NameDateSize

..17-Jul-20124 KiB

acconfig.h17-Jul-2012303

aclocal.m417-Jul-201224.6 KiB

Android.mk17-Jul-2012442

arcnet.h17-Jul-20122.5 KiB

atmuni31.h17-Jul-20123.9 KiB

bpf/17-Jul-20124 KiB

bpf_dump.c17-Jul-20122 KiB

bpf_image.c17-Jul-20124.9 KiB

CHANGES17-Jul-201217.8 KiB

ChmodBPF/17-Jul-20124 KiB

CleanSpec.mk17-Jul-20122.2 KiB

config.guess17-Jul-201241.9 KiB

config.h17-Jul-20125.2 KiB

config.h.in17-Jul-20124.8 KiB

config.sub17-Jul-201230.1 KiB

configure17-Jul-2012238.7 KiB

configure.in17-Jul-201221.5 KiB

CREDITS17-Jul-20124 KiB

doc/17-Jul-20124 KiB

etherent.c17-Jul-20123.3 KiB

ethertype.h17-Jul-20123.4 KiB

fad-getad.c17-Jul-20128.3 KiB

fad-gifc.c17-Jul-201216.3 KiB

fad-glifc.c17-Jul-201210.3 KiB

fad-null.c17-Jul-20122.6 KiB

fad-win32.c17-Jul-20127.9 KiB

ffs.h17-Jul-2012416

FILES17-Jul-20121.8 KiB

gencode.c17-Jul-2012168.2 KiB

gencode.h17-Jul-20129.4 KiB

grammar.c17-Jul-201283.6 KiB

grammar.y17-Jul-201213.1 KiB

inet.c17-Jul-201219.5 KiB

install-sh17-Jul-20125.5 KiB

INSTALL.txt17-Jul-201216.1 KiB

lbl/17-Jul-20124 KiB

LICENSE17-Jul-2012873

llc.h17-Jul-20122 KiB

Makefile.in17-Jul-20127.2 KiB

missing/17-Jul-20124 KiB

mkdep17-Jul-20122.3 KiB

MODULE_LICENSE_BSD17-Jul-20120

nametoaddr.c17-Jul-201210.1 KiB

nlpid.h17-Jul-20121.8 KiB

NOTICE17-Jul-2012873

optimize.c17-Jul-201248.3 KiB

packaging/17-Jul-20124 KiB

pcap-bpf.c17-Jul-201230.1 KiB

pcap-bpf.h17-Jul-201225.4 KiB

pcap-dag.c17-Jul-201225.8 KiB

pcap-dag.h17-Jul-2012603

pcap-dlpi.c17-Jul-201246.7 KiB

pcap-dos.c17-Jul-201234.3 KiB

pcap-dos.h17-Jul-20126.8 KiB

pcap-enet.c17-Jul-20124.9 KiB

pcap-int.h17-Jul-201210.6 KiB

pcap-linux.c17-Jul-201261.2 KiB

pcap-namedb.h17-Jul-20123.3 KiB

pcap-nit.c17-Jul-20128.8 KiB

pcap-nit.h17-Jul-2012970

pcap-null.c17-Jul-20121.8 KiB

pcap-pf.c17-Jul-201216.4 KiB

pcap-pf.h17-Jul-2012969

pcap-septel.c17-Jul-20127.8 KiB

pcap-septel.h17-Jul-2012573

pcap-snit.c17-Jul-201210.8 KiB

pcap-snoop.c17-Jul-201211.7 KiB

pcap-stdinc.h17-Jul-20122.2 KiB

pcap-win32.c17-Jul-201218.9 KiB

pcap.317-Jul-201235.3 KiB

pcap.c17-Jul-201225.2 KiB

pcap.h17-Jul-201210.8 KiB

pcap1.h17-Jul-20129.3 KiB

ppp.h17-Jul-20122.7 KiB

README17-Jul-20123.7 KiB

README.linux17-Jul-20123.7 KiB

savefile.c17-Jul-201242.7 KiB

scanner.c17-Jul-2012169.2 KiB

scanner.l17-Jul-201210.2 KiB

sll.h17-Jul-20125.4 KiB

sunatmpos.h17-Jul-20122.2 KiB

TODO17-Jul-20121.5 KiB

tokdefs.h17-Jul-20125.3 KiB

VERSION17-Jul-20126

version.c17-Jul-201231

version.h17-Jul-201267

wlan_filtering.patch17-Jul-201210.3 KiB

README

1@(#) $Header: /tcpdump/master/libpcap/README,v 1.30 2004/10/12 02:02:28 guy Exp $ (LBL)
2
3LIBPCAP 0.9
4Now maintained by "The Tcpdump Group"
5See 		www.tcpdump.org
6
7Please send inquiries/comments/reports to 	tcpdump-workers@tcpdump.org
8
9Anonymous CVS is available via:
10	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master login
11	(password "anoncvs")
12	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout libpcap
13
14Version 0.9 of LIBPCAP can be retrieved with the CVS tag "libpcap_0_9rel1":
15	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_0_9rel1 libpcap
16
17Please send patches against the master copy to patches@tcpdump.org.
18
19formerly from 	Lawrence Berkeley National Laboratory
20		Network Research Group <libpcap@ee.lbl.gov>
21		ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4)
22
23This directory contains source code for libpcap, a system-independent
24interface for user-level packet capture.  libpcap provides a portable
25framework for low-level network monitoring.  Applications include
26network statistics collection, security monitoring, network debugging,
27etc.  Since almost every system vendor provides a different interface
28for packet capture, and since we've developed several tools that
29require this functionality, we've created this system-independent API
30to ease in porting and to alleviate the need for several
31system-dependent packet capture modules in each application.
32
33Note well: this interface is new and is likely to change.
34
35For some platforms there are README.{system} files that discuss issues
36with the OS's interface for packet capture on those platforms, such as
37how to enable support for that interface in the OS, if it's not built in
38by default.
39
40The libpcap interface supports a filtering mechanism based on the
41architecture in the BSD packet filter.  BPF is described in the 1993
42Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
43User-level Packet Capture''.  A compressed PostScript version can be
44found at
45
46	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z
47
48or
49
50	http://www.tcpdump.org/papers/bpf-usenix93.ps.Z
51
52and a gzipped version can be found at
53
54	http://www.tcpdump.org/papers/bpf-usenix93.ps.gz
55
56A PDF version can be found at
57
58	http://www.tcpdump.org/papers/bpf-usenix93.pdf
59
60Although most packet capture interfaces support in-kernel filtering,
61libpcap utilizes in-kernel filtering only for the BPF interface.
62On systems that don't have BPF, all packets are read into user-space
63and the BPF filters are evaluated in the libpcap library, incurring
64added overhead (especially, for selective filters).  Ideally, libpcap
