Capture Packets with libpcap

What libpcap Does

libpcap is the standard cross-platform library for capturing network traffic. It powers tcpdump, Wireshark, and countless custom analyzers. For example, opening eth0 with a filter like tcp port 80 lets you see only HTTP traffic destined for port 80.

Core API Flow

The typical capture sequence:

1. pcap_findalldevs(): enumerate interfaces (eth0, lo, wlan0)
2. pcap_open_live(): open a device with snapshot length and timeout
3. pcap_compile() + pcap_setfilter(): apply a BPF filter string
4. pcap_loop(): call your callback for each matching packet
5. pcap_close(): release the handle

BPF Filters

Berkeley Packet Filter expressions compile to bytecode that runs in the kernel before packets reach user space. Common filters:

• icmp for ping traffic
• udp port 53 for DNS queries
• host 192.168.1.1 for traffic to or from one host

Each captured packet arrives with a pcap_pkthdr timestamp and length, followed by raw bytes starting at the Ethernet header.

Why This Exercise

This task asks you to document the libpcap setup flow even though live capture cannot run in the sandbox. You will need this API knowledge when you build custom packet analyzers instead of clicking through someone else's Wireshark capture. The BPF compiler inside libpcap is the ancestor of Linux eBPF, which now runs sandboxed programs in the kernel for networking and security tooling.