The Tcpdump Group git mirrors - libpcap/blob - doc/README.linux

   1 Currently, libpcap supports packet capturing on Linux 2.6.27 and later;
   2 earlier versions are not supported.  libpcap will not work if the kernel
   3 does not have the packet socket option enabled.
   4
   5 You must configure 2.6.x kernels with the CONFIG_PACKET_MMAP option for
   6 this protocol.  3.x and later kernels do not require that.
   7
   8 Note that, by default, libpcap will, if libnl is present, build with it;
   9 it uses libnl to support monitor mode on mac80211 devices.  There is a
  10 configuration option to disable building with libnl, but, if that option
  11 is chosen, the monitor-mode APIs (as used by tcpdump's "-I" flag, and as
  12 will probably be used by other applications in the future) won't work
  13 properly on mac80211 devices.
  14
  15 libnl-tiny can be used when libnl is not available.  This works using
  16 Autoconf only and requires the provided libnl-tiny to have sufficient
  17 pkg-config support.
  18
  19 Linux's run-time linker allows shared libraries to be linked with other
  20 shared libraries, which means that if an older version of a shared
  21 library doesn't require routines from some other shared library, and a
  22 later version of the shared library does require those routines, the
  23 later version of the shared library can be linked with that other shared
  24 library and, if it's otherwise binary-compatible with the older version,
  25 can replace that older version without breaking applications built with
  26 the older version, and without breaking configure scripts or the build
  27 procedure for applications whose configure script doesn't use the
  28 pcap-config script if they build with the shared library.  (The build
  29 procedure for applications whose configure scripts use the pcap-config
  30 script if present will not break even if they build with the static
  31 library.)
  32
  33 Statistics:
  34 Statistics reported by pcap are platform specific.  The statistics
  35 reported by pcap_stats on Linux are as follows:
  36
  37 ps_recv   Number of packets that were accepted by the pcap filter
  38 ps_drop   Number of packets that had passed filtering but were not
  39           passed on to pcap due to things like buffer shortage, etc.
  40           This is useful because these are packets you are interested in
  41           but won't be reported by, for example, tcpdump output.