Projects / libpcap


This is a handy little library which provides a packet filtering mechanism based on the BSD packet filter (BPF). Most notably, tcpdump needs this to work, and there is also a perl module (still in beta) which can use this as well. In plain english, if you want to write your own network traffic analyzer, this is the place to start.

Operating Systems

Recent releases

  •  27 Nov 2013 10:49

    Release Notes: This release (compared to the previous release 1.4.0) has improved autoconf scripts, adds support for TPACKET_V3 on Linux, adds a new API function, improves handling of memory management failures, fixes compiling on Solaris 11, adds support for E1 SS7 traffic on MTP2 layer Annex A, and adds many new DLT types.

    •  28 Oct 2008 17:56

      Release Notes: Support was added for IPMB, LAPD, AX25, JUNIPER_ST, 802.15.4, variable length 802.11 headers, X2E data type, Linux tpacket frame headers, and the SITA ACN interface. Support was added for zerocopy BPF on platforms that support it. VLAN support on Linux was improved. Dynamic library support on Mac OS X was fixed. Assorted other enhancements and bugfixes were made.

      •  28 Nov 2007 12:20

        Release Notes: Assorted minor bugfixes and code cleanups were done.

        •  09 Aug 2007 18:17

          Release Notes: Basic BPF filtering, Bluetooth, USB capturing on Linux, FreeBSD BIOCSDIRECTION ioctl, additional filter operations for 802.11 frame types, and support for filtering on MTP2 frame types were all added, and numerous other minor enhancements and bugfixes were made.

          •  20 Mar 2007 23:24

            Release Notes: Support has been added for LAPD frames with vISDN, ERF on channelized T1/E1 cards via DAG API, DLT_JUNIPER_VP, DLT_IEEE802_11, and DLT_IEEE802_11_RADIO. Fixes for MPLS packet generation (link layer). DLT/LINKTYPE has been added for carrying FRF.16 Multi-link Frame Relay. A new DLT and LINKTYPE value have been added for ARINC 653 Interpartition Communcation Messages, A429, and for CAN v2.0B frames. DLT_CAN20B and LINKTYPE_CAN20B have been redefined. Support has been added for DLLs on Cygnus and MingW32. There are minor bugfixes.

            Recent comments

            25 Mar 2012 06:21 mercurytoxic

            1.2.1 is out

            26 May 2004 10:34 psypete

            pcap implementations?
            I'm working on EtherDump ( and i'm considering writing a teeny-weeny implementation of the pcap format for my tool. Are there any other small/embedded implementations or really simple examples of how to structure it? I saw the pcap draft doc in CVS so I could always go on that, but an already written example is just so much quicker to follow, and plus if somebody's already got something made I can use I could just use that.

            01 Mar 2000 18:52 lindner

            libpcap active development
            Michael Richardson at ( has
            recently been working on libpcap. And tcpdump, obviously.


            Project Spotlight


            A Fluent OpenStack client API for Java.


            Project Spotlight

            TurnKey TWiki Appliance

            A TWiki appliance that is easy to use and lightweight.