10.1. Introduction to libpcap
libpcap is an open source C-language library for capturing network packets. libpcap is available for a number of different platforms, including most Unix and Unix-like platforms (such as Linux and BSD), as well as for Windows.
Although libpcap is primarily a packet-capturing tool, it also can create and manipulate packets from saved files, which can then be used in the wide variety of tools that support the libpcap format.
10.1.1. Why Use libpcap?
libpcap hides much of the complexity inherent in network packet capture. Packet capture is possible using native network functionality on most platforms; however, the interfaces and semantics required for capturing packets are not for the faint of heart. For example, the following is a fragment of code for packet capture from a tool I wrote for Linux some years ago:
struct sockaddr_nl nl_addr; int fd; int recvlen; unsigned char msgbuf; fd = socket (PF_NETLINK, SOCK_RAW, 0x02) memset (&nl_addr, 0, sizeof (struct sockaddr_nl)); nl_addr.nl_family = (sa_family_t) PF_NETLINK; nl_addr.nl_pid = (unsigned int) getpid ( ); nl_addr.nl_groups = 0x02; bind (fd, (struct sockaddr *) &nl_addr, sizeof (struct sockaddr_nl) recvlen = recv (fd, msgbuf, MAX_BUFFER_SIZE, 0)
As you can see, this is not the friendliest of code. It uses BSD socket calls to the Linux-only netlink(3) interface to pass packets from the kernel to the user tool.
libpcap hides the complexity of getting packets from the operating system, and it gives the tool developer a consistent interface for developing tools, regardless of the tool's intended operating system. In turn, this makes writing portable code much simpler, and it makes your tools much more useful.
10.1.2. Installing libpcap
You can obtain the latest version of libpcap from http://www.tcpdump.org. libpcap is easy to compile from the source code:
> tar zxvf libpcap-0.8.3.tar.gz > cd libpcap-0.8.3 > ./configure > make > make install
Many Linux distributions also include libpcap as an optional package that you can install with the distribution, or add afterward. Because libpcap's functionality changes between versions, you should use the latest version of the libraries available for your distribution or compile the library from source for your own development.