Merge libpcap 1.0.0.

author: rpaulo <rpaulo@FreeBSD.org> 2009-03-21 22:58:08 +0000
committer: rpaulo <rpaulo@FreeBSD.org> 2009-03-21 22:58:08 +0000
commit: 3f19af99adb541ff811a6faaaae340e24ad313c5 (patch)
tree: 41d4ee124e8dc2938aa5559c6f422a7b778c807f /contrib/libpcap
parent: b0069d00e9ca6c9d90eb18267d0949527c0249e5 (diff)
parent: d8d18f6fbdf4f16ae4382f3d0a2d97953edd9b2c (diff)
download: FreeBSD-src-3f19af99adb541ff811a6faaaae340e24ad313c5.zip
FreeBSD-src-3f19af99adb541ff811a6faaaae340e24ad313c5.tar.gz
156 files changed, 25065 insertions, 10691 deletions
diff --git a/contrib/libpcap/CHANGES b/contrib/libpcap/CHANGES
index 536e1a2..dc4e006 100644
--- a/contrib/libpcap/CHANGES
+++ b/contrib/libpcap/CHANGES
@@ -1,28 +1,41 @@
-@(#) $Header: /tcpdump/master/libpcap/CHANGES,v 1.59.2.13 2007/09/12 22:40:04 ken Exp $ (LBL)
-
-Mon.	September 10, 2007.  ken@xelerance.com.  Summary for 0.9.8 libpcap release
-	Change build process to put public libpcap headers into pcap subir
-	DLT: Add value for IPMI IPMB packets
-	DLT: Add value for u10 Networks boards
-	Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 
-	 libpcap files on an OS other than where the file was generated
-
-Wed.	July 23, 2007.  mcr@xelerance.com.  Summary for 0.9.7 libpcap release
-
-	FIXED version file to be 0.9.7 instead of 0.9.5.
-	added flags/configuration for cloning bpf device.
-	added DLT_MTP2_WITH_PHDR support (PPI)
-        "fix" the "memory leak" in icode_to_fcode() -- documentation bug
-        Various link-layer types, with a pseudo-header, for SITA http://www.sita.aero/
-	introduces support for the DAG ERF type TYPE_COLOR_MC_HDLC_POS.
-	Basic BPF filtering support for DLT_MTP2_WITH_PHDR is also added.
-        check for IPv4 and IPv6, even for DLT_RAW 
-	add support for DLT_JUNIPER_ISM
-  	Pick up changes from NetBSD: many from tron, christos, drochner
-	Allocate DLT_ for 802.15.4 without any header munging, for Mikko Saarnivala.
-	Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header
-
-Wed.	April 25, 2007. ken@xelerance.com.  Summary for 0.9.6 libpcap release
+@(#) $Header: /tcpdump/master/libpcap/CHANGES,v 1.67.2.4 2008-10-28 00:27:42 ken Exp $ (LBL)
+
+Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 1.0.0 libpcap release
+	Compile with IPv6 support by default
+	Compile with large file support on by default
+	Add pcap-config script, which deals with -I/-L flags for compiling
+	DLT: Add IPMB
+	DLT: Add LAPD
+	DLT: Add AX25 (AX.25 w/KISS header)
+	DLT: Add JUNIPER_ST
+	802.15.4 support
+	Variable length 802.11 header support
+	X2E data type support 
+	SITA ACN Interface support - see README.sita
+	Support for zerocopy BPF on platforms that support it
+	Better support for dealing with VLAN tagging/stripping on Linux
+	Fix dynamic library support on OSX
+	Return PCAP_ERROR_IFACE_NOT_UP if the interface isn't 'UP', so applications
+	 can print better diagnostic information
+	Return PCAP_ERROR_PERM_DENIED if we don't have permission to open a device, so
+	 applications can tell the user they need to go play with permissions
+	On Linux, ignore ENETDOWN so we can continue to capture packets if the 
+	 interface goes down and comes back up again.
+	On Linux, support new tpacket frame headers (2.6.27+)
+	On Mac OS X, add scripts for changing permissions on /dev/pbf* and launchd plist
+	On Solaris, support 'passive mode' on systems that support it
+	Fixes to autoconf and general build environment
+	Man page reorganization + cleanup
+	Autogenerate VERSION numbers better
+
+Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 0.9.8 libpcap release
+        Change build process to put public libpcap headers into pcap subir
+        DLT: Add value for IPMI IPMB packets
+        DLT: Add value for u10 Networks boards
+        Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 
+         libpcap files on an OS other than where the file was generated
+
+Wed.	April 25, 2007.  ken@xelerance.com.  Summary for 0.9.6 libpcap release
 
 	Put the public libpcap headers into a pcap subdirectory in both the
 	 source directory and the target include directory, and have include
diff --git a/contrib/libpcap/CREDITS b/contrib/libpcap/CREDITS
index 2e54aab..2cd7207 100644
--- a/contrib/libpcap/CREDITS
+++ b/contrib/libpcap/CREDITS
@@ -1,108 +1,126 @@
 This file lists people who have contributed to libpcap:
 
 The current maintainers:
-	Bill Fenner			<fenner@research.att.com>
-	Fulvio Risso			<risso@polito.it>
-	Guy Harris	 		<guy@alum.mit.edu>
-	Hannes Gredler			<hannes@juniper.net>
-	Jun-ichiro itojun Hagino	<itojun@iijlab.net>
-	Michael Richardson	 	<mcr@sandelman.ottawa.on.ca>
+	Bill Fenner			<fenner at research dot att dot com>
+	Fulvio Risso			<risso at polito dot it>
+	Guy Harris	 		<guy at alum dot mit dot edu>
+	Hannes Gredler			<hannes at juniper dot net>
+	Michael Richardson	 	<mcr at sandelman dot ottawa dot on dot ca>
 
 Additional people who have contributed patches:
 
