README.md revision 1.1.1.1.2.2
1 1.1.1.1.2.2 pgoyette To report a security issue please send an e-mail to security (a] tcpdump.org. 2 1.1.1.1.2.2 pgoyette 3 1.1.1.1.2.2 pgoyette To report bugs and other problems, contribute patches, request a 4 1.1.1.1.2.2 pgoyette feature, provide generic feedback etc please see the file 5 1.1.1.1.2.2 pgoyette [CONTRIBUTING](CONTRIBUTING.md) in the libpcap source tree root. 6 1.1.1.1.2.2 pgoyette 7 1.1.1.1.2.2 pgoyette The directory doc/ has README files about specific operating systems and 8 1.1.1.1.2.2 pgoyette options. 9 1.1.1.1.2.2 pgoyette 10 1.1.1.1.2.2 pgoyette LIBPCAP 1.x.y 11 1.1.1.1.2.2 pgoyette Now maintained by "The Tcpdump Group" 12 1.1.1.1.2.2 pgoyette https://www.tcpdump.org 13 1.1.1.1.2.2 pgoyette 14 1.1.1.1.2.2 pgoyette Anonymous Git is available via: 15 1.1.1.1.2.2 pgoyette https://github.com/the-tcpdump-group/libpcap.git 16 1.1.1.1.2.2 pgoyette 17 1.1.1.1.2.2 pgoyette formerly from Lawrence Berkeley National Laboratory 18 1.1.1.1.2.2 pgoyette Network Research Group <libpcap (a] ee.lbl.gov> 19 1.1.1.1.2.2 pgoyette ftp://ftp.ee.lbl.gov/old/libpcap-0.4a7.tar.Z 20 1.1.1.1.2.2 pgoyette 21 1.1.1.1.2.2 pgoyette This directory contains source code for libpcap, a system-independent 22 1.1.1.1.2.2 pgoyette interface for user-level packet capture. libpcap provides a portable 23 1.1.1.1.2.2 pgoyette framework for low-level network monitoring. Applications include 24 1.1.1.1.2.2 pgoyette network statistics collection, security monitoring, network debugging, 25 1.1.1.1.2.2 pgoyette etc. Since almost every system vendor provides a different interface 26 1.1.1.1.2.2 pgoyette for packet capture, and since we've developed several tools that 27 1.1.1.1.2.2 pgoyette require this functionality, we've created this system-independent API 28 1.1.1.1.2.2 pgoyette to ease in porting and to alleviate the need for several 29 1.1.1.1.2.2 pgoyette system-dependent packet capture modules in each application. 30 1.1.1.1.2.2 pgoyette 31 1.1.1.1.2.2 pgoyette For some platforms there are README.{system} files that discuss issues 32 1.1.1.1.2.2 pgoyette with the OS's interface for packet capture on those platforms, such as 33 1.1.1.1.2.2 pgoyette how to enable support for that interface in the OS, if it's not built in 34 1.1.1.1.2.2 pgoyette by default. 35 1.1.1.1.2.2 pgoyette 36 1.1.1.1.2.2 pgoyette The libpcap interface supports a filtering mechanism based on the 37 1.1.1.1.2.2 pgoyette architecture in the BSD packet filter. BPF is described in the 1993 38 1.1.1.1.2.2 pgoyette Winter Usenix paper ``The BSD Packet Filter: A New Architecture for 39 1.1.1.1.2.2 pgoyette User-level Packet Capture''. A compressed PostScript version can be 40 1.1.1.1.2.2 pgoyette found at 41 1.1.1.1.2.2 pgoyette 42 1.1.1.1.2.2 pgoyette ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z 43 1.1.1.1.2.2 pgoyette 44 1.1.1.1.2.2 pgoyette or 45 1.1.1.1.2.2 pgoyette 46 1.1.1.1.2.2 pgoyette https://www.tcpdump.org/papers/bpf-usenix93.ps.Z 47 1.1.1.1.2.2 pgoyette 48 1.1.1.1.2.2 pgoyette