Snort Forums Archive

Archive Home » Snort Development » what is the difference between libpcap/winpcap and tcpdump?

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

what is the difference between libpcap/winpcap and tcpdump?

Posted by andrewtky on November 14, 2005 17:21:21

which is better?
I saw some papers , it says tcpdump is better in packet capture and process better of packet header?
is it true?

Thx for reply

Posted by BrandonGreenwood on November 16, 2005 18:25:44

I spent a minute writing something up and then decided to hit the Sourceforge site as they could probably define libpcap better than I could.

"libpcap is a system-independent interface for user-level packet capture. libpcap provides a portable framework for low-level network monitoring. Applications include network statistics collection, security monitoring, network debugging, etc."

Basically, this is the underlying system that allows tcpdump, Snort, Ethereal, etc. to function without the authors of these other apps to have to get down and dirty with coding to provide the same features that libpcap provides.

Posted by shivaprasad on November 23, 2005 20:44:48

can i write the applications in windows using libpcap? especially i need to receive and send data through dialup adapter, is it possible ?
Thanks in advance

Regards
shiva