-	Alan Bawden			<Alan@LCS.MIT.EDU>
-	Alexey Kuznetsov		<kuznet@ms2.inr.ac.ru>
-	Albert Chin			<china@thewrittenword.com>
-	Andrew Brown			<atatat@atatdot.net>
-	Antti Kantee			<pooka@netbsd.org>
-	Arkadiusz Miskiewicz		<misiek@pld.org.pl>
-	Armando L. Caro Jr.		<acaro@mail.eecis.udel.edu>
-	Assar Westerlund	 	<assar@sics.se>
-	Brian Ginsbach			<ginsbach@cray.com>
-	Charles M. Hannum		<mycroft@netbsd.org>
-	Chris G. Demetriou		<cgd@netbsd.org>
-	Chris Lightfoot			<cwrl@users.sourceforge.net>
-	Chris Pepper			<pepper@mail.reppep.com>
-	Daniele Orlandi			<daniele@orlandi.com>
-	Darren Reed			<darrenr@reed.wattle.id.au>
-	David Kaelbling			<drk@sgi.com>
-	David Young			<dyoung@ojctech.com>
-	Dean Gaudet			<dean@arctic.org>
-	Don Ebright			<Don.Ebright@compuware.com> 
-	Dug Song			<dugsong@monkey.org>
-	Eric Anderson			<anderse@hpl.hp.com>
-        Erik de Castro Lopo             <erik.de.castro.lopo@sensorynetworks.com>
-	Florent Drouin			<Florent.Drouin@alcatel-lucent.fr>
-	Franz Schaefer			<schaefer@mond.at>
-	Gianluca Varenni		<varenni@netgroup-serv.polito.it>
-	Gilbert Hoyek			<gil_hoyek@hotmail.com>
-	Gisle Vanem			<giva@bgnett.no>
-	Graeme Hewson			<ghewson@cix.compulink.co.uk>
-	Greg Stark			<gsstark@mit.edu>
-	Greg Troxel			<gdt@ir.bbn.com>
-	Guillaume Pelat			<endymion_@users.sourceforge.net>
-	Hyung Sik Yoon			<hsyn@kr.ibm.com>
-	Igor Khristophorov		<igor@atdot.org>
-	Jan-Philip Velders		<jpv@veldersjes.net>
-	Jason R. Thorpe			<thorpej@netbsd.org>
-	Javier Achirica			<achirica@ttd.net>
-	Jean Tourrilhes			<jt@hpl.hp.com>
-	Jefferson Ogata			<jogata@nodc.noaa.gov>
-	Jesper Peterson			<jesper@endace.com>
-	John Bankier			<jbankier@rainfinity.com>
-	Jon Lindgren			<jonl@yubyub.net>
-	Juergen Schoenwaelder		<schoenw@ibr.cs.tu-bs.de>
-	Jung-uk Kim			<jkim@FreeBSD.org>
-	Kazushi Sugyo			<sugyo@pb.jp.nec.com>
-	Klaus Klein			<kleink@netbsd.org>
-	Koryn Grant			<koryn@endace.com>
-	Krzysztof Halasa		<khc@pm.waw.pl>
-	Lorenzo Cavallaro		<sullivan@sikurezza.org>
-	Loris Degioanni			<loris@netgroup-serv.polito.it>
-	Love H�rnquist-�strand		<lha@stacken.kth.se>
-	Maciej W. Rozycki		<macro@ds2.pg.gda.pl>
-	Marcus Felipe Pereira		<marcus@task.com.br>
-	Mark C. Brown			<mbrown@hp.com>
-	Mark Pizzolato			<List-tcpdump-workers@subscriptions.pizzolato.net>
-	Martin Husemann			<martin@netbsd.org>
-	Matthew Luckie			<mjl@luckie.org.nz>
-	Max Laier			<max@love2party.net>
-	Mike Kershaw			<dragorn@kismetwireless.net>
-	Mike Wiacek			<mike@iroot.net>
-	Monroe Williams			<monroe@pobox.com>
-	Nicolas Dade			<ndade@nsd.dyndns.org>
-	Octavian Cerna			<tavy@ylabs.com>
-	Olaf Kirch			<okir@caldera.de>
-	Ollie Wild			<aaw@users.sourceforge.net>
-	Onno van der Linden		<onno@simplex.nl>
-	Patrick Marie			<mycroft@virgaria.org>
-	Paul Mundt			<lethal@linux-sh.org>
-	Pavel Kankovsky			<kan@dcit.cz>
-	Pawel Pokrywka			<publicpp@gmail.com>
-	Peter Fales			<peter@fales-lorenz.net>
-	Peter Jeremy			<peter.jeremy@alcatel.com.au>
-	Phil Wood			<cpw@lanl.gov>
-	Rafal Maszkowski		<rzm@icm.edu.pl>
-					<rcb-isis@users.sourceforge.net>
-	Rick Jones			<raj@cup.hp.com>
-	Scott Barron			<sb125499@ohiou.edu>
-	Scott Gifford			<sgifford@tir.com>
-	Sebastian Krahmer		<krahmer@cs.uni-potsdam.de>
-	Shaun Clowes			<delius@progsoc.uts.edu.au>
-	Solomon Peachy			<pizza@shaftnet.org>
-	Stefan Hudson			<hudson@mbay.net>
-	Stephen Donnelly		<stephen@endace.com>
-	Takashi Yamamoto		<yamt@mwd.biglobe.ne.jp>
-        Tanaka Shin-ya                  <zstanaka@archer.livedoor.com>
-	Tony Li				<tli@procket.com>
-	Torsten Landschoff	 	<torsten@debian.org>
-	Uns Lider			<unslider@miranda.org>
-	Uwe Girlich			<Uwe.Girlich@philosys.de>
-	Xianjie Zhang			<xzhang@cup.hp.com>
+	Alan Bawden			<Alan at LCS dot MIT dot EDU>
+	Alexander 'Leo' Bergolth	<Leo dot Bergolth at wu-wien dot ac dot at>
+	Alexey Kuznetsov		<kuznet at ms2 dot inr dot ac dot ru>
+	Albert Chin			<china at thewrittenword dot com>
+	Andrew Brown			<atatat at atatdot dot net>
+	Antti Kantee			<pooka at netbsd dot org>
+	Arien Vijn			<arienvijn at sourceforge dot net>
+	Arkadiusz Miskiewicz		<misiek at pld dot org dot pl>
+	Armando L. Caro Jr.		<acaro at mail dot eecis dot udel dot edu>
+	Assar Westerlund	 	<assar at sics dot se>
+	Brian Ginsbach			<ginsbach at cray dot com>
+	Charles M. Hannum		<mycroft at netbsd dot org>
+	Chris G. Demetriou		<cgd at netbsd dot org>
+	Chris Lightfoot			<cwrl at users dot sourceforge dot net>
+	Chris Pepper			<pepper at mail dot reppep dot com>
+	Christian Peron			<csjp at freebsd dot org>
+	Daniele Orlandi			<daniele at orlandi dot com>
+	Darren Reed			<darrenr at reed dot wattle dot id dot au>
+	David Kaelbling			<drk at sgi dot com>
+	David Young			<dyoung at ojctech dot com>
+	Dean Gaudet			<dean at arctic dot org>
+	Don Ebright			<Don dot Ebright at compuware dot com> 
+	Dug Song			<dugsong at monkey dot org>
+	Eric Anderson			<anderse at hpl dot hp dot com>
+	Erik de Castro Lopo		<erik dot de dot castro dot lopo at sensorynetworks dot com>
+	Florent Drouin			<Florent dot Drouin at alcatel-lucent dot fr>
+	Franz Schaefer			<schaefer at mond dot at>
+	Fulko Hew			<fulko dot hew at gmail dot com>
+	Gianluca Varenni		<varenni at netgroup-serv dot polito dot it>
+	Gilbert Hoyek			<gil_hoyek at hotmail dot com>
+	Gisle Vanem			<gvanem at broadpark dot no>
+	Gisle Vanem			<giva at bgnett dot no>
+	Graeme Hewson			<ghewson at cix dot compulink dot co dot uk>
+	Greg Stark			<gsstark at mit dot edu>
+	Greg Troxel			<gdt at ir dot bbn dot com>
+	Gregor Maier			<gregor at net dot in dot tum dot de>
+	Guillaume Pelat			<endymion_ at users dot sourceforge dot net>
+	Hagen Paul Pfeifer		<hagen at jauu dot net>
+	Hyung Sik Yoon			<hsyn at kr dot ibm dot com>
+	Igor Khristophorov		<igor at atdot dot org>
+	Jan-Philip Velders		<jpv at veldersjes dot net>
+	Jason R. Thorpe			<thorpej at netbsd dot org>
+	Javier Achirica			<achirica at ttd dot net>
+	Jean Tourrilhes			<jt at hpl dot hp dot com>
+	Jefferson Ogata			<jogata at nodc dot noaa dot gov>
+	Jesper Peterson			<jesper at endace dot com>
+	Joerg Mayer			<jmayer at loplof dot de>
+	John Bankier			<jbankier at rainfinity dot com>
+	Jon Lindgren			<jonl at yubyub dot net>
+	Juergen Schoenwaelder		<schoenw at ibr dot cs dot tu-bs dot de>
+	Jung-uk Kim			<jkim at FreeBSD dot org>
+	Kazushi Sugyo			<sugyo at pb dot jp dot nec dot com>
+	Klaus Klein			<kleink at netbsd dot org>
+	Koryn Grant			<koryn at endace dot com>
+	Kris Katterjohn			<katterjohn at gmail dot com>
+	Krzysztof Halasa		<khc at pm dot waw dot pl>
+	Lorenzo Cavallaro		<sullivan at sikurezza dot org>
+	Loris Degioanni			<loris at netgroup-serv dot polito dot it>
+	Love H�rnquist-�strand		<lha at stacken dot kth dot se>
+	Luis Martin Garcia		<luis dot mgarc at gmail dot com>
+	Maciej W. Rozycki		<macro at ds2 dot pg dot gda dot pl>
+	Marcus Felipe Pereira		<marcus at task dot com dot br>
+	Mark C. Brown			<mbrown at hp dot com>
+	Mark Pizzolato			<List-tcpdump-workers at subscriptions dot pizzolato dot net>
+	Martin Husemann			<martin at netbsd dot org>
+	Matthew Luckie			<mjl at luckie dot org dot nz>
+	Max Laier			<max at love2party dot net>
+	Mike Frysinger			<vapier at gmail dot com>
+	Mike Kershaw			<dragorn at kismetwireless dot net>
+	Mike Wiacek			<mike at iroot dot net>
+	Monroe Williams			<monroe at pobox dot com>
+	Nicolas Dade			<ndade at nsd dot dyndns dot org>
+	Octavian Cerna			<tavy at ylabs dot com>
+	Olaf Kirch			<okir at caldera dot de>
+	Ollie Wild			<aaw at users dot sourceforge dot net>
+	Onno van der Linden		<onno at simplex dot nl>
+	Paolo Abeni			<paolo dot abeni at email dot it>
+	Patrick Marie			<mycroft at virgaria dot org>
+	Patrick McHardy			<kaber at trash not net>
+	Paul Mundt			<lethal at linux-sh dot org>
+	Pavel Kankovsky			<kan at dcit dot cz>
+	Pawel Pokrywka			<publicpp at gmail dot com>
+	Peter Fales			<peter at fales-lorenz dot net>
+	Peter Jeremy			<peter dot jeremy at alcatel dot com dot au>
+	Phil Wood			<cpw at lanl dot gov>
+	Rafal Maszkowski		<rzm at icm dot edu dot pl>
+					<rcb-isis at users dot sourceforge dot net>
+	Richard Stearn			<richard at rns-stearn dot demon dot co dot uk>
+	Rick Jones			<raj at cup dot hp dot com>
+	Sagun Shakya			<sagun dot shakya at sun dot com>
+	Scott Barron			<sb125499 at ohiou dot edu>
+	Scott Gifford			<sgifford at tir dot com>
+	Sebastian Krahmer		<krahmer at cs dot uni-potsdam dot de>
+	Sepherosa Ziehau		<sepherosa at gmail dot com>
+	Shaun Clowes			<delius at progsoc dot uts dot edu dot au>
+	Solomon Peachy			<pizza at shaftnet dot org>
+	Stefan Hudson			<hudson at mbay dot net>
+	Stephen Donnelly		<stephen at endace dot com>
+	Takashi Yamamoto		<yamt at mwd dot biglobe dot ne dot jp>
+	Tanaka Shin-ya			<zstanaka at archer dot livedoor dot com>
+	Tony Li				<tli at procket dot com>
+	Torsten Landschoff	 	<torsten at debian dot org>
+	Uns Lider			<unslider at miranda dot org>
+	Uwe Girlich			<Uwe dot Girlich at philosys dot de>
+	Xianjie Zhang			<xzhang at cup dot hp dot com>
 	Yen Yen Lim
-	Yoann Vandoorselaere		<yoann@prelude-ids.org>
+	Yoann Vandoorselaere		<yoann at prelude-ids dot org>
 