65would translate BPF filters into a filter program that is compatible
66with the underlying kernel subsystem, but this is not yet implemented.
67
68BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD.  DEC
69OSF/1/Digital UNIX/Tru64 UNIX uses the packetfilter interface but has
70been extended to accept BPF filters (which libpcap utilizes).  Also, you
71can add BPF filter support to Ultrix using the kernel source and/or
72object patches available in:
73
74	ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.
75
76Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
77mechanism that accepts BPF filters; see the README.linux file for
78information on configuring that option.
79
80Problems, bugs, questions, desirable enhancements, etc. should be sent
81to the address "tcpdump-workers@tcpdump.org".  Bugs, support requests,
82and feature requests may also be submitted on the SourceForge site for
83libpcap at
84
85	http://sourceforge.net/projects/libpcap/
86
87Source code contributions, etc. should be sent to the email address
88"patches@tcpdump.org", or submitted as patches on the SourceForge site
89for libpcap.
90
91Current versions can be found at www.tcpdump.org, or the SourceForge
92site for libpcap.
93
94 - The TCPdump team
95

README.linux

1In order for libpcap to be able to capture packets on a Linux system,
2the "packet" protocol must be supported by your kernel.  If it is not,
3you may get error messages such as
4
5	modprobe: can't locate module net-pf-17
6
7in "/var/adm/messages", or may get messages such as
8
9	socket: Address family not supported by protocol
10
11from applications using libpcap.
12
13You must configure the kernel with the CONFIG_PACKET option for this
14protocol; the following note is from the Linux "Configure.help" file for
15the 2.0[.x] kernel:
16
17	Packet socket
18	CONFIG_PACKET
19	  The Packet protocol is used by applications which communicate
20	  directly with network devices without an intermediate network
21	  protocol implemented in the kernel, e.g. tcpdump. If you want them
22	  to work, choose Y. 
23
24	  This driver is also available as a module called af_packet.o ( =
25	  code which can be inserted in and removed from the running kernel
26	  whenever you want). If you want to compile it as a module, say M
27	  here and read Documentation/modules.txt; if you use modprobe or
28	  kmod, you may also want to add "alias net-pf-17 af_packet" to 
29	  /etc/modules.conf.
30
31and the note for the 2.2[.x] kernel says:
32
33	Packet socket
34	CONFIG_PACKET
35	  The Packet protocol is used by applications which communicate
36	  directly with network devices without an intermediate network
37	  protocol implemented in the kernel, e.g. tcpdump. If you want them
38	  to work, choose Y. This driver is also available as a module called
39	  af_packet.o ( = code which can be inserted in and removed from the
40	  running kernel whenever you want). If you want to compile it as a
41	  module, say M here and read Documentation/modules.txt.  You will
42	  need to add 'alias net-pf-17 af_packet' to your /etc/conf.modules
43	  file for the module version to function automatically.  If unsure,
44	  say Y.
45
46In addition, there is an option that, in 2.2 and later kernels, will
47allow packet capture filters specified to programs such as tcpdump to be
48executed in the kernel, so that packets that don't pass the filter won't
49be copied from the kernel to the program, rather than having all packets
50copied to the program and libpcap doing the filtering in user mode. 
51
52Copying packets from the kernel to the program consumes a significant
53amount of CPU, so filtering in the kernel can reduce the overhead of
54capturing packets if a filter has been specified that discards a
55significant number of packets.  (If no filter is specified, it makes no
56difference whether the filtering isn't performed in the kernel or isn't
57performed in user mode. :-))
58
59The option for this is the CONFIG_FILTER option; the "Configure.help"
60file says:
61
62	Socket filtering
63	CONFIG_FILTER
64	  The Linux Socket Filter is derived from the Berkeley Packet Filter.
65	  If you say Y here, user-space programs can attach a filter to any
66	  socket and thereby tell the kernel that it should allow or disallow
67	  certain types of data to get through the socket. Linux Socket
68	  Filtering works on all socket types except TCP for now. See the text
69	  file linux/Documentation/networking/filter.txt for more information.
70	  If unsure, say N.
71
72
73Statistics:
74Statistics reported by pcap are platform specific.  The statistics
75reported by pcap_stats on Linux are as follows:
76
772.2.x
78=====
79ps_recv   Number of packets that were accepted by the pcap filter
80ps_drops  Always 0, this statistic is not gatherd on this platform
81
822.4.x
83=====
84ps_rec    Number of packets that were accepted by the pcap filter
85ps_drops  Number of packets that had passed filtering but were not
86          passed on to pcap due to things like buffer shortage, etc.
87			 This is useful because these are packets you are interested in
88			 but won't be reported by, for example, tcpdump output.
89