tcpdump Mailing List

Covers the classic tcpdump text-based network sniffer and its libpcap sniffer library component.

List Archives

Latest Posts

new release: tcpdump 4.99.7 Denis Ovsienko (Sep 21)
Hello all.

tcpdump 4.99.7 (stable) has been published today with the following
release notes:

----------------------------------------------------------------------
This tcpdump release improves support for the following network
protocols: BIG TCP, ISAKMP, MPTCP, and TCP (specifically, the new AE
flag). It also fixes building on GNU/Hurd and improves compatibility
with QNX. This release requires libpcap 1.10.5 or later to pass all
test cases....

new testing release: libpcap 1.11.0 Denis Ovsienko (Sep 13)
Hello all.

libpcap 1.11.0 (testing) has been published today with the following
release notes:

----------------------------------------------------------------------
This libpcap release is a result of nearly six years of development
done by The Tcpdump Group and many contributors. In calendar year 2025
Sovereign Tech Agency supported this work financially by contracting
one of the maintainers as a part-time fellow via their Fellowship [1]...

Re: BPF ISA web page Guy Harris (Sep 10)
Not implemented yet.

XOR and MOD were added in

revision 1.36
date: 2025/11/16 02:20:08; author: dlg; state: Exp; lines: +21 -1; commitid$
add XOR and MOD operations.

linux introduced these and netbsd and freebsd have picked them up.
i'm not sure of the usefulness of these, but they're cheap to
implement.

Not implemented yet.

Probably not going to show up until everythingOS 27;...

Re: BPF ISA web page Guy Harris (Sep 10)
"Same opcodes as Linux", so perhaps he heard about the added operations and independently added them, so I wouldn't go
so far as to say it was my changes.

Re: BPF ISA web page Denis Ovsienko (Sep 10)
Samuel Thibault has ported your changes to GNU/Hurd today.

https://git.sceen.net/hurd/hurd.git/commit/?id=ac35333957c8c9cf3e1253c707b039ed63ee6fbe

libpcap 1.10.7 fixes 7 vulnerabilities Denis Ovsienko (Sep 06)
Hello all.

libpcap 1.10.7 has been published yesterday, its main focus is fixing of
the following vulnerabilities:

* CVE-2026-0799 (reported by Include Security in 2018, sponsored by
Mozilla under the Secure Open Source program, but reproduced only in
2026)
* CVE-2026-31912
* CVE-2026-31911 (reported by FuzzAnything Organization)
* CVE-2026-6244
* CVE-2026-6554 (reported by Kaixuan LI)
* CVE-2026-18313
* CVE-2026-18238

All users are...

activities report for August 2026 Denis Ovsienko (Sep 01)
August 2026
===========

The accounted activities in August stand for 126:30 working hours and
45 commits (33 in libpcap, 4 in tcpdump and 8 in tcpdump-htdocs).
libpcap test tooling now implements a new type of tests (enumeration)
using a new test program, there are 15 new tests. The source code
linting, which stopped at the Cirrus CI shutdown, has been reinstated
in Buildbot.

Minor libpcap improvements are as follows:
* pcap_statustostr() is...

Re: Should applications close pcap_get_selectable_fd()? Michael Richardson (Aug 14)
Guy Harris <gharris () sonic net> wrote:
> On Aug 13, 2026, at 4:22 PM, Mark Delany <fzx () xray emu st> wrote:

>> This is probably more a documentation clarification than anything else as a light troll
>> through the archives suggests the answer...
>>
>> pcap_fileno(3) is fairly explicit about suggesting that the returned fd is the same one as
>> that used internally by...

Re: Should applications close pcap_get_selectable_fd()? Mark Delany (Aug 13)
Exactly my thoughts. We don't know anything about the relationship and shouldn't assume otherwise.

Either works for me. What would you say about pcap_fileno() as the manpage currently
implies pretty tight coupling?

Will do (at least for one of those).

Mark.

Re: Should applications close pcap_get_selectable_fd()? Guy Harris (Aug 13)
Please file an issue on this at https://github.com/the-tcpdump-group/libpcap/issues to serve as a reminder. (And if you
have a change to the manual page that you'd like to suggest, feel free to file a pull request.)

Re: Should applications close pcap_get_selectable_fd()? Guy Harris (Aug 13)
The documentation needs to be changed to make it clearer that it should *not* be closed, because it could be, but is
not guaranteed to be, the same file descriptor as the one used for the capture mechanism. (Some capture mechanism might
require separate readable and selectable FDs. Npcap requires the Windows equivalent - a HANDLE on which to do reads,
writes, and DeviceIoControl()s, and another HANDLE representing an event that can be waited...

Should applications close pcap_get_selectable_fd()? Mark Delany (Aug 13)
This is probably more a documentation clarification than anything else as a light troll
through the archives suggests the answer...

pcap_fileno(3) is fairly explicit about suggesting that the returned fd is the same one as
that used internally by pcap, however pcap_get_selectable_fd(3) is much less forthcoming
on the matter.

My naive reading is that pcap_get_selectable_fd() returns a unique fd for my own purposes
and that I should close it when...

Re: activities report for July 2026 Denis Ovsienko (Aug 02)
In these use cases "ret" [a] seems to fit better because if the
return value is a sum of several components, it most likely will be in A
after the required number of "add x" and "add #k".

For somebody who is prepared to do that an additional "txa" hardly
makes the task any more difficult.

Re: activities report for July 2026 Guy Harris (Aug 02)
Somebody who wants to capture TCP packets and wants the packets to be cut off after the first 20 bytes of TCP
*payload*, especially if they're running on a link layer that has a variable-length header?

Or just "...after the first 20 bytes of IPv4 header" with a variable-length link-layer header?

(No API support for that in libpcap, though. They'd have to write their own filter code.)

Re: activities report for July 2026 Denis Ovsienko (Aug 02)
[...]

This would be a monumental task, but the gain could be zero because:

* "ret x" would have the same effect as "txa; ret" because the value of
A makes no difference after the return, except each "ret x" per
filter program would save one BPF instruction, and

* libpcap always generates filter programs with one or two return
instructions, and

* the only type of return instruction libpcap generates is...

More Lists

Dozens of other network security lists are archived at SecLists.Org.