 The original LBL crew:
 	Steve McCanne
 	Craig Leres
 	Van Jacobson
+
+Past maintainers:
+	Jun-ichiro itojun Hagino	<itojun at iijlab dot net>
diff --git a/contrib/libpcap/FILES b/contrib/libpcap/FILES
deleted file mode 100644
index 68c204a..0000000
--- a/contrib/libpcap/FILES
+++ /dev/null
@@ -1,124 +0,0 @@
-CHANGES
-ChmodBPF/ChmodBPF
-ChmodBPF/StartupParameters.plist
-CREDITS
-FILES
-INSTALL.txt
-LICENSE
-Makefile.in
-README
-README.aix
-README.dag
-README.hpux
-README.linux
-README.macosx
-README.septel
-README.tru64
-README.Win32
-SUNOS4/nit_if.o.sparc
-SUNOS4/nit_if.o.sun3
-SUNOS4/nit_if.o.sun4c.4.0.3c
-TODO
-VERSION
-acconfig.h
-aclocal.m4
-arcnet.h
-atmuni31.h
-bpf/net/bpf_filter.c
-bpf_dump.c
-bpf_image.c
-config.guess
-config.h.in
-config.sub
-configure
-configure.in
-etherent.c
-ethertype.h
-fad-getad.c
-fad-gifc.c
-fad-glifc.c
-fad-null.c
-fad-win32.c
-gencode.c
-gencode.h
-grammar.y
-inet.c
-install-sh
-lbl/os-aix4.h
-lbl/os-hpux11.h
-lbl/os-osf4.h
-lbl/os-osf5.h
-lbl/os-solaris2.h
-lbl/os-sunos4.h
-lbl/os-ultrix4.h
-llc.h
-missing/snprintf.c
-mkdep
-msdos/bin2c.c
-msdos/common.dj
-msdos/makefile
-msdos/makefile.dj
-msdos/makefile.wc
-msdos/ndis2.c
-msdos/ndis2.h
-msdos/ndis_0.asm
-msdos/pkt_rx0.asm
-msdos/pkt_rx1.s
-msdos/pktdrvr.c
-msdos/pktdrvr.h
-msdos/readme.dos
-nametoaddr.c
-nlpid.h
-optimize.c
-packaging/pcap.spec
-packaging/pcap.spec.in
-pcap-bpf.c
-pcap-bpf.h
-pcap-dag.c
-pcap-dag.h
-pcap-dlpi.c
-pcap-dos.c
-pcap-dos.h
-pcap-enet.c
-pcap-int.h
-pcap-linux.c
-pcap-namedb.h
-pcap-nit.c
-pcap-nit.h
-pcap-null.c
-pcap-pf.c
-pcap-pf.h
-pcap-septel.c
-pcap-septel.h
-pcap-stdinc.h
-pcap-snit.c
-pcap-snoop.c
-pcap-win32.c
-pcap.3
-pcap.c
-pcap.h
-ppp.h
-savefile.c
-scanner.l
-sll.h
-sunatmpos.h
-Win32/Include/Gnuc.h
-Win32/Include/addrinfo.h
-Win32/Include/bittypes.h
-Win32/Include/cdecl_ext.h
-Win32/Include/inetprivate.h
-Win32/Include/ip6_misc.h
-Win32/Include/sockstorage.h
-Win32/Include/arpa/nameser.h
-Win32/Include/net/if.h
-Win32/Include/net/netdb.h
-Win32/Include/net/paths.h
-Win32/Src/ffs.c
-Win32/Src/getaddrinfo.c
-Win32/Src/getnetbynm.c
-Win32/Src/getnetent.c
-Win32/Src/getopt.c
-Win32/Src/getservent.c
-Win32/Src/inet_aton.c
-Win32/Src/inet_net.c
-Win32/Src/inet_pton.c
diff --git a/contrib/libpcap/INSTALL.txt b/contrib/libpcap/INSTALL.txt
index 76445a7..c7cfd22 100644
--- a/contrib/libpcap/INSTALL.txt
+++ b/contrib/libpcap/INSTALL.txt
@@ -1,4 +1,4 @@
-@(#) $Header: /tcpdump/master/libpcap/INSTALL.txt,v 1.12.2.2 2007/09/12 19:17:24 guy Exp $ (LBL)
+@(#) $Header: /tcpdump/master/libpcap/INSTALL.txt,v 1.21.2.8 2008-06-12 20:25:38 guy Exp $ (LBL)
 
 To build libpcap, run "./configure" (a shell script). The configure
 script will determine your system attributes and generate an
@@ -211,8 +211,7 @@ Read the README.aix file for information on installing libpcap and
 configuring your system to be able to support libpcap.
 
 If you use NeXTSTEP, you will not be able to build libpcap from this
-release. We hope to support this operating system in some future
-release of libpcap.
+release.
 
 If you use SINIX, you should be able to build libpcap from this
 release. It is known to compile and run on SINIX-Y/N 5.42 with the C-DS
@@ -229,22 +228,22 @@ Another workaround is to use flex and bison.
 
