How does libpcap compile?!?

[guyharris]

Converted from SourceForge issue 697594, submitted by cross

I am trying to get libpcap 0.7.2 to compile on a BSD/OS 5.0 host. There are many DLT_ symbols used in the code, that are documented to come from only one OS (OpenBSD, NetBSD, Linux, etc). But, these are not generally protected with an #ifdef. How is this? Do all OS's tend to define these symbols to something, even in the case that they came up from only one OS originally? Is there some magic that needs to occur during the build process to NULL out the other ones that aren't valid for your host OS?

Thanks. Could very much use support/clarification here...

[guyharris]

Submitted by guy_harris

Logged In: YES user_id=541179

tcpdump.org's libpcap, at least prior to the current CVS version, is not guaranteed to compile with the native OS's <net/bpf.h>. If you're porting to a platform that has its own <net/bpf.h>, you might either have to modify the platform's <net/bpf.h> (if you're one of the platform's developers) or arrange that it use the <net/bpf.h> that comes with libpcap, in the bpf/net directory.

The current CVS version renames <net/bpf.h> to pcap-bpf.h, and installs it along with the other pcap header files. This was done so that pcap-bpf.c could include <net/bpf.h> and be guaranteed to get the native OS's <net/bpf.h> (that's necessary on AIX, as, on AIX, it now loads the BPF driver and creates the "/dev/bpf" devices, just as AIX 5.x's libpcap does and the libpcap code presumably internal to AIX 4.x's tcpdump does, and the code to do that requires stuff from the AIX <net/bpf.h>). A side-effect of that is that it might be easier to get the current CVS version to compile on OSes that supply their own <net/bpf.h>.

The intent is that libpcap be able to work with DLT_ values even if the native packet capture mechanism doesn't use them, so that you can generate BPF code for capture files taken on machines with an OS whose native packet capture mechanism does generate them.

[guyharris]

Submitted by nobody

Logged In: NO

How can compile tcpdum with IDS?

[guyharris]

Submitted by guy_harris

Logged In: YES user_id=541179

I assume that in "How can compile tcpdum with IDS?" "IDS" means "Intrusion Detection System".

Tcpdump is not an intrusion detection system, and does not use any part of any IDS, so you don't "compile it with an IDS" in the sense of including an IDS as a component of it.

Perhaps there exists an IDS that builds on top of tcpdump; if you want to know how to compile an IDS that includes tcpdump, you'd have to see the instructions for compiling that IDS.

[infrastation]

Request addressed, closing.