.
12
13You must configure the kernel with the CONFIG_PACKET option for this
14protocol; the following note is from the Linux "Configure.help" file for
15the 2.0[.x] kernel:
16
17 Packet socket
18 CONFIG_PACKET
19 The Packet protocol is used by applications which communicate
20 directly with network devices without an intermediate network
21 protocol implemented in the kernel, e.g. tcpdump. If you want them
22 to work, choose Y.
23
24 This driver is also available as a module called af_packet.o ( =
25 code which can be inserted in and removed from the running kernel
26 whenever you want). If you want to compile it as a module, say M
27 here and read Documentation/modules.txt; if you use modprobe or
28 kmod, you may also want to add "alias net-pf-17 af_packet" to
29 /etc/modules.conf.
30
31and the note for the 2.2[.x] kernel says:
32
33 Packet socket
34 CONFIG_PACKET
35 The Packet protocol is used by applications which communicate
36 directly with network devices without an intermediate network
37 protocol implemented in the kernel, e.g. tcpdump. If you want them
38 to work, choose Y. This driver is also available as a module called
39 af_packet.o ( = code which can be inserted in and removed from the
40 running kernel whenever you want). If you want to compile it as a
41 module, say M here and read Documentation/modules.txt. You will
42 need to add 'alias net-pf-17 af_packet' to your /etc/conf.modules
43 file for the module version to function automatically. If unsure,
44 say Y.
45
46In addition, there is an option that, in 2.2 and later kernels, will
47allow packet capture filters specified to programs such as tcpdump to be
48executed in the kernel, so that packets that don't pass the filter won't
49be copied from the kernel to the program, rather than having all packets
50copied to the program and libpcap doing the filtering in user mode.
51
52Copying packets from the kernel to the program consumes a significant
53amount of CPU, so filtering in the kernel can reduce the overhead of
54capturing packets if a filter has been specified that discards a
55significant number of packets. (If no filter is specified, it makes no
56difference whether the filtering isn't performed in the kernel or isn't
57performed in user mode. :-))
58
59The option for this is the CONFIG_FILTER option; the "Configure.help"
60file says:
61
62 Socket filtering
63 CONFIG_FILTER
64 The Linux Socket Filter is derived from the Berkeley Packet Filter.
65 If you say Y here, user-space programs can attach a filter to any
66 socket and thereby tell the kernel that it should allow or disallow
67 certain types of data to get through the socket. Linux Socket
68 Filtering works on all socket types except TCP for now. See the text
69 file linux/Documentation/networking/filter.txt for more information.
70 If unsure, say N.
71
72
73Statistics:
74Statistics reported by pcap are platform specific. The statistics
75reported by pcap_stats on Linux are as follows:
76
772.2.x
78=====
79ps_recv Number of packets that were accepted by the pcap filter
80ps_drops Always 0, this statistic is not gatherd on this platform
81
822.4.x
83=====
84ps_rec Number of packets that were accepted by the pcap filter
85ps_drops Number of packets that had passed filtering but were not
86 passed on to pcap due to things like buffer shortage, etc.
87 This is useful because these are packets you are interested in
88 but won't be reported by, for example, tcpdump output.
89