 If you use SCO, you might have trouble building libpcap from this
 release. We do not have a machine running SCO and have not had reports
-of anyone successfully building on it. Since SCO apparently supports
-DLPI, it's possible the current version works. Meanwhile, SCO provides
-a tcpdump binary as part of their "Network/Security Tools" package:
-
-    http://www.sco.com/technology/internet/goodies/#SECURITY
-
-There is also a README that explains how to enable packet capture.
-
-If you use UnixWare, you will not be able to build libpcap from this
-release. We hope to support this operating system in some future
-release of libpcap. Meanwhile, there appears to be an UnixWare port of
-libpcap 0.0 (and tcpdump 3.0) in:
-
-    ftp://ftp1.freebird.org/pub/mirror/freebird/internet/systools/
-
-UnixWare appears to use a hacked version of DLPI.
+of anyone successfully building on it; the current release of libpcap
+does not compile on SCO OpenServer 5.  Although SCO apparently supports
+DLPI to some extent, the DLPI in OpenServer 5 is very non-standard, and
+it appears that completely new code would need to be written to capture
+network traffic.  SCO do not appear to provide tcpdump binaries for
+OpenServer 5 or OpenServer 6 as part of SCO Skunkware:
+
+	http://www.sco.com/skunkware/
+
+If you use UnixWare, you might be able to build libpcap from this
+release, or you might not.  We do not have a machine running UnixWare,
+so we have not tested it; however, SCO provide packages for libpcap
+0.6.2 and tcpdump 3.7.1 in the UnixWare 7/Open UNIX 8 part of SCO
+Skunkware, and the source package for libpcap 0.6.2 is not changed from
+the libpcap 0.6.2 source release, so this release of libpcap might also
+build without changes on UnixWare 7.
 
 If linking tcpdump fails with "Undefined: _alloca" when using bison on
 a Sun4, your version of bison is broken. In any case version 1.16 or
@@ -298,7 +297,6 @@ CHANGES		- description of differences between releases
 ChmodBPF/*	- Mac OS X startup item to set ownership and permissions
 		  on /dev/bpf*
 CREDITS		- people that have helped libpcap along
-FILES		- list of files exported as part of the distribution
 INSTALL.txt	- this file
 LICENSE		- the license under which tcpdump is distributed
 Makefile.in	- compilation rules (input to the configure script)
@@ -309,6 +307,7 @@ README.hpux	- notes on using libpcap on HP-UX
 README.linux	- notes on using libpcap on Linux
 README.macosx	- notes on using libpcap on Mac OS X
 README.septel   - notes on using libpcap to capture on Intel/Septel devices
+README.sita	- notes on using libpcap to capture on SITA devices
 README.tru64	- notes on using libpcap on Digital/Tru64 UNIX
 README.Win32	- notes on using libpcap on Win32 systems (with WinPcap)
 SUNOS4		- pre-SunOS 4.1 replacement kernel nit modules
@@ -326,16 +325,22 @@ config.h.in	- autoconf input
 config.sub	- autoconf support
 configure	- configure script (run this first)
 configure.in	- configure script source
+dlpisubs.c	- DLPI-related functions for pcap-dlpi.c and pcap-libdlpi.c
+dlpisubs.h	- DLPI-related function declarations
 etherent.c	- /etc/ethers support routines
 ethertype.h	- Ethernet protocol types and names definitions
 fad-getad.c	- pcap_findalldevs() for systems with getifaddrs()
 fad-gifc.c	- pcap_findalldevs() for systems with only SIOCGIFLIST
 fad-glifc.c	- pcap_findalldevs() for systems with SIOCGLIFCONF
 fad-null.c	- pcap_findalldevs() for systems without capture support
+fad-sita.c	- pcap_findalldevs() for systems with SITA support
 fad-win32.c	- pcap_findalldevs() for WinPcap
+filtertest.c	- test program for BPF compiler
+findalldevstest.c - test program for pcap_findalldevs()
 gencode.c	- BPF code generation routines
 gencode.h	- BPF code generation definitions
 grammar.y	- filter string grammar
+ieee80211.h	- 802.11 definitions
 inet.c		- network routines
 install-sh	- BSD style install script
 lbl/os-*.h	- OS-dependent defines and prototypes
@@ -348,8 +353,16 @@ nlpid.h		- OSI network layer protocol identifier definitions
 net		- symlink to bpf/net
 optimize.c	- BPF optimization routines
 packaging	- packaging information for building libpcap RPMs
+pcap/bluetooth.h - public definition of DLT_BLUETOOTH_HCI_H4_WITH_PHDR header
+pcap/bpf.h	- BPF definitions
+pcap/namedb.h	- public libpcap name database definitions
+pcap/pcap.h	- public libpcap definitions
+pcap/sll.h	- public definition of DLT_LINUX_SLL header
+pcap/usb.h	- public definition of DLT_USB header
 pcap-bpf.c	- BSD Packet Filter support
-pcap-bpf.h	- BPF definitions
+pcap-bpf.h	- header for backwards compatibility
+pcap-bt-linux.c	- Bluetooth capture support for Linux
+pcap-bt-linux.h	- Bluetooth capture support for Linux
 pcap-dag.c	- Endace DAG device capture support
 pcap-dag.h	- Endace DAG device capture support
 pcap-dlpi.c	- Data Link Provider Interface support
@@ -357,26 +370,34 @@ pcap-dos.c	- MS-DOS capture support
 pcap-dos.h	- headers for MS-DOS capture support
 pcap-enet.c	- enet support
 pcap-int.h	- internal libpcap definitions
+pcap-libdlpi.c	- Data Link Provider Interface support for systems with libdlpi
 pcap-linux.c	- Linux packet socket support
-pcap-namedb.h	- public libpcap name database definitions
+pcap-namedb.h	- header for backwards compatibility
 pcap-nit.c	- SunOS Network Interface Tap support
 pcap-nit.h	- SunOS Network Interface Tap definitions
 pcap-null.c	- dummy monitor support (allows offline use of libpcap)
 pcap-pf.c	- Ultrix and Digital/Tru64 UNIX Packet Filter support
 pcap-pf.h	- Ultrix and Digital/Tru64 UNIX Packet Filter definitions
-pcap-septel.c   - INTEL/Septel device capture support
-pcap-septel.h   - INTEL/Septel device capture support
+pcap-septel.c   - Intel/Septel device capture support
+pcap-septel.h   - Intel/Septel device capture support
+pcap-sita.c	- SITA device capture support
+pcap-sita.h	- SITA device capture support
+pcap-sita.html	- SITA device capture documentation
 pcap-stdinc.h	- includes and #defines for compiling on Win32 systems
 pcap-snit.c	- SunOS 4.x STREAMS-based Network Interface Tap support
 pcap-snoop.c	- IRIX Snoop network monitoring support
+pcap-usb-linux.c - USB capture support for Linux
+pcap-usb-linux.h - USB capture support for Linux
 pcap-win32.c	- WinPcap capture support
-pcap.3		- manual entry
+pcap.3pcap	- manual entry for the library
 pcap.c		- pcap utility routines
-pcap.h		- public libpcap definitions
+pcap.h		- header for backwards compatibility
+pcap_*.3pcap	- manual entries for library functions
+pcap-filter.4	- manual entry for filter syntax
+pcap-linktype.4	- manual entry for link-layer header types
 ppp.h		- Point to Point Protocol definitions
-rawss7.h	- information on DLT_ types for SS7
+runlex.sh	- wrapper for Lex/Flex
 savefile.c	- offline support
 scanner.l	- filter string scanner
-sll.h		- definitions for Linux cooked mode fake link-layer header
 sunatmpos.h	- definitions for SunATM capturing
 Win32		- headers and routines for building on Win32 systems
diff --git a/contrib/libpcap/Makefile.in b/contrib/libpcap/Makefile.in
index 98396ec..5c4d679 100644
--- a/contrib/libpcap/Makefile.in
+++ b/contrib/libpcap/Makefile.in
@@ -17,7 +17,7 @@
 #  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 #  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 #
-# @(#) $Header: /tcpdump/master/libpcap/Makefile.in,v 1.99.2.2 2007/07/24 02:35:15 mcr Exp $ (LBL)
+# @(#) $Header: /tcpdump/master/libpcap/Makefile.in,v 1.108.2.28 2008-10-23 22:13:21 guy Exp $ (LBL)
 
 #
 # Various configurable paths (remember to edit Makefile.in, not Makefile)
@@ -26,11 +26,14 @@
 # Top level hierarchy
 prefix = @prefix@
 exec_prefix = @exec_prefix@
+datarootdir = @datarootdir@
+# Pathname of directory to install the configure program
+bindir = @bindir@
 # Pathname of directory to install the include files
 includedir = @includedir@
 # Pathname of directory to install the library
 libdir =  @libdir@
-# Pathname of directory to install the man page
+# Pathname of directory to install the man pages
 mandir = @mandir@
 