and a gzipped version can be found at 49 1.1.1.1.2.2 pgoyette 50 1.1.1.1.2.2 pgoyette https://www.tcpdump.org/papers/bpf-usenix93.ps.gz 51 1.1.1.1.2.2 pgoyette 52 1.1.1.1.2.2 pgoyette A PDF version can be found at 53 1.1.1.1.2.2 pgoyette 54 1.1.1.1.2.2 pgoyette https://www.tcpdump.org/papers/bpf-usenix93.pdf 55 1.1.1.1.2.2 pgoyette 56 1.1.1.1.2.2 pgoyette Although most packet capture interfaces support in-kernel filtering, 57 1.1.1.1.2.2 pgoyette libpcap utilizes in-kernel filtering only for the BPF interface. 58 1.1.1.1.2.2 pgoyette On systems that don't have BPF, all packets are read into user-space 59 1.1.1.1.2.2 pgoyette and the BPF filters are evaluated in the libpcap library, incurring 60 1.1.1.1.2.2 pgoyette added overhead (especially, for selective filters). Ideally, libpcap 61 1.1.1.1.2.2 pgoyette would translate BPF filters into a filter program that is compatible 62 1.1.1.1.2.2 pgoyette with the underlying kernel subsystem, but this is not yet implemented. 63 1.1.1.1.2.2 pgoyette 64 1.1.1.1.2.2 pgoyette BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly 65 1.1.1.1.2.2 pgoyette BSD, and macOS; an older, modified and undocumented version is standard 66 1.1.1.1.2.2 pgoyette in AIX. {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the packetfilter 67 1.1.1.1.2.2 pgoyette interface but has been extended to accept BPF filters (which libpcap 68 1.1.1.1.2.2 pgoyette utilizes). Also, you can add BPF filter support to Ultrix using the 69 1.1.1.1.2.2 pgoyette kernel source and/or object patches available in: 70 1.1.1.1.2.2 pgoyette 71 1.1.1.1.2.2 pgoyette https://www.tcpdump.org/other/bpfext42.tar.Z 72 1.1.1.1.2.2 pgoyette 73 1.1.1.1.2.2 pgoyette Linux has a number of BPF based systems, and libpcap does not support 74 1.1.1.1.2.2 pgoyette any of the eBPF mechanisms as yet, although it supports many of the 75 1.1.1.1.2.2 pgoyette memory mapped receive mechanisms. 76 1.1.1.1.2.2 pgoyette See the [README.linux](doc/README.linux.md) file for more information. 77 1.1.1.1.2.2 pgoyette 78 1.1.1.1.2.2 pgoyette Note to Linux distributions and *BSD systems that include libpcap: 79 1.1.1.1.2.2 pgoyette 80 1.1.1.1.2.2 pgoyette There's now a rule to make a shared library, which should work on Linux 81 1.1.1.1.2.2 pgoyette and *BSD, among other platforms. 82 1.1.1.1.2.2 pgoyette 83 1.1.1.1.2.2 pgoyette It sets the soname of the library to "libpcap.so.1"; this is what it 84 1.1.1.1.2.2 pgoyette should be, *NOT* libpcap.so.1.x or libpcap.so.1.x.y or something such as 85 1.1.1.1.2.2 pgoyette that. 86 1.1.1.1.2.2 pgoyette 87 1.1.1.1.2.2 pgoyette We've been maintaining binary compatibility between libpcap releases for 88 1.1.1.1.2.2 pgoyette quite a while; there's no reason to tie a binary linked with libpcap to 89 1.1.1.1.2.2 pgoyette a particular release of libpcap. 90 1.1.1.1.2.2 pgoyette 91 1.1.1.1.2.2 pgoyette Current versions can be found at https://www.tcpdump.org. 92 1.1.1.1.2.2 pgoyette 93 1.1.1.1.2.2 pgoyette - The TCPdump group 94
Indexes created Sun Apr 26 00:22:38 UTC 2026