|
Packit |
209cc3 |
To report a security issue please send an e-mail to security@tcpdump.org.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
To report bugs and other problems, contribute patches, request a
|
|
Packit |
209cc3 |
feature, provide generic feedback etc please see the file
|
|
Packit |
209cc3 |
[CONTRIBUTING](CONTRIBUTING.md) in the libpcap source tree root.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
The directory doc/ has README files about specific operating systems and
|
|
Packit |
209cc3 |
options.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
LIBPCAP 1.x.y
|
|
Packit |
209cc3 |
Now maintained by "The Tcpdump Group"
|
|
Packit |
209cc3 |
https://www.tcpdump.org
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
Anonymous Git is available via:
|
|
Packit |
209cc3 |
https://github.com/the-tcpdump-group/libpcap.git
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
formerly from Lawrence Berkeley National Laboratory
|
|
Packit |
209cc3 |
Network Research Group <libpcap@ee.lbl.gov>
|
|
Packit |
209cc3 |
ftp://ftp.ee.lbl.gov/old/libpcap-0.4a7.tar.Z
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
This directory contains source code for libpcap, a system-independent
|
|
Packit |
209cc3 |
interface for user-level packet capture. libpcap provides a portable
|
|
Packit |
209cc3 |
framework for low-level network monitoring. Applications include
|
|
Packit |
209cc3 |
network statistics collection, security monitoring, network debugging,
|
|
Packit |
209cc3 |
etc. Since almost every system vendor provides a different interface
|
|
Packit |
209cc3 |
for packet capture, and since we've developed several tools that
|
|
Packit |
209cc3 |
require this functionality, we've created this system-independent API
|
|
Packit |
209cc3 |
to ease in porting and to alleviate the need for several
|
|
Packit |
209cc3 |
system-dependent packet capture modules in each application.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
For some platforms there are README.{system} files that discuss issues
|
|
Packit |
209cc3 |
with the OS's interface for packet capture on those platforms, such as
|
|
Packit |
209cc3 |
how to enable support for that interface in the OS, if it's not built in
|
|
Packit |
209cc3 |
by default.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
The libpcap interface supports a filtering mechanism based on the
|
|
Packit |
209cc3 |
architecture in the BSD packet filter. BPF is described in the 1993
|
|
Packit |
209cc3 |
Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
|
|
Packit |
209cc3 |
User-level Packet Capture''. A compressed PostScript version can be
|
|
Packit |
209cc3 |
found at
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
or
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
https://www.tcpdump.org/papers/bpf-usenix93.ps.Z
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
and a gzipped version can be found at
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
https://www.tcpdump.org/papers/bpf-usenix93.ps.gz
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
A PDF version can be found at
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
https://www.tcpdump.org/papers/bpf-usenix93.pdf
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
Although most packet capture interfaces support in-kernel filtering,
|
|
Packit |
209cc3 |
libpcap utilizes in-kernel filtering only for the BPF interface.
|
|
Packit |
209cc3 |
On systems that don't have BPF, all packets are read into user-space
|
|
Packit |
209cc3 |
and the BPF filters are evaluated in the libpcap library, incurring
|
|
Packit |
209cc3 |
added overhead (especially, for selective filters). Ideally, libpcap
|
|
Packit |
209cc3 |
would translate BPF filters into a filter program that is compatible
|
|
Packit |
209cc3 |
with the underlying kernel subsystem, but this is not yet implemented.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly
|
|
Packit |
209cc3 |
BSD, and macOS; an older, modified and undocumented version is standard
|
|
Packit |
209cc3 |
in AIX. {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the packetfilter
|
|
Packit |
209cc3 |
interface but has been extended to accept BPF filters (which libpcap
|
|
Packit |
209cc3 |
utilizes). Also, you can add BPF filter support to Ultrix using the
|
|
Packit |
209cc3 |
kernel source and/or object patches available in:
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
https://www.tcpdump.org/other/bpfext42.tar.Z
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
Linux has a number of BPF based systems, and libpcap does not support
|
|
Packit |
209cc3 |
any of the eBPF mechanisms as yet, although it supports many of the
|
|
Packit |
209cc3 |
memory mapped receive mechanisms.
|
|
Packit |
209cc3 |
See the [README.linux](doc/README.linux.md) file for more information.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
Note to Linux distributions and *BSD systems that include libpcap:
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
There's now a rule to make a shared library, which should work on Linux
|
|
Packit |
209cc3 |
and *BSD, among other platforms.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
It sets the soname of the library to "libpcap.so.1"; this is what it
|
|
Packit |
209cc3 |
should be, *NOT* libpcap.so.1.x or libpcap.so.1.x.y or something such as
|
|
Packit |
209cc3 |
that.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
We've been maintaining binary compatibility between libpcap releases for
|
|
Packit |
209cc3 |
quite a while; there's no reason to tie a binary linked with libpcap to
|
|
Packit |
209cc3 |
a particular release of libpcap.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
Current versions can be found at https://www.tcpdump.org.
|
|
Packit |
209cc3 |
|
|
Packit |
209cc3 |
- The TCPdump group
|