Very Computer

I wanna know what is difference between tcpdump and libpcap.
And, what's the BPF(BSD Packet Filtering)?
When programmer using tcpdump or libpcap, system apply BPF automatically?
OR, programmer must do something else to use BPF?
Please, give me answers ! :-)

BPF is the Berkeley Packet Filter interface.  It is an interface which
allows you to tell the kernel which packets you want captured, and the
kernel gives you only those.  It is not available on Linux.

libpcap is a portable packet capturing library which is able to use
BPF, Linux's SOCK_PACKET sockets, and various other packet capturing
kernel interfaces.  It provides a consistent api, allowing you to
write packet capturing programs which use libpcap and can run
unmodified on a variety of operating systems.

tcpdump is a very popular network monitoring application which uses
libpcap.

In order to use tcpdump, you need to install libpcap.  You don't need
to worry about BPF (if you're on Linux, you don't have it, if you're
on *bsd, libpcap will automatically use it).

tcpdump and libpcap are available at http://ee.lbl.gov/.

Best of luck,
Andru
--
--------------------------------------------------------------------------
| Andru Luvisi                 | http://libweb.sonoma.edu/                 |
| Programmer/Analyst           |   Library Resources Online              |
| Ruben Salazar Library        |-----------------------------------------|
| Sonoma State University      | http://www.belleprovence.com/                 |

--------------------------------------------------------------------------