NameDateSize

..11-Jun-201812 KiB

.gitignore11-Jun-201893

aclocal.m411-Jun-201836.1 KiB

Android.mk11-Jun-20181.4 KiB

arcnet.h11-Jun-20182.4 KiB

atmuni31.h11-Jun-20183.9 KiB

bpf/11-Jun-20184 KiB

bpf_dump.c11-Jun-20181.9 KiB

bpf_filter.c11-Jun-201816.4 KiB

bpf_image.c11-Jun-20185.3 KiB

CHANGES11-Jun-201833.1 KiB

chmod_bpf11-Jun-2018760

ChmodBPF/11-Jun-20184 KiB

CleanSpec.mk11-Jun-20182.2 KiB

cmake/11-Jun-20184 KiB

cmakeconfig.h.in11-Jun-20189.5 KiB

CMakeLists.txt11-Jun-201816.2 KiB

config/11-Jun-20184 KiB

config.guess11-Jun-201842.3 KiB

config.h11-Jun-20189.4 KiB

config.h.in11-Jun-20188.8 KiB

config.sub11-Jun-201835.2 KiB

configure11-Jun-2018280.1 KiB

configure.ac11-Jun-201848.7 KiB

CREDITS11-Jun-201811 KiB

dlpisubs.c11-Jun-20189.2 KiB

dlpisubs.h11-Jun-2018702

etherent.c11-Jun-20183.3 KiB

ethertype.h11-Jun-20183.5 KiB

extract.h11-Jun-20189 KiB

fad-getad.c11-Jun-20188.8 KiB

fad-gifc.c11-Jun-201812.8 KiB

fad-glifc.c11-Jun-20189.7 KiB

fad-helpers.c11-Jun-201825.1 KiB

gen_version_c.sh11-Jun-2018247

gen_version_header.sh11-Jun-2018369

gencode.c11-Jun-2018230.2 KiB

gencode.h11-Jun-201811.7 KiB

GenVersion.bat11-Jun-2018474

grammar.c11-Jun-2018114.8 KiB

grammar.h11-Jun-20186.3 KiB

grammar.y11-Jun-201822.3 KiB

ieee80211.h11-Jun-20185.3 KiB

inet.c11-Jun-201810.5 KiB

install-sh11-Jun-20185.4 KiB

INSTALL.txt11-Jun-201816.4 KiB

lbl/11-Jun-20184 KiB

LICENSE11-Jun-2018868

llc.h11-Jun-20182.6 KiB

Makefile-devel-adds11-Jun-2018614

Makefile.in11-Jun-201823.2 KiB

missing/11-Jun-20184 KiB

mkdep11-Jun-20182.4 KiB

MODULE_LICENSE_BSD11-Jun-20180

msdos/11-Jun-20184 KiB

nametoaddr.c11-Jun-201811.8 KiB

nametoaddr.h11-Jun-20182.1 KiB

net/11-Jun-20184 KiB

nlpid.h11-Jun-20181.7 KiB

NOTICE11-Jun-2018873

optimize.c11-Jun-201854.7 KiB

org.tcpdump.chmod_bpf.plist11-Jun-2018441

pcap/11-Jun-20184 KiB

pcap-bpf.c11-Jun-201878.1 KiB

pcap-bpf.h11-Jun-20182.2 KiB

pcap-bt-linux.c11-Jun-201810.7 KiB

pcap-bt-linux.h11-Jun-20181.8 KiB

pcap-bt-monitor-linux.c11-Jun-20187 KiB

pcap-bt-monitor-linux.h11-Jun-20181.6 KiB

pcap-common.c11-Jun-201843.7 KiB

pcap-common.h11-Jun-2018955

pcap-config11-Jun-20181.6 KiB

pcap-config.111-Jun-20182.3 KiB

pcap-config.in11-Jun-20181.6 KiB

pcap-dag.c11-Jun-201835.2 KiB

pcap-dag.h11-Jun-2018453

pcap-dbus.c11-Jun-20187.5 KiB

pcap-dbus.h11-Jun-2018108

pcap-dlpi.c11-Jun-201845.5 KiB

pcap-dos.c11-Jun-201835.1 KiB

pcap-dos.h11-Jun-20186.7 KiB

pcap-enet.c11-Jun-20184.7 KiB

pcap-filter.manmisc11-Jun-201832 KiB

pcap-filter.manmisc.in11-Jun-201832 KiB

pcap-int.h11-Jun-201814.8 KiB

pcap-libdlpi.c11-Jun-201810.6 KiB

pcap-linktype.manmisc11-Jun-20182.3 KiB

pcap-linktype.manmisc.in11-Jun-20182.3 KiB

pcap-linux.c11-Jun-2018189.2 KiB

pcap-namedb.h11-Jun-20182 KiB

pcap-netfilter-linux-android.c11-Jun-2018858

pcap-netfilter-linux-android.h11-Jun-2018784

pcap-netfilter-linux.c11-Jun-201818.1 KiB

pcap-netfilter-linux.h11-Jun-20181.7 KiB

pcap-new.c11-Jun-201834.3 KiB

pcap-nit.c11-Jun-20189.5 KiB

pcap-null.c11-Jun-20181.7 KiB

pcap-pf.c11-Jun-201817.1 KiB

pcap-rpcap.c11-Jun-201873.7 KiB

pcap-rpcap.h11-Jun-201821 KiB

pcap-savefile.manfile11-Jun-20185.1 KiB

pcap-savefile.manfile.in11-Jun-20185.1 KiB

pcap-septel.c11-Jun-20188 KiB

pcap-septel.h11-Jun-2018508

pcap-sita.c11-Jun-201835.7 KiB

pcap-sita.h11-Jun-2018224

pcap-sita.html11-Jun-201837.4 KiB

pcap-snf.c11-Jun-201811.6 KiB

pcap-snf.h11-Jun-2018106

pcap-snit.c11-Jun-201811.8 KiB

pcap-snoop.c11-Jun-201812.6 KiB

pcap-stdinc.h11-Jun-20184.6 KiB

pcap-tc.c11-Jun-201833.7 KiB

pcap-tc.h11-Jun-20181.9 KiB

pcap-tstamp.manmisc11-Jun-20187.9 KiB

pcap-tstamp.manmisc.in11-Jun-20188 KiB

pcap-usb-linux.c11-Jun-201825.3 KiB

pcap-usb-linux.h11-Jun-20181.8 KiB

pcap-win32.c11-Jun-201837.6 KiB

pcap.3pcap11-Jun-201828 KiB

pcap.3pcap.in11-Jun-201828 KiB

pcap.c11-Jun-201860.3 KiB

pcap.h11-Jun-20182.2 KiB

pcap_activate.3pcap11-Jun-20183.8 KiB

pcap_breakloop.3pcap11-Jun-20183.7 KiB

pcap_can_set_rfmon.3pcap11-Jun-20182.6 KiB

pcap_close.3pcap11-Jun-20181.5 KiB

pcap_compile.3pcap11-Jun-20182.6 KiB

pcap_compile.3pcap.in11-Jun-20182.6 KiB

pcap_create.3pcap11-Jun-20182.2 KiB

pcap_datalink.3pcap11-Jun-20182.4 KiB

pcap_datalink.3pcap.in11-Jun-20182.4 KiB

pcap_datalink_name_to_val.3pcap11-Jun-20181.8 KiB

pcap_datalink_val_to_name.3pcap11-Jun-20182 KiB

pcap_dump.3pcap11-Jun-20181.8 KiB

pcap_dump_close.3pcap11-Jun-20181.5 KiB

pcap_dump_file.3pcap11-Jun-20181.5 KiB

pcap_dump_flush.3pcap11-Jun-20181.7 KiB

pcap_dump_ftell.3pcap11-Jun-20181.7 KiB

pcap_dump_open.3pcap11-Jun-20183.2 KiB

pcap_dump_open.3pcap.in11-Jun-20183.2 KiB

pcap_file.3pcap11-Jun-20182.1 KiB

pcap_fileno.3pcap11-Jun-20182.1 KiB

pcap_findalldevs.3pcap11-Jun-20185.1 KiB

pcap_freecode.3pcap11-Jun-20181.7 KiB

pcap_get_selectable_fd.3pcap11-Jun-20184.1 KiB

pcap_get_tstamp_precision.3pcap11-Jun-20181.6 KiB

pcap_get_tstamp_precision.3pcap.in11-Jun-20181.6 KiB

pcap_geterr.3pcap11-Jun-20181.8 KiB

pcap_inject.3pcap11-Jun-20183.3 KiB

pcap_is_swapped.3pcap11-Jun-20181.9 KiB

