1*6f9cba8fSJoseph MingroneCurrently, libpcap supports packet capturing on Linux 2.6.27 and later; 2*6f9cba8fSJoseph Mingroneearlier versions are not supported. 3*6f9cba8fSJoseph Mingrone 4*6f9cba8fSJoseph MingroneYou must configure 2.6.x kernels with the CONFIG_PACKET_MMAP option for 5*6f9cba8fSJoseph Mingronethis protocol. 3.x and later kernels do not require that. 6*6f9cba8fSJoseph Mingrone 7*6f9cba8fSJoseph MingroneNote that, by default, libpcap will, if libnl is present, build with it; 8*6f9cba8fSJoseph Mingroneit uses libnl to support monitor mode on mac80211 devices. There is a 9*6f9cba8fSJoseph Mingroneconfiguration option to disable building with libnl, but, if that option 10*6f9cba8fSJoseph Mingroneis chosen, the monitor-mode APIs (as used by tcpdump's "-I" flag, and as 11*6f9cba8fSJoseph Mingronewill probably be used by other applications in the future) won't work 12*6f9cba8fSJoseph Mingroneproperly on mac80211 devices. 13*6f9cba8fSJoseph Mingrone 14*6f9cba8fSJoseph MingroneLinux's run-time linker allows shared libraries to be linked with other 15*6f9cba8fSJoseph Mingroneshared libraries, which means that if an older version of a shared 16*6f9cba8fSJoseph Mingronelibrary doesn't require routines from some other shared library, and a 17*6f9cba8fSJoseph Mingronelater version of the shared library does require those routines, the 18*6f9cba8fSJoseph Mingronelater version of the shared library can be linked with that other shared 19*6f9cba8fSJoseph Mingronelibrary and, if it's otherwise binary-compatible with the older version, 20*6f9cba8fSJoseph Mingronecan replace that older version without breaking applications built with 21*6f9cba8fSJoseph Mingronethe older version, and without breaking configure scripts or the build 22*6f9cba8fSJoseph Mingroneprocedure for applications whose configure script doesn't use the 23*6f9cba8fSJoseph Mingronepcap-config script if they build with the shared library. (The build 24*6f9cba8fSJoseph Mingroneprocedure for applications whose configure scripts use the pcap-config 25*6f9cba8fSJoseph Mingronescript if present will not break even if they build with the static 26*6f9cba8fSJoseph Mingronelibrary.) 27*6f9cba8fSJoseph Mingrone 28*6f9cba8fSJoseph MingroneStatistics: 29*6f9cba8fSJoseph MingroneStatistics reported by pcap are platform specific. The statistics 30*6f9cba8fSJoseph Mingronereported by pcap_stats on Linux are as follows: 31*6f9cba8fSJoseph Mingrone 32*6f9cba8fSJoseph Mingroneps_recv Number of packets that were accepted by the pcap filter 33*6f9cba8fSJoseph Mingroneps_drop Number of packets that had passed filtering but were not 34*6f9cba8fSJoseph Mingrone passed on to pcap due to things like buffer shortage, etc. 35*6f9cba8fSJoseph Mingrone This is useful because these are packets you are interested in 36*6f9cba8fSJoseph Mingrone but won't be reported by, for example, tcpdump output. 37