NetBSD/lib/libpcap
thorpej b62918959e The only two data link types that support the "inbound" and "outbound"
qualifiers are DLT_SLIP and DLT_PPP (i.e. old-style serial encap PPP).
If an attempt to use these qualifiers is used for any other link type,
cause a BPF program compilation error.
1999-05-15 17:39:07 +00:00
..
CHANGES Resolve conflicts 1997-10-03 15:53:00 +00:00
Makefile convert to using LPREFIX and YPREFIX 1998-11-01 03:48:35 +00:00
README Resolve conflicts 1997-10-03 15:53:00 +00:00
bpf_image.c Resolve conflicts 1997-10-03 15:53:00 +00:00
etherent.c Resolve conflicts 1997-10-03 15:53:00 +00:00
ethertype.h Resolve conflicts 1997-10-03 15:53:00 +00:00
gencode.c The only two data link types that support the "inbound" and "outbound" 1999-05-15 17:39:07 +00:00
gencode.h Resolve conflicts 1997-10-03 15:53:00 +00:00
gnuc.h Resolve conflicts 1997-10-03 15:53:00 +00:00
grammar.y Resolve conflicts 1997-10-03 15:53:00 +00:00
inet.c Resolve conflicts 1997-10-03 15:53:00 +00:00
nametoaddr.c lint 1997-11-05 21:37:27 +00:00
optimize.c Resolve conflicts 1997-10-03 15:53:00 +00:00
pcap-bpf.c Resolve conflicts 1997-10-03 15:53:00 +00:00
pcap-int.h Switch to the same padding ULTRIX and Digital UNIX use. 1998-09-19 21:44:37 +00:00
pcap-namedb.h Resolve conflicts 1997-10-03 15:53:00 +00:00
pcap.3 Fix pasto; from matt debergalis <deberg@mit.edu> in PR lib/5649. 1998-06-24 19:07:00 +00:00
pcap.c const poisoning. 1998-07-26 14:49:36 +00:00
pcap.h const poisoning. 1998-07-26 14:49:36 +00:00
pcap2netbsd .y.c <sys.mk> rule fixes. Don't create a y.tab.h file unless asked for, 1998-04-09 00:32:31 +00:00
ppp.h Import LBL's libpcap 0.4a3 1997-10-03 15:38:55 +00:00
savefile.c Resolve conflicts 1997-10-03 15:53:00 +00:00
scanner.l Tweak to allow (perfectly legal) single-character host names, or, 1999-03-22 09:15:10 +00:00
shlib_version Add a note to update src/distrib/sets/lists/base/shl.*, and add a missing 1999-02-25 08:02:19 +00:00
version.c Add support for version.c; this is needed by other programs. 1997-10-03 16:40:56 +00:00

README

$NetBSD: README,v 1.4 1997/10/03 15:53:01 christos Exp $
@(#) Header: README,v 1.18 97/06/12 14:23:56 leres Exp  (LBL)

LIBPCAP 0.4
Lawrence Berkeley National Laboratory
Network Research Group
libpcap@ee.lbl.gov
ftp://ftp.ee.lbl.gov/libpcap.tar.Z

This directory contains source code for libpcap, a system-independent
interface for user-level packet capture.  libpcap provides a portable
framework for low-level network monitoring.  Applications include
network statistics collection, security monitoring, network debugging,
etc.  Since almost every system vendor provides a different interface
for packet capture, and since we've developed several tools that
require this functionality, we've created this system-independent API
to ease in porting and to alleviate the need for several
system-dependent packet capture modules in each application.

Note well: this interface is new and is likely to change.

The libpcap interface supports a filtering mechanism based on the
architecture in the BSD packet filter.  BPF is described in the 1993
Winter Usenix paper ``The BSD Packet Filter: A New Architecture for
User-level Packet Capture''.  A compressed postscript version is in:

	ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z.

Although most packet capture interfaces support in-kernel filtering,
libpcap utilizes in-kernel filtering only for the BPF interface.
On systems that don't have BPF, all packets are read into user-space
and the BPF filters are evaluated in the libpcap library, incurring
added overhead (especially, for selective filters).  Ideally, libpcap
would translate BPF filters into a filter program that is compatible
with the underlying kernel subsystem, but this is not yet implemented.

BPF is standard in 4.4BSD, BSD/386, NetBSD, and FreeBSD.  DEC OSF/1
uses the packetfilter interface but has been extended to accept BPF
filters (which libpcap utilizes).  Also, you can add BPF filter support
to Ultrix using the kernel source and/or object patches available in:

	ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.

Problems, bugs, questions, desirable enhancements, source code
contributions, etc., should be sent to the email address
"libpcap@ee.lbl.gov".

 - Steve McCanne
   Craig Leres
   Van Jacobson