pcap icon indicating copy to clipboard operation
pcap copied to clipboard

Allow to compile pcap filters to BPF

Open fmaurer-rh opened this issue 3 years ago • 0 comments

libpcap has a filter language (pcap-filter(7)) that it can compile into BPF instructions. With this PR, pcap_compile(3) gets exposed. Additionally, pcap_open_dead(3) gets exposed, which allows to open a fake Pcap that can be used to compile the filters without having to open a real interface of the system.

This allows to compile pcap filters to BPF instructions. See the added test for an usage example.

fmaurer-rh avatar Aug 11 '22 08:08 fmaurer-rh