1*748408edSchristosCurrently, libpcap supports packet capturing on Linux 2.6.27 and later; 2*748408edSchristosearlier versions are not supported. 3*748408edSchristos 4*748408edSchristosYou must configure 2.6.x kernels with the CONFIG_PACKET_MMAP option for 5*748408edSchristosthis protocol. 3.x and later kernels do not require that. 6*748408edSchristos 7*748408edSchristosNote that, by default, libpcap will, if libnl is present, build with it; 8*748408edSchristosit uses libnl to support monitor mode on mac80211 devices. There is a 9*748408edSchristosconfiguration option to disable building with libnl, but, if that option 10*748408edSchristosis chosen, the monitor-mode APIs (as used by tcpdump's "-I" flag, and as 11*748408edSchristoswill probably be used by other applications in the future) won't work 12*748408edSchristosproperly on mac80211 devices. 13*748408edSchristos 14*748408edSchristosLinux's run-time linker allows shared libraries to be linked with other 15*748408edSchristosshared libraries, which means that if an older version of a shared 16*748408edSchristoslibrary doesn't require routines from some other shared library, and a 17*748408edSchristoslater version of the shared library does require those routines, the 18*748408edSchristoslater version of the shared library can be linked with that other shared 19*748408edSchristoslibrary and, if it's otherwise binary-compatible with the older version, 20*748408edSchristoscan replace that older version without breaking applications built with 21*748408edSchristosthe older version, and without breaking configure scripts or the build 22*748408edSchristosprocedure for applications whose configure script doesn't use the 23*748408edSchristospcap-config script if they build with the shared library. (The build 24*748408edSchristosprocedure for applications whose configure scripts use the pcap-config 25*748408edSchristosscript if present will not break even if they build with the static 26*748408edSchristoslibrary.) 27*748408edSchristos 28*748408edSchristosStatistics: 29*748408edSchristosStatistics reported by pcap are platform specific. The statistics 30*748408edSchristosreported by pcap_stats on Linux are as follows: 31*748408edSchristos 32*748408edSchristosps_recv Number of packets that were accepted by the pcap filter 33*748408edSchristosps_drop Number of packets that had passed filtering but were not 34*748408edSchristos passed on to pcap due to things like buffer shortage, etc. 35*748408edSchristos This is useful because these are packets you are interested in 36*748408edSchristos but won't be reported by, for example, tcpdump output. 37