| @(#) $Header: /tcpdump/master/libpcap/README,v 1.22 2000-07-13 06:24:14 guy Exp $ (LBL) |
| |
| LIBPCAP 0.5 |
| Now maintained by "The Tcpdump Group" |
| See www.tcpdump.org |
| |
| Please send inquiries/comments/reports to tcpdump-workers@tcpdump.org |
| |
| Anonymous CVS is available via: |
| cvs -d cvs.tcpdump.org:/tcpdump/master login |
| (password "anoncvs") |
| cvs -d cvs.tcpdump.org:/tcpdump/master checkout libpcap |
| |
| Version 0.5 of LIBPCAP can be retrived with the CVS tag "libpcap_0_5": |
| cvs -d cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_0_5 libpcap |
| |
| Please send patches against the master copy to patches@tcpdump.org. |
| |
| formerly from Lawrence Berkeley National Laboratory |
| Network Research Group <libpcap@ee.lbl.gov> |
| ftp://ftp.ee.lbl.gov/libpcap.tar.Z (0.4) |
| |
| This directory contains source code for libpcap, a system-independent |
| interface for user-level packet capture. libpcap provides a portable |
| framework for low-level network monitoring. Applications include |
| network statistics collection, security monitoring, network debugging, |
| etc. Since almost every system vendor provides a different interface |
| for packet capture, and since we've developed several tools that |
| require this functionality, we've created this system-independent API |
| to ease in porting and to alleviate the need for several |
| system-dependent packet capture modules in each application. |
| |
| Note well: this interface is new and is likely to change. |
| |
| The libpcap interface supports a filtering mechanism based on the |
| architecture in the BSD packet filter. BPF is described in the 1993 |
| Winter Usenix paper ``The BSD Packet Filter: A New Architecture for |
| User-level Packet Capture''. A compressed postscript version is in: |
| |
| ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z. |
| |
| Although most packet capture interfaces support in-kernel filtering, |
| libpcap utilizes in-kernel filtering only for the BPF interface. |
| On systems that don't have BPF, all packets are read into user-space |
| and the BPF filters are evaluated in the libpcap library, incurring |
| added overhead (especially, for selective filters). Ideally, libpcap |
| would translate BPF filters into a filter program that is compatible |
| with the underlying kernel subsystem, but this is not yet implemented. |
| |
| BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD. DEC OSF/1 |
| uses the packetfilter interface but has been extended to accept BPF |
| filters (which libpcap utilizes). Also, you can add BPF filter support |
| to Ultrix using the kernel source and/or object patches available in: |
| |
| ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z. |
| |
| Problems, bugs, questions, desirable enhancements, etc. |
| should be sent to the address "tcpdump-workers@tcpdump.org". |
| |
| Source code contributions, etc. should be sent to the email address |
| "patches@tcpdump.org". |
| |
| Current versions can be found at www.tcpdump.org |
| |
| - The TCPdump team |