 # VPATH
@@ -47,6 +50,7 @@ INCLS = -I. @V_INCLS@
 DEFS = @DEFS@ @V_DEFS@
 LIBS = @V_LIBS@
 DAGLIBS = @DAGLIBS@
+DEPLIBS = @DEPLIBS@
 DYEXT = @DYEXT@
 PROG=libpcap
 
@@ -73,7 +77,7 @@ YACC = @V_YACC@
 	@rm -f $@
 	$(CC) $(CFLAGS) -c $(srcdir)/$*.c
 
-PSRC =	pcap-@V_PCAP@.c
+PSRC =	pcap-@V_PCAP@.c @USB_SRC@ @BT_SRC@
 FSRC =  fad-@V_FINDALLDEVS@.c
 SSRC =  @SSRC@
 CSRC =	pcap.c inet.c gencode.c optimize.c nametoaddr.c \
@@ -86,10 +90,31 @@ SRC =	$(PSRC) $(FSRC) $(CSRC) $(SSRC) $(GENSRC)
 # We would like to say "OBJ = $(SRC:.c=.o)" but Ultrix's make cannot
 # hack the extra indirection
 OBJ =	$(PSRC:.c=.o) $(FSRC:.c=.o) $(CSRC:.c=.o) $(SSRC:.c=.o) $(GENSRC:.c=.o) $(LIBOBJS)
-HDR =	pcap.h pcap-int.h pcap-namedb.h pcap-nit.h pcap-pf.h \
-	ethertype.h gencode.h gnuc.h
+HDR = \
+	acconfig.h \
+	arcnet.h \
+	atmuni31.h \
+	ethertype.h \
+	gencode.h \
+	ieee80211.h \
+	llc.h \
+	nlpid.h \
+	pcap/bluetooth.h \
+	pcap/bpf.h \
+	pcap/namedb.h \
+	pcap/pcap.h \
+	pcap/sll.h \
+	pcap/usb.h \
+	pcap/vlan.h \
+	pcap.h \
+	pcap-int.h \
+	pcap-namedb.h \
+	pcap-stdinc.h \
+	ppp.h \
+	sunatmpos.h
+
 GENHDR = \
-	tokdefs.h version.h
+	scanner.h tokdefs.h version.h
 
 TAGHDR = \
 	pcap-bpf.h
@@ -99,11 +124,198 @@ TAGFILES = \
 
 CLEANFILES = $(OBJ) libpcap.a $(GENSRC) $(GENHDR) lex.yy.c
 
-all: libpcap.a
+MAN1 = pcap-config.1
+
+MAN3PCAP_EXPAND = \
+	pcap.3pcap.in \
+	pcap_compile.3pcap.in \
+	pcap_datalink.3pcap.in \
+	pcap_dump_open.3pcap.in \
+	pcap_list_datalinks.3pcap.in \
+	pcap_open_dead.3pcap.in \
+	pcap_open_offline.3pcap.in
+
+MAN3PCAP_NOEXPAND = \
+	pcap_activate.3pcap \
+	pcap_breakloop.3pcap \
+	pcap_can_set_rfmon.3pcap \
+	pcap_close.3pcap \
+	pcap_create.3pcap \
+	pcap_datalink_name_to_val.3pcap \
+	pcap_datalink_val_to_name.3pcap \
+	pcap_dump.3pcap \
+	pcap_dump_close.3pcap \
+	pcap_dump_file.3pcap \
+	pcap_dump_flush.3pcap \
+	pcap_dump_ftell.3pcap \
+	pcap_file.3pcap \
+	pcap_fileno.3pcap \
+	pcap_findalldevs.3pcap \
+	pcap_freealldevs.3pcap \
+	pcap_freecode.3pcap \
+	pcap_free_datalinks.3pcap \
+	pcap_get_selectable_fd.3pcap \
+	pcap_geterr.3pcap \
+	pcap_inject.3pcap \
+	pcap_is_swapped.3pcap \
+	pcap_lib_version.3pcap \
+	pcap_lookupdev.3pcap \
+	pcap_lookupnet.3pcap \
+	pcap_loop.3pcap \
+	pcap_major_version.3pcap \
+	pcap_next_ex.3pcap \
+	pcap_offline_filter.3pcap \
+	pcap_open_live.3pcap \
+	pcap_set_buffer_size.3pcap \
+	pcap_set_datalink.3pcap \
+	pcap_set_promisc.3pcap \
+	pcap_set_rfmon.3pcap \
+	pcap_set_snaplen.3pcap \
+	pcap_set_timeout.3pcap \
+	pcap_setdirection.3pcap \
+	pcap_setfilter.3pcap \
+	pcap_setnonblock.3pcap \
+	pcap_snapshot.3pcap \
+	pcap_stats.3pcap \
+	pcap_statustostr.3pcap \
+	pcap_strerror.3pcap
+
+MAN3PCAP = $(MAN3PCAP_NOEXPAND) $(MAN3PCAP_EXPAND:.in=)
+
+MANFILE = \
+	pcap-savefile.manfile.in
+
+MANMISC = \
+	pcap-filter.manmisc.in \
+	pcap-linktype.manmisc.in
+
+EXTRA_DIST = \
+	CHANGES \
+	ChmodBPF/ChmodBPF \
+	ChmodBPF/StartupParameters.plist \
+	CREDITS \
+	INSTALL.txt \
+	LICENSE \
+	Makefile.in \
+	README \
+	README.aix \
+	README.dag \
+	README.hpux \
+	README.linux \
+	README.macosx \
+	README.septel \
+	README.sita \
+	README.tru64 \
+	README.Win32 \
+	SUNOS4/nit_if.o.sparc \
+	SUNOS4/nit_if.o.sun3 \
+	SUNOS4/nit_if.o.sun4c.4.0.3c \
+	TODO \
+	VERSION \
+	aclocal.m4 \
+	bpf/net/bpf_filter.c \
+	chmod_bpf \
+	config.guess \
+	config.h.in \
+	config.sub \
+	configure \
+	configure.in \
+	dlpisubs.c \
+	dlpisubs.h \
+	fad-getad.c \
+	fad-gifc.c \
+	fad-glifc.c \
+	fad-null.c \
+	fad-sita.c \
+	fad-win32.c \
+	filtertest.c \
+	findalldevstest.c \
+	grammar.y \
+	install-sh \
+	lbl/os-aix4.h \
+	lbl/os-hpux11.h \
+	lbl/os-osf4.h \
+	lbl/os-osf5.h \
+	lbl/os-solaris2.h \
+	lbl/os-sunos4.h \
+	lbl/os-ultrix4.h \
+	missing/snprintf.c \
+	mkdep \
+	msdos/bin2c.c \
+	msdos/common.dj \
+	msdos/makefile \
+	msdos/makefile.dj \
+	msdos/makefile.wc \
+	msdos/ndis2.c \
+	msdos/ndis2.h \
+	msdos/ndis_0.asm \
+	msdos/pkt_rx0.asm \
+	msdos/pkt_rx1.s \
+	msdos/pktdrvr.c \
+	msdos/pktdrvr.h \
+	msdos/readme.dos \
+	net/bpf_filter.c \
+	org.tcpdump.chmod_bpf.plist \
+	packaging/pcap.spec.in \
+	pcap-bpf.c \
+	pcap-bpf.h \
+	pcap-bt-linux.c \
+	pcap-bt-linux.h \
+	pcap-config.in \
+	pcap-dag.c \
+	pcap-dag.h \
+	pcap-dlpi.c \
+	pcap-dos.c \
+	pcap-dos.h \
+	pcap-enet.c \
+	pcap-int.h \
+	pcap-libdlpi.c \
+	pcap-linux.c \
+	pcap-namedb.h \
+	pcap-nit.c \
+	pcap-null.c \
+	pcap-pf.c \
+	pcap-septel.c \
+	pcap-septel.h \
+	pcap-sita.h \
+	pcap-sita.c \
+	pcap-sita.html \
+	pcap-snit.c \
+	pcap-snoop.c \
+	pcap-usb-linux.c \
+	pcap-usb-linux.h \
+	pcap-win32.c \
+	runlex.sh \
+	scanner.l \
+	Win32/Include/Gnuc.h \
+	Win32/Include/addrinfo.h \
+	Win32/Include/bittypes.h \
+	Win32/Include/cdecl_ext.h \
+	Win32/Include/inetprivate.h \
+	Win32/Include/ip6_misc.h \
+	Win32/Include/sockstorage.h \
+	Win32/Include/arpa/nameser.h \
+	Win32/Include/net/if.h \
+	Win32/Include/net/netdb.h \
+	Win32/Include/net/paths.h \
+	Win32/Prj/libpcap.dsp \
+	Win32/Prj/libpcap.dsw \
+	Win32/Src/ffs.c \
+	Win32/Src/gai_strerror.c \
+	Win32/Src/getaddrinfo.c \
+	Win32/Src/getnetbynm.c \
+	Win32/Src/getnetent.c \
+	Win32/Src/getopt.c \
+	Win32/Src/getservent.c \
+	Win32/Src/inet_aton.c \
+	Win32/Src/inet_net.c \
+	Win32/Src/inet_pton.c
+
+all: libpcap.a pcap-config
 
