1998-09-15 19:28:10 +00:00
|
|
|
@(#) $Header: README,v 1.18 97/06/12 14:23:56 leres Exp $ (LBL)
|
1996-08-19 20:36:34 +00:00
|
|
|
|
1998-09-15 19:28:10 +00:00
|
|
|
LIBPCAP 0.4
|
1996-08-19 20:36:34 +00:00
|
|
|
Lawrence Berkeley National Laboratory
|
|
|
|
|
Network Research Group
|
|
|
|
|
libpcap@ee.lbl.gov
|
|
|
|
|
ftp://ftp.ee.lbl.gov/libpcap.tar.Z
|
|
|
|
|
|
|
|
|
|
This directory contains source code for libpcap, a system-independent
|
|
|
|
|
interface for user-level packet capture. libpcap provides a portable
|
|
|
|
|
framework for low-level network monitoring. Applications include
|
|
|
|
|
network statistics collection, security monitoring, network debugging,
|
|
|
|
|
etc. Since almost every system vendor provides a different interface
|
|
|
|
|
for packet capture, and since we've developed several tools that
|
|
|
|
|
require this functionality, we've created this system-independent API
|
|
|
|
|
to ease in porting and to alleviate the need for several
|
|
|
|
|
system-dependent packet capture modules in each application.
|
|
|
|
|
|
|
|
|
|
Note well: this interface is new and is likely to change.
|
|
|
|
|
|
|
|
|
|
The libpcap interface supports a filtering mechanism based on the
|
|
|
|
|
architecture in the BSD packet filter. BPF is described in the 1993
|
|
|
|
|
Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
|
|
|
|
|
User-level Packet Capture''. A compressed postscript version is in:
|
|
|
|
|
|
|
|
|
|
ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z.
|
|
|
|
|
|
|
|
|
|
Although most packet capture interfaces support in-kernel filtering,
|
|
|
|
|
libpcap utilizes in-kernel filtering only for the BPF interface.
|
|
|
|
|
On systems that don't have BPF, all packets are read into user-space
|
|
|
|
|
and the BPF filters are evaluated in the libpcap library, incurring
|
|
|
|
|
added overhead (especially, for selective filters). Ideally, libpcap
|
|
|
|
|
would translate BPF filters into a filter program that is compatible
|
|
|
|
|
with the underlying kernel subsystem, but this is not yet implemented.
|
|
|
|
|
|
|
|
|
|
BPF is standard in 4.4BSD, BSD/386, NetBSD, and FreeBSD. DEC OSF/1
|
|
|
|
|
uses the packetfilter interface but has been extended to accept BPF
|
|
|
|
|
filters (which libpcap utilizes). Also, you can add BPF filter support
|
|
|
|
|
to Ultrix using the kernel source and/or object patches available in:
|
|
|
|
|
|
|
|
|
|
ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.
|
|
|
|
|
|
|
|
|
|
Problems, bugs, questions, desirable enhancements, source code
|
|
|
|
|
contributions, etc., should be sent to the email address
|
|
|
|
|
"libpcap@ee.lbl.gov".
|
|
|
|
|
|
|
|
|
|
- Steve McCanne
|
|
|
|
|
Craig Leres
|
|
|
|
|
Van Jacobson
|
