tcpdump doesn't appear to call any libpcap's exported function
0
votes
1
answer
102
views
Digging into
tcpdump
implementation, I can see that it actually loads the libpcap.so
dynamic library in userspace.
However, by use of strace
, I can't see any occurrence of calls to any function exported by libpcap.
Is the above an expected behaviour of tcpdump? Thank you.
root@eve-ng02:~# tcpdump --help
tcpdump version 4.9.2
libpcap version 1.7.4
OpenSSL 1.0.2g 1 Mar 2016
Edit: from received comments I tried with ltrace
but it seems no call to dynamic library is done as well.
root@eve-ng02:~# ltrace tcpdump -i lo
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
^C--- SIGINT (Interrupt) ---
0 packets captured
126 packets received by filter
98 packets dropped by kernel
+++ exited (status 0) +++
root@eve-ng02:~#
Asked by CarloC
(385 rep)
Nov 19, 2023, 11:14 AM
Last activity: Nov 19, 2023, 01:50 PM
Last activity: Nov 19, 2023, 01:50 PM