 libpcap.a: $(OBJ)
 	@rm -f $@
-	ar rc $@ $(OBJ) $(LIBS)
+	$(AR) rc $@ $(OBJ) $(LIBS)
 	$(RANLIB) $@
 
 shared: libpcap.$(DYEXT)
@@ -114,19 +326,27 @@ shared: libpcap.$(DYEXT)
 #
 libpcap.so: $(OBJ)
 	@rm -f $@
-	$(CC) -shared -o $@.`cat VERSION` $(OBJ) $(DAGLIBS)
+	$(CC) -shared -Wl,-soname,$@.1 -o $@.`cat $(srcdir)/VERSION` $(OBJ) $(DAGLIBS)
 
-# the following rule succeeds, but the result is untested.
+#
+# The following rule succeeds, but the result is untested.
+#
+# XXX - OS X installs the library as "libpcap.A.dylib", with that as the
+# install_name, and sets the current version to 1 as well.  VERSION
+# might contain a not-purely-numeric version number, but
+# -current_version requires a purely numeric version, so this won't
+# work with top-of-tree builds.
+#
 libpcap.dylib: $(OBJ)
 	rm -f libpcap*.dylib
-	$(CC) -dynamiclib -undefined error -o libpcap.`cat VERSION`.dylib $(OBJ) \
-		-install_name $(libdir)/libpcap.0.dylib -compatibility_version `cat VERSION` \
-		-current_version `cat VERSION`
-
+	$(CC) -dynamiclib -undefined error -o libpcap.`cat $(srcdir)/VERSION`.dylib $(OBJ) \
+		-install_name $(libdir)/libpcap.A.dylib \
+		-compatibility_version 1 \
+		-current_version `sed 's/[^0-9.].*$$//' $(srcdir)/VERSION`
 
 scanner.c: $(srcdir)/scanner.l
 	@rm -f $@
-	$(LEX) -t $< > $$$$.$@; mv $$$$.$@ $@
+	./runlex.sh $(LEX) -o$@ $<
 
 scanner.o: scanner.c tokdefs.h
 	$(CC) $(CFLAGS) -c scanner.c
@@ -172,43 +392,135 @@ bpf_filter.c: $(srcdir)/bpf/net/bpf_filter.c
 bpf_filter.o: bpf_filter.c
 	$(CC) $(CFLAGS) -c bpf_filter.c
 
-install: libpcap.a 
+#
+# Generate the pcap-config script.
+#
+pcap-config: pcap-config.in Makefile
+	@rm -f $@ $@.tmp
+	sed -e 's|@includedir[@]|$(includedir)|g' \
+	    -e 's|@libdir[@]|$(libdir)|g' \
+	    -e 's|@DEPLIBS[@]|$(DEPLIBS)|g' \
+	    pcap-config.in >$@.tmp
+	mv $@.tmp $@
+	chmod a+x $@
+
+#
+# Test programs - not built by default, and not installed.
+#
+filtertest: filtertest.c libpcap.a
+	$(CC) $(CFLAGS) -I. -L. -o filtertest filtertest.c libpcap.a
+
+findalldevstest: findalldevstest.c libpcap.a
+	$(CC) $(CFLAGS) -I. -L. -o findalldevstest findalldevstest.c libpcap.a
+
+install: libpcap.a pcap-config
 	[ -d $(DESTDIR)$(libdir) ] || \
 	    (mkdir -p $(DESTDIR)$(libdir); chmod 755 $(DESTDIR)$(libdir))
 	$(INSTALL_DATA) libpcap.a $(DESTDIR)$(libdir)/libpcap.a
 	$(RANLIB) $(DESTDIR)$(libdir)/libpcap.a
 	[ -d $(DESTDIR)$(includedir) ] || \
 	    (mkdir -p $(DESTDIR)$(includedir); chmod 755 $(DESTDIR)$(includedir))
+	[ -d $(DESTDIR)$(includedir)/pcap ] || \
+	    (mkdir -p $(DESTDIR)$(includedir)/pcap; chmod 755 $(DESTDIR)$(includedir)/pcap)
+	[ -d $(DESTDIR)$(mandir)/man1 ] || \
+	    (mkdir -p $(DESTDIR)$(mandir)/man1; chmod 755 $(DESTDIR)$(mandir)/man1)
+	[ -d $(DESTDIR)$(mandir)/man3 ] || \
+	    (mkdir -p $(DESTDIR)$(mandir)/man3; chmod 755 $(DESTDIR)$(mandir)/man3)
+	[ -d $(DESTDIR)$(mandir)/man@MAN_FILE_FORMATS@ ] || \
+	    (mkdir -p $(DESTDIR)$(mandir)/man@MAN_FILE_FORMATS@; chmod 755 $(DESTDIR)$(mandir)/man@MAN_FILE_FORMATS@)
+	[ -d $(DESTDIR)$(mandir)/man@MAN_MISC_INFO@ ] || \
+	    (mkdir -p $(DESTDIR)$(mandir)/man@MAN_MISC_INFO@; chmod 755 $(DESTDIR)$(mandir)/man@MAN_MISC_INFO@)
+	$(INSTALL_DATA) $(srcdir)/pcap/pcap.h \
+	    $(DESTDIR)$(includedir)/pcap/pcap.h
+	$(INSTALL_DATA) $(srcdir)/pcap/bpf.h \
+	    $(DESTDIR)$(includedir)/pcap/bpf.h
+	$(INSTALL_DATA) $(srcdir)/pcap/namedb.h \
+	    $(DESTDIR)$(includedir)/pcap/namedb.h
+	$(INSTALL_DATA) $(srcdir)/pcap/sll.h \
+	    $(DESTDIR)$(includedir)/pcap/sll.h
+	$(INSTALL_DATA) $(srcdir)/pcap/usb.h \
+	    $(DESTDIR)$(includedir)/pcap/usb.h
 	$(INSTALL_DATA) $(srcdir)/pcap.h $(DESTDIR)$(includedir)/pcap.h
 	$(INSTALL_DATA) $(srcdir)/pcap-bpf.h \
 	    $(DESTDIR)$(includedir)/pcap-bpf.h
 	$(INSTALL_DATA) $(srcdir)/pcap-namedb.h \
 	    $(DESTDIR)$(includedir)/pcap-namedb.h
-	[ -d $(DESTDIR)$(mandir)/man3 ] || \
-		(mkdir -p $(DESTDIR)$(mandir)/man3; chmod 755 $(DESTDIR)$(mandir)/man3)
-	$(INSTALL_DATA) $(srcdir)/pcap.3 \
-	    $(DESTDIR)$(mandir)/man3/pcap.3
+	$(INSTALL_PROGRAM) pcap-config $(DESTDIR)$(bindir)/pcap-config
+	for i in $(MAN1); do \
+		$(INSTALL_DATA) $(srcdir)/$$i \
+		    $(DESTDIR)$(mandir)/man1/$$i; done
+	for i in $(MAN3PCAP); do \
+		$(INSTALL_DATA) $(srcdir)/$$i \
+		    $(DESTDIR)$(mandir)/man3/$$i; done
+	ln $(DESTDIR)$(mandir)/man3/pcap_datalink_val_to_name.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_datalink_val_to_description.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_dump_open.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_dump_fopen.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_geterr.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_perror.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_inject.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_sendpacket.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_loop.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_dispatch.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_major_version.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_minor_version.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_next_ex.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_next.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_open_offline.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_fopen_offline.3pcap
+	ln $(DESTDIR)$(mandir)/man3/pcap_setnonblock.3pcap \
+		 $(DESTDIR)$(mandir)/man3/pcap_getnonblock.3pcap
+	for i in $(MANFILE); do \
+		$(INSTALL_DATA) $(srcdir)/`echo $$i | sed 's/.manfile.in/.manfile/'` \
+		    $(DESTDIR)$(mandir)/man@MAN_FILE_FORMATS@/`echo $$i | sed 's/.manfile.in/.@MAN_FILE_FORMATS@/'`; done
+	for i in $(MANMISC); do \
+		$(INSTALL_DATA) $(srcdir)/`echo $$i | sed 's/.manmisc.in/.manmisc/'` \
+		    $(DESTDIR)$(mandir)/man@MAN_MISC_INFO@/`echo $$i | sed 's/.manmisc.in/.@MAN_MISC_INFO@/'`; done
 