pcap_lib_version.3pcap11-Jun-20181.6 KiB

pcap_list_datalinks.3pcap11-Jun-20182.5 KiB

pcap_list_datalinks.3pcap.in11-Jun-20182.5 KiB

pcap_list_tstamp_types.3pcap11-Jun-20182.5 KiB

pcap_list_tstamp_types.3pcap.in11-Jun-20182.5 KiB

pcap_lookupdev.3pcap11-Jun-20181.9 KiB

pcap_lookupnet.3pcap11-Jun-20181.9 KiB

pcap_loop.3pcap11-Jun-20186.5 KiB

pcap_major_version.3pcap11-Jun-20182 KiB

pcap_next_ex.3pcap11-Jun-20184.8 KiB

pcap_offline_filter.3pcap11-Jun-20182 KiB

pcap_open_dead.3pcap11-Jun-20182.7 KiB

pcap_open_dead.3pcap.in11-Jun-20182.7 KiB

pcap_open_live.3pcap11-Jun-20182.6 KiB

pcap_open_offline.3pcap11-Jun-20183.5 KiB

pcap_open_offline.3pcap.in11-Jun-20183.5 KiB

pcap_set_buffer_size.3pcap11-Jun-20181.8 KiB

pcap_set_datalink.3pcap11-Jun-20181.8 KiB

pcap_set_immediate_mode.3pcap11-Jun-20181.9 KiB

pcap_set_promisc.3pcap11-Jun-20181.8 KiB

pcap_set_rfmon.3pcap11-Jun-20181.8 KiB

pcap_set_snaplen.3pcap11-Jun-20181.7 KiB

pcap_set_timeout.3pcap11-Jun-20182 KiB

pcap_set_tstamp_precision.3pcap11-Jun-20182.2 KiB

pcap_set_tstamp_precision.3pcap.in11-Jun-20182.2 KiB

pcap_set_tstamp_type.3pcap11-Jun-20182.4 KiB

pcap_set_tstamp_type.3pcap.in11-Jun-20182.4 KiB

pcap_setdirection.3pcap11-Jun-20182.3 KiB

pcap_setfilter.3pcap11-Jun-20181.8 KiB

pcap_setnonblock.3pcap11-Jun-20182.8 KiB

pcap_snapshot.3pcap11-Jun-20181.9 KiB

pcap_stats.3pcap11-Jun-20183.3 KiB

pcap_statustostr.3pcap11-Jun-20181.6 KiB

pcap_strerror.3pcap11-Jun-20181.5 KiB

pcap_tstamp_type_name_to_val.3pcap11-Jun-20181.8 KiB

pcap_tstamp_type_val_to_name.3pcap11-Jun-20181.9 KiB

pcap_version.h11-Jun-2018759

pcap_version.h.in11-Jun-2018773

portability.h11-Jun-20186.1 KiB

ppp.h11-Jun-20182.6 KiB

README11-Jun-20183.9 KiB

README.aix11-Jun-20183.1 KiB

README.dag11-Jun-20185.1 KiB

README.hpux11-Jun-20188 KiB

README.linux11-Jun-20184.9 KiB

README.macosx11-Jun-20183.4 KiB

README.septel11-Jun-20182 KiB

README.sita11-Jun-20182.4 KiB

README.tru6411-Jun-20181.6 KiB

README.version11-Jun-201872

README.Win3211-Jun-20182.1 KiB

remote-ext.h11-Jun-201815.2 KiB

savefile.c11-Jun-201813.1 KiB

scanner.c11-Jun-2018196.7 KiB

scanner.h11-Jun-20188.7 KiB

scanner.l11-Jun-201812.2 KiB

sf-pcap-ng.c11-Jun-201835.7 KiB

sf-pcap-ng.h11-Jun-20181.4 KiB

sf-pcap.c11-Jun-201824.1 KiB

sf-pcap.h11-Jun-20181.7 KiB

sockutils.c11-Jun-201842 KiB

sockutils.h11-Jun-20187.8 KiB

sunatmpos.h11-Jun-20182.1 KiB

SUNOS4/11-Jun-20184 KiB

tests/11-Jun-20184 KiB

TODO11-Jun-20181.5 KiB

VERSION11-Jun-20186

version.c11-Jun-201874

Win32/11-Jun-20184 KiB

README

1LIBPCAP 1.x.y
2
3www.tcpdump.org
4
5Please send inquiries/comments/reports to:
6	tcpdump-workers@lists.tcpdump.org
7
8Anonymous Git is available via:
9	git clone git://bpf.tcpdump.org/libpcap
10
11Please submit patches by forking the branch on GitHub at
12
13	http://github.com/the-tcpdump-group/libpcap/tree/master
14
15and issuing a pull request.
16
17formerly from 	Lawrence Berkeley National Laboratory
18		Network Research Group <libpcap@ee.lbl.gov>
19		ftp://ftp.ee.lbl.gov/old/libpcap-0.4a7.tar.Z
20
21This directory contains source code for libpcap, a system-independent
22interface for user-level packet capture.  libpcap provides a portable
23framework for low-level network monitoring.  Applications include
24network statistics collection, security monitoring, network debugging,
25etc.  Since almost every system vendor provides a different interface
26for packet capture, and since we've developed several tools that
27require this functionality, we've created this system-independent API
28to ease in porting and to alleviate the need for several
29system-dependent packet capture modules in each application.
30
31For some platforms there are README.{system} files that discuss issues
32with the OS's interface for packet capture on those platforms, such as
33how to enable support for that interface in the OS, if it's not built in
34by default.
35
36The libpcap interface supports a filtering mechanism based on the
37architecture in the BSD packet filter.  BPF is described in the 1993
38Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
39User-level Packet Capture''.  A compressed PostScript version can be
40found at
41
42	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z
43
44or
45
46	http://www.tcpdump.org/papers/bpf-usenix93.ps.Z
47
48and a gzipped version can be found at
49
50	http://www.tcpdump.org/papers/bpf-usenix93.ps.gz
51
52A PDF version can be found at
53
54	http://www.tcpdump.org/papers/bpf-usenix93.pdf
55
56Although most packet capture interfaces support in-kernel filtering,
57libpcap utilizes in-kernel filtering only for the BPF interface.
58On systems that don't have BPF, all packets are read into user-space
59and the BPF filters are evaluated in the libpcap library, incurring
60added overhead (especially, for selective filters).  Ideally, libpcap
61would translate BPF filters into a filter program that is compatible
62with the underlying kernel subsystem, but this is not yet implemented.
63
64BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly
65BSD, and Mac OS X; an older, modified and undocumented version is
66standard in AIX.  {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the
67packetfilter interface but has been extended to accept BPF filters
68(which libpcap utilizes).  Also, you can add BPF filter support to
69Ultrix using the kernel source and/or object patches available in:
70
71	http://www.tcpdump.org/other/bpfext42.tar.Z
72
73Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
74mechanism that accepts BPF filters; see the README.linux file for
75information on configuring that option.
76
77Note to Linux distributions and *BSD systems that include libpcap:
78
79There's now a rule to make a shared library, which should work on Linux
80and *BSD, among other platforms.
81
82It sets the soname of the library to "libpcap.so.1"; this is what it
83should be, *NOT* libpcap.so.1.x or libpcap.so.1.x.y or something such as
84that.
85
86We've been maintaining binary compatibility between libpcap releases for
87quite a while; there's no reason to tie a binary linked with libpcap to
88a particular release of libpcap.
89
90Problems, bugs, questions, desirable enhancements, etc. should be sent
91to the address "tcpdump-workers@lists.tcpdump.org".  Bugs, support
92requests, and feature requests may also be submitted on the GitHub issue
93tracker for libpcap at
94
95	https://github.com/the-tcpdump-group/libpcap/issues
96
97Source code contributions, etc. should be sent to the email address
98above or submitted by forking the branch on GitHub at
99
100	http://github.com/the-tcpdump-group/libpcap/tree/master
101
102and issuing a pull request.
103
104Current versions can be found at www.tcpdump.org.
105
106 - The TCPdump team
107

README.aix

1Using BPF:
2
3(1) AIX 4.x's version of BPF is undocumented and somewhat unstandard; the
4    current BPF support code includes changes that should work around
5    that; it appears to compile and work on at least one AIX 4.3.3
6    machine.
7
8    Note that the BPF driver and the "/dev/bpf" devices might not exist
9    on your machine; AIX's tcpdump loads the driver and creates the
10    devices if they don't already exist.  Our libpcap should do the
11    same, and the configure script should detect that it's on an AIX
12    system and choose BPF even if the devices aren't there.
13
14    Also note that tcpdump _binary_ compiled on AIX 4 may have a problem
15    doing the initial loading of the BPF driver if copied to AIX 5 and
16    run there (GH #52). tcpdump binary natively compiled on AIX 5 should
17    not have this issue.
18
19(2) If libpcap doesn't compile on your machine when configured to use
20    BPF, or if the workarounds fail to make it work correctly, you
21    should send to tcpdump-workers@lists.tcpdump.org a detailed bug
22    report (if the compile fails, send us the compile error messages;
23    if it compiles but fails to work correctly, send us as detailed as
24    possible a description of the symptoms, including indications of the
25    network link-layer type being wrong or time stamps being wrong).
26
27    If you fix the problems yourself, please submit a patch by forking
28    the branch at
29
30	https://github.com/the-tcpdump-group/libpcap/issues
31
32    and issuing a pull request, so we can incorporate the fixes into the
33    next release.
34
35    If you don't fix the problems yourself, you can, as a workaround,
36    make libpcap use DLPI instead of BPF.
37
38    This can be done by specifying the flag:
39
40       --with-pcap=dlpi
41
42    to the "configure" script for libpcap.
43
44If you use DLPI:
45
46(1) It is a good idea to have the latest version of the DLPI driver on
47    your system, since certain versions may be buggy and cause your AIX
48    system to crash.  DLPI is included in the fileset bos.rte.tty.  I
49    found that the DLPI driver that came with AIX 4.3.2 was buggy, and
50    had to upgrade to bos.rte.tty 4.3.2.4:
51
52	    lslpp -l bos.rte.tty
53
54	    bos.rte.tty     4.3.2.4  COMMITTED  Base TTY Support and Commands
55
56    Updates for AIX filesets can be obtained from:
57    ftp://service.software.ibm.com/aix/fixes/
58
59    These updates can be installed with the smit program.
60
61(2) After compiling libpcap, you need to make sure that the DLPI driver
62    is loaded.  Type:
63
64	    strload -q -d dlpi
65
66    If the result is:
67
68	    dlpi: yes
69
70    then the DLPI driver is loaded correctly.
71
72    If it is:
73
74	    dlpi: no
75
76    Then you need to type:
77
78	    strload -f /etc/dlpi.conf
79
80    Check again with strload -q -d dlpi that the dlpi driver is loaded.
81
82    Alternatively, you can uncomment the lines for DLPI in
83    /etc/pse.conf and reboot the machine; this way DLPI will always
84    be loaded when you boot your system.
85
86(3) There appears to be a problem in the DLPI code in some versions of
87    AIX, causing a warning about DL_PROMISC_MULTI failing; this might
88    be responsible for DLPI not being able to capture outgoing packets.
89

