"snprintf()", include one in libpcap with the name "pcap_snprintf()", so
applications don't have to supply their own "snprintf()" on those
platforms in order to use libpcap.
were read, so we check "p->break_loop"; that way, we can break out of
the loop even if we get no packets (because of a timeout).
Also, check "p->break_loop" before reading packets from the driver.
first check whether BIOCVERSION works;
then, if so, check whether the version is OK for us;
then, if so, try to install the filter - if that succeeds, free
up any userland filter we had installed, if any, and filter in
the kernel, otherwise fail;
otherwise, if we couldn't get the version or the version check
failed, install a userland filter.
That way, we don't install kernel filters unless we know the kernel's
BPF interpreter is OK for us (rather than checking the version *after*
we've already installed the filter), and don't have to worry about that
filter being in the kernel (possibly with an inappropriate interpreter)
if we're filtering in userland.
Clean up the "version isn't OK" message (put in a newline at the end,
and put in "tcpdump:" at the beginning).
userland filter before setting the "filtering is being done in the
kernel" flag to 0, and note in a comment that we've already handed the
BPF program to the older BPF interpreter in the kernel.
Added support for nonblocking operation.
Added support for processing more than a single packet in
pcap_dispatch().
Fixed bug in loss counter code.
Improved portability of loss counter code (e.g. use UINT_MAX
instead of 0xffff).
Removed unused local variables.
Added required headers (ctype.h, limits.h, unistd.h,
netinet/in.h).
Changed semantics to match those of standard pcap on linux.
- packets rejected by the filter are not counted.
correctly handle loopback devices on IRIX and UNICOS/mp (tweak
the packet header so that it's a 4-byte AF_ value rather than
the 2-byte AF_ value supplied on snoop sockets);
add support for IP-over-FC and pseudo-link devices on UNICOS/mp.
caplen and len fields in the pre-2.3 order).
Move the version number checking to the open-file code; store a
tri-state (definitely swapped, definitely not swapped, maybe swapped)
value in the savefile information and use that when processing packets.
support Linux Frame Relay ARPHRD_FRAD as Frame Relay with an FR
header;
support Linux Frame Relay ARPHRD_DLCI in cooked mode;
current Linux kernels use the name ARPHRD_CISCO for Cisco HDLC
(513).
Fix the pcap-dag atexit() handler for non-execing child
processes. Previously a fork()/exit() would stop the packet
capture (doh!).
Add a couple of optimizations.
guy