 install-shared: install-shared-$(DYEXT)
 install-shared-so: libpcap.so
 	$(INSTALL_PROGRAM) libpcap.so.`cat VERSION` $(DESTDIR)$(libdir)/libpcap.so.`cat VERSION`
 install-shared-dylib: libpcap.dylib
 	$(INSTALL_PROGRAM) libpcap.`cat VERSION`.dylib $(DESTDIR)$(libdir)/libpcap.`cat VERSION`.dylib
-	VER=`cat VERSION`; cd $(DESTDIR)$(libdir) && ln -sf libpcap.$$VER.dylib libpcap.0.dylib;  ln -sf libpcap.0.dylib libpcap.dylib
+	VER=`cat VERSION`; cd $(DESTDIR)$(libdir) && ln -sf libpcap.$$VER.dylib libpcap.A.dylib;  ln -sf libpcap.A.dylib libpcap.dylib
 
 uninstall:
 	rm -f $(DESTDIR)$(libdir)/libpcap.a
+	rm -f $(DESTDIR)$(includedir)/pcap/pcap.h
+	rm -f $(DESTDIR)$(includedir)/pcap/bpf.h
+	rm -f $(DESTDIR)$(includedir)/pcap/namedb.h
+	rm -f $(DESTDIR)$(includedir)/pcap/sll.h
+	rm -f $(DESTDIR)$(includedir)/pcap/usb.h
+	-rmdir $(DESTDIR)$(includedir)/pcap
 	rm -f $(DESTDIR)$(includedir)/pcap.h
 	rm -f $(DESTDIR)$(includedir)/pcap-bpf.h
 	rm -f $(DESTDIR)$(includedir)/pcap-namedb.h
-	rm -f $(DESTDIR)$(mandir)/man3/pcap.3
+	for i in $(MAN1); do \
+		rm -f $(DESTDIR)$(mandir)/man1/$$i; done
+	for i in $(MAN3PCAP); do \
+		rm -f $(DESTDIR)$(mandir)/man3/$$i; done
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_datalink_val_to_description.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_dump_fopen.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_perror.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_sendpacket.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_dispatch.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_minor_version.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_next.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_fopen_offline.3pcap
+	rm -f  $(DESTDIR)$(mandir)/man3/pcap_getnonblock.3pcap
+	for i in $(MANFILE); do \
+		rm -f $(DESTDIR)$(mandir)/man@MAN_FILE_FORMATS@/`echo $$i | sed 's/.manfile.in/.@MAN_FILE_FORMATS@/'`; done
+	for i in $(MANMISC); do \
+		rm -f $(DESTDIR)$(mandir)/man@MAN_MISC_INFO@/`echo $$i | sed 's/.manmisc.in/.@MAN_MISC_INFO@/'`; done
 
 clean:
 	rm -f $(CLEANFILES) libpcap*.dylib libpcap.so*
 
 distclean: clean
 	rm -f Makefile config.cache config.log config.status \
-	    config.h gnuc.h os-proto.h bpf_filter.c stamp-h stamp-h.in
+	    config.h gnuc.h os-proto.h bpf_filter.c pcap-config \
+	    stamp-h stamp-h.in
+	rm -f $(MAN3PCAP_EXPAND:.in=) $(MANFILE:.in=) $(MANMISC:.in=)
 	rm -rf autom4te.cache
 
 tags: $(TAGFILES)
@@ -220,8 +532,12 @@ packaging/pcap.spec: packaging/pcap.spec.in VERSION
 
 releasetar:
 	@cwd=`pwd` ; dir=`basename $$cwd` ; name=$(PROG)-`cat VERSION` ; \
-	   list="" ; make distclean; cd ..; mkdir -p n; cd n; ln -s ../$$dir $$name; \
-	   tar -c -z -f $$name.tar.gz $$name/. ;
+	   mkdir $$name; \
+	   tar cf - $(CSRC) $(HDR) $(MAN1) $(MAN3PCAP_EXPAND) \
+	      $(MAN3PCAP_NOEXPAND) $(MANFILE) $(MANMISC) $(EXTRA_DIST) | \
+	      (cd $$name; tar xf -); \
+	   tar -c -z -f $$name.tar.gz $$name; \
+	   rm -rf $$name
 
 depend:	$(GENSRC) $(GENHDR) bpf_filter.c
 	./mkdep -c $(CC) $(DEFS) $(INCLS) $(SRC)
diff --git a/contrib/libpcap/README b/contrib/libpcap/README
index 90571a1..ee1a141 100644
--- a/contrib/libpcap/README
+++ b/contrib/libpcap/README
@@ -1,20 +1,22 @@
-@(#) $Header: /tcpdump/master/libpcap/README,v 1.30 2004/10/12 02:02:28 guy Exp $ (LBL)
+@(#) $Header: /tcpdump/master/libpcap/README,v 1.30.4.3 2008-10-17 10:39:20 ken Exp $ (LBL)
 
-LIBPCAP 0.9
-Now maintained by "The Tcpdump Group"
-See 		www.tcpdump.org
+LIBPCAP 1.0.0
 
-Please send inquiries/comments/reports to 	tcpdump-workers@tcpdump.org
+www.tcpdump.org
+
+Please send inquiries/comments/reports to:
+	tcpdump-workers@lists.tcpdump.org
 
 Anonymous CVS is available via:
 	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master login
 	(password "anoncvs")
 	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout libpcap
 
-Version 0.9 of LIBPCAP can be retrieved with the CVS tag "libpcap_0_9rel1":
-	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_0_9rel1 libpcap
+Version 1.0.0 of LIBPCAP can be retrieved with the CVS tag "libpcap_1_0":
+	cvs -d :pserver:tcpdump@cvs.tcpdump.org:/tcpdump/master checkout -r libpcap_1_0 libpcap
 
-Please send patches against the master copy to patches@tcpdump.org.
+Please submit patches against the master copy to the libpcap project on
+sourceforge.net.
 
 formerly from 	Lawrence Berkeley National Laboratory
 		Network Research Group <libpcap@ee.lbl.gov>
@@ -30,8 +32,6 @@ require this functionality, we've created this system-independent API
 to ease in porting and to alleviate the need for several
 system-dependent packet capture modules in each application.
 
-Note well: this interface is new and is likely to change.
-
 For some platforms there are README.{system} files that discuss issues
 with the OS's interface for packet capture on those platforms, such as
 how to enable support for that interface in the OS, if it's not built in
@@ -77,16 +77,28 @@ Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
 mechanism that accepts BPF filters; see the README.linux file for
 information on configuring that option.
 
