Guy Harris

(There may be some expressions people are using that depend on this behavior, so there is some risk in making that change, but that behavior is sufficiently contrary to naive...

The "expression rejects all packets" test is done only if the optimizer is on; detecting filters that never match involves analysis that's done in the optimizer. However, even *with* the...

The goal here is to have a single contiguous block of data containing both a `pcap_t` and the module's private data, with both of the structures properly aligned. I guess...

> Apparently, on this OS with this CMake `CMakeCache.txt` and `CMakeFiles/ `end up under `build/` Even if you're not doing a build in a `build` directory? That's what I've always...

That's a bit of a big Git comment. Should we discard everything starting with "*Raw filters are those generated by tcpdump -ddd. i.e.", and change the first paragraph to read...

Is there any reason to run raw filters through the optimizer? Presumably if a user specifies a raw filter, they want exactly that chunk of BPF machine code to be...

Documentation for the user would belong in a man page; documentation for libpcap developers would belong in a comment in the code.

> Also used 4096 instead of 64k (that's what the kernel defines). Actually, [the kernel defines it as 512](https://opensource.apple.com/source/xnu/xnu-3789.41.3/bsd/net/bpf.h.auto.html), as do [the kernel](https://svnweb.freebsd.org/base/head/sys/net/bpf.h?revision=314436&view=markup) and [the kernel](http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/net/bpf.h?rev=1.69&content-type=text/x-cvsweb-markup&only_with_tag=MAIN) and [the kernel](http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/net/bpf.h?rev=1.62&content-type=text/x-cvsweb-markup) and...

Currently (as of 1.10), we try to find libnl3 using pkg-config, and only fall back on hardcoding the include path if that doesn't work. If that doesn't suffice, it appears...

And given that: $ pkg-config --cflags libnl-genl-3.0 -I/usr/include/libnl3 solution 1) would be wrong (as it would break on a platform where pkg-config worked, unless we tweaked its output to remove...