README.dag

1
2The following instructions apply if you have a Linux or FreeBSD platform and
3want libpcap to support the DAG range of passive network monitoring cards from
4Endace (http://www.endace.com, see below for further contact details).
5
61) Install and build the DAG software distribution by following the
7instructions supplied with that package. Current Endace customers can download
8the DAG software distibution from https://www.endace.com
9
102) Configure libcap. To allow the 'configure' script to locate the DAG
11software distribution use the '--with-dag' option:
12
13        ./configure --with-dag=DIR
14
15Where DIR is the root of the DAG software distribution, for example
16/var/src/dag. If the DAG software is correctly detected 'configure' will
17report:
18
19        checking whether we have DAG API... yes
20
21If 'configure' reports that there is no DAG API, the directory may have been
22incorrectly specified or the DAG software was not built before configuring
23libpcap.
24
25See also the libpcap INSTALL.txt file for further libpcap configuration
26options.
27
28Building libpcap at this stage will include support for both the native packet
29capture stream (linux or bpf) and for capturing from DAG cards. To build
30libpcap with only DAG support specify the capture type as 'dag' when
31configuring libpcap:
32
33        ./configure --with-dag=DIR --with-pcap=dag
34
35Applications built with libpcap configured in this way will only detect DAG
36cards and will not capture from the native OS packet stream.
37
38----------------------------------------------------------------------
39
40Libpcap when built for DAG cards against dag-2.5.1 or later releases:
41
42Timeouts are supported. pcap_dispatch() will return after to_ms milliseconds
43regardless of how many packets are received. If to_ms is zero pcap_dispatch()
44will block waiting for data indefinitely.
45
46pcap_dispatch() will block on and process a minimum of 64kB of data (before
47filtering) for efficiency. This can introduce high latencies on quiet
48interfaces unless a timeout value is set. The timeout expiring will override
49the 64kB minimum causing pcap_dispatch() to process any available data and
50return.
51
52pcap_setnonblock is supported. When nonblock is set, pcap_dispatch() will
53check once for available data, process any data available up to count, then
54return immediately.
55
56pcap_findalldevs() is supported, e.g. dag0, dag1...
57
58Some DAG cards can provide more than one 'stream' of received data.
59This can be data from different physical ports, or separated by filtering
60or load balancing mechanisms. Receive streams have even numbers, e.g.
61dag0:0, dag0:2 etc. Specifying transmit streams for capture is not supported.
62
63pcap_setfilter() is supported, BPF programs run in userspace.
64
65pcap_setdirection() is not supported. Only received traffic is captured.
66DAG cards normally do not have IP or link layer addresses assigned as
67they are used to passively monitor links.
68
69pcap_breakloop() is supported.
70
71pcap_datalink() and pcap_list_datalinks() are supported. The DAG card does
72not attempt to set the correct datalink type automatically where more than
73one type is possible.
74
75pcap_stats() is supported. ps_drop is the number of packets dropped due to
76RX stream buffer overflow, this count is before filters are applied (it will
77include packets that would have been dropped by the filter). The RX stream
78buffer size is user configurable outside libpcap, typically 16-512MB.
79
80pcap_get_selectable_fd() is not supported, as DAG cards do not support
81poll/select methods.
82
83pcap_inject() and pcap_sendpacket() are not supported.
84
85Some DAG cards now support capturing to multiple virtual interfaces, called
86streams. Capture streams have even numbers. These are available via libpcap
87as separate interfaces, e.g. dag0:0, dag0:2, dag0:4 etc. dag0:0 is the same
88as dag0. These are visible via pcap_findalldevs().
89
90libpcap now does NOT set the card's hardware snaplen (slen). This must now be
91set using the appropriate DAG coniguration program, e.g. dagthree, dagfour,
92dagsix, dagconfig. This is because the snaplen is currently shared between
93all of the streams. In future this may change if per-stream slen is
94implemented.
95
96DAG cards by default capture entire packets including the L2
97CRC/FCS. If the card is not configured to discard the CRC/FCS, this
98can confuse applications that use libpcap if they're not prepared for
99packets to have an FCS.
100
101Libpcap now reads the environment variable ERF_FCS_BITS to determine
102how many bits of CRC/FCS to strip from the end of the captured
103frame. This defaults to 32 for use with Ethernet. If the card is
104configured to strip the CRC/FCS, then set ERF_FCS_BITS=0. If used with
105a HDLC/PoS/PPP/Frame Relay link with 16 bit CRC/FCS, then set
106ERF_FCS_BITS=16.
107
108If you wish to create a pcap file that DOES contain the Ethernet FCS,
109specify the environment variable ERF_DONT_STRIP_FCS. This will cause
110the existing FCS to be captured into the pcap file. Note some
111applications may incorrectly report capture errors or oversize packets
112when reading these files.
113
114----------------------------------------------------------------------
115
116Please submit bug reports via <support@endace.com>.
117
118Please also visit our Web site at:
119
120        http://www.endace.com/
121
122For more information about Endace DAG cards contact <sales@endace.com>.
123

