Ethereal-users: Re: [ethereal-users] ./configure problem -- Header file net/bpf.h not found

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Thu, 12 Aug 1999 00:35:15 -0500
On Wed, Aug 11, 1999 at 11:13:51PM -0500, Richard Demanowski wrote:
> 
> 
> I keep getting the message "Header file net/bpf.h not found" trying to
> compile Ethereal 0.7.2 on Linux.  This happens on both a Red Hat 6 and a
> Slackware 4 box.
> 
> It was my understanding that Linux doesn't support a bpf device, so why is
> it looking for that header (which exists on neither box, btw)?

Linux 2.2.x has "Linux Socket Filter", a BPF implentation for filtering
on a socket. Some patches for libpcap to take advantage of this are floating
around. A standard libpcap won't take advantage of these, and just
sucks in packets and uses its user-space implementation of BPF to filter
packets.

However, net/bpf.h defines not only constants for the packet filter, but
the pcap file format as well. And Ethereal uses libpcap to capture packets
and save them in the pcap format.

--gilbert