pcap
pcap copied to clipboard
Allow to compile pcap filters to BPF
libpcap has a filter language (pcap-filter(7)) that it can compile into BPF instructions. With this PR, pcap_compile(3) gets exposed. Additionally, pcap_open_dead(3) gets exposed, which allows to open a fake Pcap that can be used to compile the filters without having to open a real interface of the system.
This allows to compile pcap filters to BPF instructions. See the added test for an usage example.