README.hpux

1For HP-UX 11i (11.11) and later, there are no known issues with
2promiscuous mode under HP-UX.  If you are using a earlier version of
3HP-UX and cannot upgrade, please continue reading.
4
5HP-UX patches to fix packet capture problems
6
7Note that packet-capture programs such as tcpdump may, on HP-UX, not be
8able to see packets sent from the machine on which they're running.
9Some articles on groups.google.com discussing this are:
10
11	http://groups.google.com/groups?selm=82ld3v%2480i%241%40mamenchi.zrz.TU-Berlin.DE
12
13which says:
14
15  Newsgroups: comp.sys.hp.hpux
16  Subject:  Re: Did someone made tcpdump working on 10.20 ?
17  Date: 12/08/1999
18  From: Lutz Jaenicke <jaenicke@emserv1.ee.TU-Berlin.DE>
19
20  In article <82ks5i$5vc$1@news1.dti.ne.jp>, mtsat <mtsat@iris.dti.ne.jp>
21  wrote:
22   >Hello,
23   >
24   >I downloaded and compiled tcpdump3.4 a couple of week ago. I tried to use
25   >it, but I can only see incoming data, never outgoing.
26   >Someone (raj) explained me that a patch was missing, and that this patch
27   >must me "patched" (poked) in order to see outbound data in promiscuous mode.
28   >Many things to do .... So the question is : did someone has already this
29   >"ready to use" PHNE_**** patch ?
30
31   Two things:
32   1. You do need a late "LAN products cumulative patch" (e.g.  PHNE_18173
33  for   s700/10.20).
34   2. You must use
35echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
36     You can insert this e.g. into /sbin/init.d/lan
37
38   Best regards,
39   Lutz
40
41and
42
43	http://groups.google.com/groups?selm=88cf4t%24p03%241%40web1.cup.hp.com
44
45which says:
46
47  Newsgroups: comp.sys.hp.hpux
48  Subject: Re: tcpdump only shows incoming packets
49  Date: 02/15/2000
50  From: Rick Jones <foo@bar.baz.invalid>
51
52  Harald Skotnes <harald@cc.uit.no> wrote:
53  > I am running HPUX 11.0 on a C200 hanging on a 100Mb switch. I have
54  > compiled libpcap-0.4 an tcpdump-3.4 and it seems to work. But at a
55  > closer look I only get to see the incoming packets not the
56  > outgoing. I have tried tcpflow-0.12 which also uses libpcap and the
57  > same thing happens.  Could someone please give me a hint on how to
58  > get this right?
59
60  Search/Read the archives ?-)
61
62  What you are seeing is expected, un-patched, behaviour for an HP-UX
63  system.  On 11.00, you need to install the latest lancommon/DLPI
64  patches, and then the latest driver patch for the interface(s) in use.
65  At that point, a miracle happens and you should start seeing outbound
66  traffic.
67
68[That article also mentions the patch that appears below.]
69
70and
71
72	http://groups.google.com/groups?selm=38AA973E.96BE7DF7%40cc.uit.no
73
74which says:
75
76  Newsgroups: comp.sys.hp.hpux
77  Subject: Re: tcpdump only shows incoming packets
78  Date: 02/16/2000
79  From: Harald Skotnes <harald@cc.uit.no>
80
81  Rick Jones wrote:
82
83	...
84
85  > What you are seeing is expected, un-patched, behaviour for an HP-UX
86  > system. On 11.00, you need to install the latest lancommon/DLPI
87  > patches, and then the latest driver patch for the interface(s) in
88  > use. At that point, a miracle happens and you should start seeing
89  > outbound traffic.
90
91  Thanks a lot.  I have this problem on several machines running HPUX
92  10.20 and 11.00.  The machines where patched up before y2k so did not
93  know what to think.  Anyway I have now installed PHNE_19766,
94  PHNE_19826, PHNE_20008, PHNE_20735 on the C200 and now I can see the
95  outbound traffic too.  Thanks again.
96
97(although those patches may not be the ones to install - there may be
98later patches).
99
100And another message to tcpdump-workers@tcpdump.org, from Rick Jones:
101
102  Date: Mon, 29 Apr 2002 15:59:55 -0700
103  From: Rick Jones
104  To: tcpdump-workers@tcpdump.org
105  Subject: Re: [tcpdump-workers] I Can't Capture the Outbound Traffic
106
107	...
108
109  http://itrc.hp.com/ would be one place to start in a search for the most
110  up-to-date patches for DLPI and the lan driver(s) used on your system (I
111  cannot guess because 9000/800 is too generic - one hs to use the "model"
112  command these days and/or an ioscan command (see manpage) to guess what
113  the drivers (btlan[3456], gelan, etc) might be involved in addition to
114  DLPI.
115
116  Another option is to upgrade to 11i as outbound promiscuous mode support
117  is there in the base OS, no patches required.
118
119Another posting:
120
121	http://groups.google.com/groups?selm=7d6gvn%24b3%241%40ocean.cup.hp.com
122
123indicates that you need to install the optional STREAMS product to do
124captures on HP-UX 9.x:
125
126  Newsgroups: comp.sys.hp.hpux
127  Subject:  Re: tcpdump HP/UX 9.x
128  Date: 03/22/1999
129  From: Rick Jones <foo@bar.baz>
130
131  Dave Barr (barr@cis.ohio-state.edu) wrote:
132  : Has anyone ported tcpdump (or something similar) to HP/UX 9.x?
133
134  I'm reasonably confident that any port of tcpdump to 9.X would require
135  the (then optional) STREAMS product.  This would bring DLPI, which is
136  what one uses to access interfaces in promiscuous mode.
137
138  I'm not sure that HP even sells the 9.X STREAMS product any longer,
139  since HP-UX 9.X is off the pricelist (well, maybe 9.10 for the old 68K
140  devices).
141
142  Your best bet is to be up on 10.20 or better if that is at all
143  possible.  If your hardware is supported by it, I'd go with HP-UX 11.
144  If you want to see the system's own outbound traffic, you'll never get
145  that functionality on 9.X, but it might happen at some point for 10.20
146  and 11.X.
147
148  rick jones
149
150(as per other messages cited here, the ability to see the system's own
151outbound traffic did happen).
152
153Rick Jones reports that HP-UX 11i needs no patches for outbound
154promiscuous mode support.
155
156An additional note, from Jost Martin, for HP-UX 10.20:
157
158	Q: How do I get ethereral on HPUX to capture the _outgoing_ packets
159	   of an interface
160	A: You need to get PHNE_20892,PHNE_20725 and PHCO_10947 (or
161	   newer, this is as of 4.4.00) and its dependencies.  Then you can
162	   enable the feature as descibed below:
163
164	Patch Name: PHNE_20892
165	Patch Description: s700 10.20 PCI 100Base-T cumulative patch
166		To trace the outbound packets, please do the following
167		to turn on a global promiscuous switch before running
168		the promiscuous applications like snoop or tcpdump:
169
170		adb -w /stand/vmunix /dev/mem
171		lanc_outbound_promisc_flag/W 1
172		(adb will echo the result showing that the flag has
173		been changed)
174		$quit
175	(Thanks for this part to HP-support, Ratingen)
176
177		The attached hack does this and some security-related stuff
178	(thanks to hildeb@www.stahl.bau.tu-bs.de (Ralf Hildebrandt) who
179	posted the security-part some time ago)
180
181		 <<hack_ip_stack>>
182
183		(Don't switch IP-forwarding off, if you need it !)
184		Install the hack as /sbin/init.d/hacl_ip_stack (adjust
185	permissions !) and make a sequencing-symlink
186	/sbin/rc2.d/S350hack_ip_stack pointing to this script.
187		Now all this is done on every reboot.
188
189According to Rick Jones, the global promiscuous switch also has to be
190turned on for HP-UX 11.00, but not for 11i - and, in fact, the switch
191doesn't even exist on 11i.
192
193Here's the "hack_ip_stack" script:
194
195-----------------------------------Cut Here-------------------------------------
196#!/sbin/sh
197#
198# nettune:  hack kernel parms for safety
199
200OKAY=0
201ERROR=-1
202
203# /usr/contrib/bin fuer nettune auf Pfad
204PATH=/sbin:/usr/sbin:/usr/bin:/usr/contrib/bin
205export PATH
206
207
208##########
209#  main  #
210##########
211
212case $1 in
213   start_msg)
214      print "Tune IP-Stack for security"
215      exit $OKAY
216      ;;
217
218   stop_msg)
219      print "This action is not applicable"
220      exit $OKAY
221      ;;
222
223   stop)
224      exit $OKAY
225      ;;
226
227   start)
228      ;;  # fall through
229
230   *)
231      print "USAGE: $0 {start_msg | stop_msg | start | stop}" >&2
232      exit $ERROR
233      ;;
234   esac
235
236###########
237#  start  #
238###########
239
240#
241# tcp-Sequence-Numbers nicht mehr inkrementieren sondern random
242# Syn-Flood-Protection an
243# ip_forwarding aus
244# Source-Routing aus
245# Ausgehende Packets an ethereal/tcpdump etc.
246
247/usr/contrib/bin/nettune -s tcp_random_seq 2 || exit $ERROR
248/usr/contrib/bin/nettune -s hp_syn_protect 1 || exit $ERROR
249/usr/contrib/bin/nettune -s ip_forwarding 0 || exit $ERROR
250echo 'ip_block_source_routed/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem || exit $ERROR
251echo 'lanc_outbound_promisc_flag/W 1' | adb -w /stand/vmunix /dev/mem  || exit $ERROR
252
253exit $OKAY
254-----------------------------------Cut Here-------------------------------------
255

