NetBSD/lib/libpcap
thorpej e9c2ed11fe Add names for some ICMP and TCP protocol header offsets:
- icmptype (offset of ICMP type field)
	- icmpcode (offset of ICMP code field)
	- tcpflags (offset of TCP flags field)
and field values:
	- icmp-echoreply, icmp-unreach, icmp-sourcequench,
	  icmp-redirect, icmp-echo, icmp-routeradvert,
	  icmp-routersolicit, icmp-timxceed, icmp-paramprob,
	  icmp-tstamp, icmp-tstampreply, icmp-ireq, icmp-ireqreply,
	  icmp-maskreq, icmp-maskreply
	- tcp-fin, tcp-syn, tcp-rst, tcp-push, tcp-ack, tcp-urg

This allows expressions like the following:

	icmp[0] = 3
	(tcp[13] & 0x02) != 0

to be written as:

	icmp[icmptype] = icmp-unreach
	(tcp[tcpflags] & tcp-syn) != 0

which is a bit more user-friendly for e.g. writing packet filter rules.
2000-12-28 22:12:07 +00:00
..
CHANGES Resolve conflicts 1997-10-03 15:53:00 +00:00
Makefile use getifaddrs, instead of SIOCGIFCONF. 2000-04-13 05:14:19 +00:00
README Resolve conflicts 1997-10-03 15:53:00 +00:00
bpf_image.c Format string cleanups by sommerfeld. 2000-10-10 19:12:48 +00:00
etherent.c Resolve conflicts 1997-10-03 15:53:00 +00:00
ethertype.h more fallback #define. more friendly message on "ip host ip6only-host" 2000-04-14 14:26:35 +00:00
gencode.c Add support for the DLT_RAWAF() data link type. 2000-12-28 22:04:22 +00:00
gencode.h be more pedant. remove unused vars and such. 1999-12-13 01:44:30 +00:00
gnuc.h Resolve conflicts 1997-10-03 15:53:00 +00:00
grammar.y Add code to do link level address matching for ARCnet interfaces. 1999-10-25 16:39:37 +00:00
inet.c use getifaddrs, instead of SIOCGIFCONF. 2000-04-13 05:14:19 +00:00
nametoaddr.c comment fix (less diff with tcpdump.org) 2000-04-14 14:18:40 +00:00
optimize.c re-introduce netbsd fix 1.5 -> 1.6, which was mistakenly removed. 2000-11-19 13:18:03 +00:00
pcap-bpf.c support IPv6 address and IPv6 protocols. 1999-07-02 10:05:22 +00:00
pcap-int.h More trailing white space. 1999-07-02 15:58:35 +00:00
pcap-namedb.h support IPv6 address and IPv6 protocols. 1999-07-02 10:05:22 +00:00
pcap.3 Add pcap_compile_nopcap() from the most recent libpcap release 2000-10-06 16:39:24 +00:00
pcap.c fix bug in pcap.c, which appeared in LBL libpcap version 0.4 of the following 2000-04-12 14:40:33 +00:00
pcap.h Add pcap_compile_nopcap() from the most recent libpcap release 2000-10-06 16:39:24 +00:00
pcap2netbsd More trailing white space. 1999-07-02 15:58:35 +00:00
ppp.h support for PPP_IPV6. 1999-07-25 00:15:22 +00:00
savefile.c sprintf -> snprintf 2000-04-13 05:10:17 +00:00
scanner.l Add names for some ICMP and TCP protocol header offsets: 2000-12-28 22:12:07 +00:00
shlib_version Add pcap_compile_nopcap() from the most recent libpcap release 2000-10-06 16:39:24 +00:00
version.c we already have all fixes toward 0.4 (v0.4 Sat Jul 25 12:40:09 PDT 1998 - 2000-10-08 14:28:05 +00:00

README

$NetBSD: README,v 1.4 1997/10/03 15:53:01 christos Exp $
@(#) Header: README,v 1.18 97/06/12 14:23:56 leres Exp  (LBL)

LIBPCAP 0.4
Lawrence Berkeley National Laboratory
Network Research Group
libpcap@ee.lbl.gov
ftp://ftp.ee.lbl.gov/libpcap.tar.Z

This directory contains source code for libpcap, a system-independent
interface for user-level packet capture.  libpcap provides a portable
framework for low-level network monitoring.  Applications include
network statistics collection, security monitoring, network debugging,
etc.  Since almost every system vendor provides a different interface
for packet capture, and since we've developed several tools that
require this functionality, we've created this system-independent API
to ease in porting and to alleviate the need for several
system-dependent packet capture modules in each application.

Note well: this interface is new and is likely to change.

The libpcap interface supports a filtering mechanism based on the
architecture in the BSD packet filter.  BPF is described in the 1993
Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
User-level Packet Capture''.  A compressed postscript version is in:

	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z.

Although most packet capture interfaces support in-kernel filtering,
libpcap utilizes in-kernel filtering only for the BPF interface.
On systems that don't have BPF, all packets are read into user-space
and the BPF filters are evaluated in the libpcap library, incurring
added overhead (especially, for selective filters).  Ideally, libpcap
would translate BPF filters into a filter program that is compatible
with the underlying kernel subsystem, but this is not yet implemented.

BPF is standard in 4.4BSD, BSD/386, NetBSD, and FreeBSD.  DEC OSF/1
uses the packetfilter interface but has been extended to accept BPF
filters (which libpcap utilizes).  Also, you can add BPF filter support
to Ultrix using the kernel source and/or object patches available in:

	ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.

Problems, bugs, questions, desirable enhancements, source code
contributions, etc., should be sent to the email address
"libpcap@ee.lbl.gov".

 - Steve McCanne
   Craig Leres
   Van Jacobson