libpcap, tcpdump,..

libpcap, tcpdump,..

Post by Vijayant Palai » Mon, 24 Apr 1995 04:00:00


I found the following in the README of the libpcap directory used by the
tcpdump -

"Although most packet capture interfaces support in-kernel filtering,
libpcap utilizes in-kernel filtering only for the BPF interface.
On systems that don't have BPF, all packets are read into user-space
and the BPF filters are evaluated in the libpcap library, incurring
added overhead (especially, for selective filters)."

Does BPF interface here means only /dev/bpfXXX?
Does this mean that libpcap in systems which does not have /dev/bpfXXX
won't does not perform "in-kernel" filtering?

In short, can someone tell how packet filtering works for other systems?

Thanks in advance,

Vijayant Palaiya


1. Can libpcap (tcpdump) loose frames ?

Hi !

I'm currently writing a program using the libpcap packet capturing
library. As far as I understand, the library grabs any packet directly
from the NIC without buffering. This would mean that if I spent too
much time processing the frame in the function called by pcap_loop, I
would lose frames that were sent during the processing.
Is this correct ?

Alexander Dietrich
| Alexander Dietrich | Norderstedt, Germany |

2. Migrating from UNIX to NT?

3. I installed libpcap trojan

4. FA310TX and Solaris 7 x86

5. libpcap (+tcpdump) woes, HEEEELP!!!

6. Solaris compatible mail reader on DECS

7. tcpdump-3.0.2 and libpcap-0.0.6

8. Looking for the "ufs" includes

9. libpcap problem (hdr.len vs tcpdump file size)?

10. libpcap and tcpdump

11. tcpdump, libpcap

12. tcpdump & libpcap