README.linux

1In order for libpcap to be able to capture packets on a Linux system,
2the "packet" protocol must be supported by your kernel.  If it is not,
3you may get error messages such as
4
5	modprobe: can't locate module net-pf-17
6
7in "/var/adm/messages", or may get messages such as
8
9	socket: Address family not supported by protocol
10
11from applications using libpcap.
12
13You must configure the kernel with the CONFIG_PACKET option for this
14protocol; the following note is from the Linux "Configure.help" file for
15the 2.0[.x] kernel:
16
17	Packet socket
18	CONFIG_PACKET
19	  The Packet protocol is used by applications which communicate
20	  directly with network devices without an intermediate network
21	  protocol implemented in the kernel, e.g. tcpdump. If you want them
22	  to work, choose Y.
23
24	  This driver is also available as a module called af_packet.o ( =
25	  code which can be inserted in and removed from the running kernel
26	  whenever you want). If you want to compile it as a module, say M
27	  here and read Documentation/modules.txt; if you use modprobe or
28	  kmod, you may also want to add "alias net-pf-17 af_packet" to
29	  /etc/modules.conf.
30
31and the note for the 2.2[.x] kernel says:
32
33	Packet socket
34	CONFIG_PACKET
35	  The Packet protocol is used by applications which communicate
36	  directly with network devices without an intermediate network
37	  protocol implemented in the kernel, e.g. tcpdump. If you want them
38	  to work, choose Y. This driver is also available as a module called
39	  af_packet.o ( = code which can be inserted in and removed from the
40	  running kernel whenever you want). If you want to compile it as a
41	  module, say M here and read Documentation/modules.txt.  You will
42	  need to add 'alias net-pf-17 af_packet' to your /etc/conf.modules
43	  file for the module version to function automatically.  If unsure,
44	  say Y.
45
46In addition, there is an option that, in 2.2 and later kernels, will
47allow packet capture filters specified to programs such as tcpdump to be
48executed in the kernel, so that packets that don't pass the filter won't
49be copied from the kernel to the program, rather than having all packets
50copied to the program and libpcap doing the filtering in user mode.
51
52Copying packets from the kernel to the program consumes a significant
53amount of CPU, so filtering in the kernel can reduce the overhead of
54capturing packets if a filter has been specified that discards a
55significant number of packets.  (If no filter is specified, it makes no
56difference whether the filtering isn't performed in the kernel or isn't
57performed in user mode. :-))
58
59The option for this is the CONFIG_FILTER option; the "Configure.help"
60file says:
61
62	Socket filtering
63	CONFIG_FILTER
64	  The Linux Socket Filter is derived from the Berkeley Packet Filter.
65	  If you say Y here, user-space programs can attach a filter to any
66	  socket and thereby tell the kernel that it should allow or disallow
67	  certain types of data to get through the socket. Linux Socket
68	  Filtering works on all socket types except TCP for now. See the text
69	  file linux/Documentation/networking/filter.txt for more information.
70	  If unsure, say N.
71
72Note that, by default, libpcap will, if libnl is present, build with it;
73it uses libnl to support monitor mode on mac80211 devices.  There is a
74configuration option to disable building with libnl, but, if that option
75is chosen, the monitor-mode APIs (as used by tcpdump's "-I" flag, and as
76will probably be used by other applications in the future) won't work
77properly on mac80211 devices.
78
79Linux's run-time linker allows shared libraries to be linked with other
80shared libraries, which means that if an older version of a shared
81library doesn't require routines from some other shared library, and a
82later version of the shared library does require those routines, the
83later version of the shared library can be linked with that other shared
84library and, if it's otherwise binary-compatible with the older version,
85can replace that older version without breaking applications built with
86the older version, and without breaking configure scripts or the build
87procedure for applications whose configure script doesn't use the
88pcap-config script if they build with the shared library.  (The build
89procedure for applications whose configure scripts use the pcap-config
90script if present will not break even if they build with the static
91library.)
92
93Statistics:
94Statistics reported by pcap are platform specific.  The statistics
95reported by pcap_stats on Linux are as follows:
96
972.2.x
98=====
99ps_recv   Number of packets that were accepted by the pcap filter
100ps_drop   Always 0, this statistic is not gatherd on this platform
101
1022.4.x
103=====
104ps_recv   Number of packets that were accepted by the pcap filter
105ps_drop   Number of packets that had passed filtering but were not
106          passed on to pcap due to things like buffer shortage, etc.
107          This is useful because these are packets you are interested in
108          but won't be reported by, for example, tcpdump output.
109

README.macosx

1As with other systems using BPF, Mac OS X allows users with read access
2to the BPF devices to capture packets with libpcap and allows users with
3write access to the BPF devices to send packets with libpcap.
4
5On some systems that use BPF, the BPF devices live on the root file
6system, and the permissions and/or ownership on those devices can be
7changed to give users other than root permission to read or write those
8devices.
9
10On newer versions of FreeBSD, the BPF devices live on devfs, and devfs
11can be configured to set the permissions and/or ownership of those
12devices to give users other than root permission to read or write those
13devices.
14
15On Mac OS X, the BPF devices live on devfs, but the OS X version of
16devfs is based on an older (non-default) FreeBSD devfs, and that version
17of devfs cannot be configured to set the permissions and/or ownership of
18those devices.
19
20Therefore, we supply:
21
22	a "startup item" for older versions of Mac OS X;
23
24	a launchd daemon for Tiger and later versions of Mac OS X;
25
26Both of them will change the ownership of the BPF devices so that the
27"admin" group owns them, and will change the permission of the BPF
28devices to rw-rw----, so that all users in the "admin" group - i.e., all
29users with "Allow user to administer this computer" turned on - have
30both read and write access to them.
31
32The startup item is in the ChmodBPF directory in the source tree.  A
33/Library/StartupItems directory should be created if it doesn't already
34exist, and the ChmodBPF directory should be copied to the
35/Library/StartupItems directory (copy the entire directory, so that
36there's a /Library/StartupItems/ChmodBPF directory, containing all the
37files in the source tree's ChmodBPF directory; don't copy the individual
38items in that directory to /Library/StartupItems).  The ChmodBPF
39directory, and all files under it, must be owned by root.  Installing
40the files won't immediately cause the startup item to be executed; it
41will be executed on the next reboot.  To change the permissions before
42the reboot, run
43
44	sudo SystemStarter start ChmodBPF
45
46The launchd daemon is the chmod_bpf script, plus the
47org.tcpdump.chmod_bpf.plist launchd plist file.  chmod_bpf should be
48installed in /usr/local/bin/chmod_bpf, and org.tcpdump.chmod_bpf.plist
49should be installed in /Library/LaunchDaemons.  chmod_bpf, and
50org.tcpdump.chmod_bpf.plist, must be owned by root.  Installing the
51script and plist file won't immediately cause the script to be executed;
52it will be executed on the next reboot.  To change the permissions
53before the reboot, run
54
55	sudo /usr/local/bin/chmod_bpf
56
57or
58
59	sudo launchctl load /Library/LaunchDaemons/org.tcpdump.chmod_bpf.plist
60
61If you want to give a particular user permission to access the BPF
62devices, rather than giving all administrative users permission to
63access them, you can have the ChmodBPF/ChmodBPF script change the
64ownership of /dev/bpf* without changing the permissions.  If you want to
65give a particular user permission to read and write the BPF devices and
66give the administrative users permission to read but not write the BPF
67devices, you can have the script change the owner to that user, the
68group to "admin", and the permissions to rw-r-----.  Other possibilities
69are left as an exercise for the reader.
70
71(NOTE: due to a bug in Snow Leopard, if you change the permissions not
72to grant write permission to everybody who should be allowed to capture
73traffic, non-root users who cannot open the BPF devices for writing will
74not be able to capture outgoing packets.)
75

README.septel

1The following instructions apply if you have a Linux platform and want
2libpcap to support the Septel range of passive network monitoring cards
3from Intel (http://www.intel.com)
4
51) Install and build the Septel software distribution by following the
6instructions supplied with that package.
7
82) Configure libcap. To allow the 'configure' script to locate the Septel
9software distribution use the '--with-septel' option:
10
11        ./configure --with-septel=DIR
12
13where DIR is the root of the Septel software distribution, for example
14/var/src/septel.
15
16By default (if you write only ./configure --with-septel) it takes
17./../septel as argument for DIR.
18
19If the Septel software is correctly detected 'configure' will
20report:
21
22        checking whether we have Septel API... yes
23
24If 'configure' reports that there is no Septel API, the directory may have been
25incorrectly specified or the Septel software was not built before configuring
26libpcap.
27
28See also the libpcap INSTALL.txt file for further libpcap configuration
29options.
30
31Building libpcap at this stage will include support for both the native
32packet capture stream and for capturing from Septel cards.  To build
33libpcap with only Septel support specify the capture type as 'septel'
34when configuring libpcap:
35
36        ./configure --with-septel=DIR --with-pcap=septel
37
38Applications built with libpcap configured in this way will only detect Septel
39cards and will not capture from the native OS packet stream.
40
41Note: As mentioned in pcap-septel.c we should first edit the system.txt
42file to change the user part example (UPE) module id to 0xdd instead of
430x2d for technical reason.  So this change in system.txt is crutial and
44things will go wrong if it's not done.  System.txt along with config.txt
45are configuration files that are edited by the user before running the
46gctload program that uses these files for initialising modules and
47configuring parameters.
48
49----------------------------------------------------------------------
50for more information please contact me : gil_hoyek@hotmail.com
51

README.sita

1The following instructions apply if you have a Linux platform and want
2libpcap to support the 'ACN' WAN/LAN router product from from SITA
3(http://www.sita.aero)
4
5This might also work on non-Linux Unix-compatible platforms, but that
6has not been tested.
7
8See also the libpcap INSTALL.txt file for further libpcap configuration
9options.
10
11These additions/extensions have been made to PCAP to allow it to
12capture packets from a SITA ACN device (and potentially others).
13
14To enable its support you need to ensure that the distribution has
15a correct configure.ac file; that can be created if neccessay by
16using the normal autoconf procedure of:
17
18aclocal
19autoconf
20autoheader
21automake
22
23Then run configure with the 'sita' option:
24
25./configure --with-sita
26
27Applications built with libpcap configured in this way will only detect SITA
28ACN interfaces and will not capture from the native OS packet stream.
29
30The SITA extension provides a remote datascope operation for capturing
31both WAN and LAN protocols.  It effectively splits the operation of
32PCAP into two halves.  The top layer performs the majority of the
33work, but interfaces via a TCP session to remote agents that
34provide the lower layer functionality of actual sniffing and
35filtering. More detailed information regarding the functions and
36inter-device protocol and naming conventions are described in detail
37in 'pcap-sita.html'.
38
39pcap_findalldevs() reads the local system's /etc/hosts file looking
40for host names that match the format of IOP type devices.  ie.  aaa_I_x_y
41and then queries each associated IP address for a list of its WAN and
42LAN devices.  The local system the aggregates the lists obtained from
43each IOP, sorts it, and provides it (to Wireshark et.al) as the
44list of monitorable interfaces.
45
46Once a valid interface has been selected, pcap_open() is called
47which opens a TCP session (to a well known port) on the target IOP
48and tells it to start monitoring.
49
50All captured packets are then forwarded across that TCP session
51back to the local 'top layer' for forwarding to the actual
52sniffing program (wireshark...)
53
54Note that the DLT_SITA link-layer type includes a proprietary header
55that is documented as part of the SITA dissector of Wireshark and is
56also described in 'pcap-sita.html' for posterity sake.
57
58That header provides:
59- Packet direction (in/out) (1 octet)
60- Link layer hardware signal status (1 octet)
61- Transmit/Receive error status (2 octets)
62- Encapsulated WAN protocol ID (1 octet)
63
64
65

README.tru64

1The following instructions are applicable to Tru64 UNIX
2(formerly Digital UNIX (formerly DEC OSF/1)) version 4.0, and
3probably to later versions as well; at least some options apply to
4Digital UNIX 3.2 - perhaps all do.
5
6In order to use kernel packet filtering on this system, you have
7to configure it in such a way:
8
9Kernel configuration
10--------------------
11
12The packet filtering kernel option must be enabled at kernel
13installation.  If it was not the case, you can rebuild the kernel with
14"doconfig -c" after adding the following line in the kernel
15configuration file (/sys/conf/<HOSTNAME>):
16
17	option PACKETFILTER
18
19or use "doconfig" without any arguments to add the packet filter driver
20option via the kernel option menu (see the system administration
21documentation for information on how to do this).
22
23Device configuration
24--------------------
25
26Devices used for packet filtering must be created thanks to
27the following command (executed in the /dev directory):
28
29	./MAKEDEV pfilt
30
31Interface configuration
32-----------------------
33
34In order to capture all packets on a network, you may want to allow
35applications to put the interface on that network into "local copy"
36mode, so that tcpdump can see packets sent by the host on which it's
37running as well as packets received by that host, and to put the
38interface into "promiscuous" mode, so that tcpdump can see packets on
39the network segment not sent to the host on which it's running, by using
40the pfconfig(1) command:
41
42	pfconfig +c +p <network_device>
43
44or allow application to put any interface into "local copy" or
45"promiscuous" mode by using the command:
46
47	pfconfig +c +p -a
48
49Note: all instructions given require root privileges.
50

README.version

README.Win32

1Under Win32, libpcap is integrated in the WinPcap packet capture system.
2WinPcap provides a framework that allows libpcap to capture the packets
3under Windows 95, Windows 98, Windows ME, Windows NT 4, Windows 2000
4and Windows XP.
5WinPcap binaries and source code can be found at http://winpcap.polito.it:
6they include also a developer's pack with all the necessary to compile
7libpcap-based applications under Windows.
8
9How to compile libpcap with Visual Studio
10-----------------------------------------
11
12In order to compile libpcap you will need:
13
14- version 6 (or higher) of Microsoft Visual Studio
15- The November 2001 (or later) edition of Microsoft Platform
16Software Development Kit (SDK), that contains some necessary includes
17for IPv6 support. You can download it from http://www.microsoft.com/sdk
18- the latest WinPcap sources from http://winpcap.polito.it/install
19
20The WinPcap source code already contains a recent (usually the latest
21stable) version of libpcap. If you need to compile a different one,
22simply download it from www.tcpdump.org and copy the sources in the
23winpcap\wpcap\libpcap folder of the WinPcap distribution. If you want to
24compile a libpcap source retrieved from the tcpdump.org Git, you will
25have to create the scanner and the grammar by hand (with lex and yacc)
26or with the cygnus makefile, since The Visual Studio project is not able
27to build them.
28
29Open the project file winpcap\wpcap\prj\wpcap.dsw with Visual Studio and
30build wpcap.dll. wpcap.lib, the library file to link with the applications,
31will be generated in winpcap\wpcap\lib\. wpcap.dll will be generated in
32winpcap\wpcap\prj\release or winpcap\wpcap\prj\debug depending on the type
33of binary that is being created.
34
35How to compile libpcap with Cygnus
36----------------------------------
37
38To build wpcap.dll, cd to the directory WPCAP/PRJ of the WinPcap source code
39distribution and type "make". libwpcap.a, the library file to link with the
40applications, will be generated in winpcap\wpcap\lib\. wpcap.dll will be
41generated in winpcap\wpcap\prj.
42
43Remember, you CANNOT use the MSVC-generated .lib files with gcc, use
44libwpcap.a instead.
45
46"make install" installs wpcap.dll in the Windows system folder.
47