+Note to Linux distributions and *BSD systems that include libpcap:
+
+There's now a rule to make a shared library, which should work on Linux 
+and *BSD (and OS X).
+
+It sets the soname of the library to "libpcap.so.1"; this is what it 
+should be, *NOT* libpcap.so.1.0 or libpcap.so.1.0.0 or something such as 
+that.
+
+We've been maintaining binary compatibility between libpcap releases for 
+quite a while; there's no reason to tie a binary linked with libpcap to 
+a particular release of libpcap.
+
 Problems, bugs, questions, desirable enhancements, etc. should be sent
-to the address "tcpdump-workers@tcpdump.org".  Bugs, support requests,
-and feature requests may also be submitted on the SourceForge site for
-libpcap at
+to the address "tcpdump-workers@lists.tcpdump.org".  Bugs, support
+requests, and feature requests may also be submitted on the SourceForge
+site for libpcap at
 
 	http://sourceforge.net/projects/libpcap/
 
 Source code contributions, etc. should be sent to the email address
-"patches@tcpdump.org", or submitted as patches on the SourceForge site
-for libpcap.
+submitted as patches on the SourceForge site for libpcap.
 
 Current versions can be found at www.tcpdump.org, or the SourceForge
 site for libpcap.
diff --git a/contrib/libpcap/README.Win32 b/contrib/libpcap/README.Win32
deleted file mode 100644
index 3116d5e..0000000
--- a/contrib/libpcap/README.Win32
+++ /dev/null
@@ -1,46 +0,0 @@
-Under Win32, libpcap is integrated in the WinPcap packet capture system. 
-WinPcap provides a framework that allows libpcap to capture the packets 
-under Windows 95, Windows 98, Windows ME, Windows NT 4, Windows 2000 
-and Windows XP.
-WinPcap binaries and source code can be found at http://winpcap.polito.it: 
-they include also a developer's pack with all the necessary to compile 
-libpcap-based applications under Windows.
-
-How to compile libpcap with Visual Studio
------------------------------------------
-
-In order to compile libpcap you will need:
-
-- version 6 (or higher) of Microsoft Visual Studio
-- The November 2001 (or later) edition of Microsoft Platform 
-Software Development Kit (SDK), that contains some necessary includes 
-for IPv6 support. You can download it from http://www.microsoft.com/sdk
-- the latest WinPcap sources from http://winpcap.polito.it/install 
-
-The WinPcap source code already contains a recent (usually the latest 
-stable) version of libpcap. If you need to compile a different one, 
-simply download it from www.tcpdump.org and copy the sources in the 
-winpcap\wpcap\libpcap folder of the WinPcap distribution. If you want to
-compile a libpcap source retrieved from the tcpdump.org CVS, you will 
-have to create the scanner and the grammar by hand (with lex and yacc) 
-or with the cygnus makefile, since The Visual Studio project is not able
-to build them.
-
-Open the project file winpcap\wpcap\prj\wpcap.dsw with Visual Studio and 
-build wpcap.dll. wpcap.lib, the library file to link with the applications, 
-will be generated in winpcap\wpcap\lib\. wpcap.dll will be generated in 
-winpcap\wpcap\prj\release or winpcap\wpcap\prj\debug depending on the type 
-of binary that is being created.
-
-How to compile libpcap with Cygnus
-----------------------------------
-
-To build wpcap.dll, cd to the directory WPCAP/PRJ of the WinPcap source code 
-distribution and type "make". libwpcap.a, the library file to link with the 
-applications, will be generated in winpcap\wpcap\lib\. wpcap.dll will be 
-generated in winpcap\wpcap\prj.
-
-Remember, you CANNOT use the MSVC-generated .lib files with gcc, use 
-libwpcap.a instead.
-
-"make install" installs wpcap.dll in the Windows system folder.
diff --git a/contrib/libpcap/README.aix b/contrib/libpcap/README.aix
deleted file mode 100644
index dcddb61..0000000
--- a/contrib/libpcap/README.aix
+++ /dev/null
@@ -1,78 +0,0 @@
-Using BPF:
-
-(1) AIX 4.x's version of BPF is undocumented and somewhat unstandard; the
-    current BPF support code includes changes that should work around
-    that; it appears to compile and work on at least one AIX 4.3.3
-    machine.
-
-    Note that the BPF driver and the "/dev/bpf" devices might not exist
-    on your machine; AIX's tcpdump loads the driver and creates the
-    devices if they don't already exist.  Our libpcap should do the
-    same, and the configure script should detect that it's on an AIX
-    system and choose BPF even if the devices aren't there.
-
-(2) If libpcap doesn't compile on your machine when configured to use
-    BPF, or if the workarounds fail to make it work correctly, you
-    should send to tcpdump-workers@tcpdump.org a detailed bug report (if
-    the compile fails, send us the compile error messages; if it
-    compiles but fails to work correctly, send us as detailed as
-    possible a description of the symptoms, including indications of the
-    network link-layer type being wrong or time stamps being wrong).
-
-    If you fix the problems yourself, please send to patches@tcpdump.org
-    a patch, so we can incorporate them into the next release.
-
-    If you don't fix the problems yourself, you can, as a workaround,
-    make libpcap use DLPI instead of BPF.
-
-    This can be done by specifying the flag:
-
-       --with-pcap=dlpi
-
-    to the "configure" script for libpcap.
-
-If you use DLPI:
-
-(1) It is a good idea to have the latest version of the DLPI driver on
-    your system, since certain versions may be buggy and cause your AIX
-    system to crash.  DLPI is included in the fileset bos.rte.tty.  I
-    found that the DLPI driver that came with AIX 4.3.2 was buggy, and
-    had to upgrade to bos.rte.tty 4.3.2.4:
-
-	    lslpp -l bos.rte.tty
-
-	    bos.rte.tty     4.3.2.4  COMMITTED  Base TTY Support and Commands
-
-    Updates for AIX filesets can be obtained from:
-    ftp://service.software.ibm.com/aix/fixes/
-
-    These updates can be installed with the smit program.
-
-(2) After compiling libpcap, you need to make sure that the DLPI driver
-    is loaded.  Type:
-
-	    strload -q -d dlpi
-
-    If the result is:
-
-	    dlpi: yes
-
-    then the DLPI driver is loaded correctly.
-
-    If it is:
-
-	    dlpi: no
-
-    Then you need to type:
-
-	    strload -f /etc/dlpi.conf
- 
-    Check again with strload -q -d dlpi that the dlpi driver is loaded.  
-
-    Alternatively, you can uncomment the lines for DLPI in
-    /etc/pse.conf and reboot the machine; this way DLPI will always
-    be loaded when you boot your system.
-
-(3) There appears to be a problem in the DLPI code in some versions of
-    AIX, causing a warning about DL_PROMISC_MULTI failing; this might
-    be responsible for DLPI not being able to capture outgoing packets.
diff --git a/contrib/libpcap/README.dag b/contrib/libpcap/README.dag
deleted file mode 100644
index acf97ed..0000000
--- a/contrib/libpcap/README.dag
+++ /dev/null
@@ -1,114 +0,0 @@
-
-The following instructions apply if you have a Linux or FreeBSD platform and
-want libpcap to support the DAG range of passive network monitoring cards from
-Endace (http://www.endace.com, see below for further contact details).
-
-1) Install and build the DAG software distribution by following the
-instructions supplied with that package. Current Endace customers can download
-the DAG software distibution from https://www.endace.com
-
-2) Configure libcap. To allow the 'configure' script to locate the DAG
-software distribution use the '--with-dag' option:
-
-        ./configure --with-dag=DIR
-
-Where DIR is the root of the DAG software distribution, for example
-/var/src/dag. If the DAG software is correctly detected 'configure' will
-report:
-
-        checking whether we have DAG API... yes
-
-If 'configure' reports that there is no DAG API, the directory may have been
-incorrectly specified or the DAG software was not built before configuring
-libpcap.
-
-See also the libpcap INSTALL.txt file for further libpcap configuration
-options.
-
-Building libpcap at this stage will include support for both the native packet
-capture stream (linux or bpf) and for capturing from DAG cards. To build
-libpcap with only DAG support specify the capture type as 'dag' when
-configuring libpcap:
-
-        ./configure --with-dag=DIR --with-pcap=dag
-
-Applications built with libpcap configured in this way will only detect DAG
-cards and will not capture from the native OS packet stream.
-
-----------------------------------------------------------------------
-
-Libpcap when built for DAG cards against dag-2.5.1 or later releases:
-
-Timeouts are supported. pcap_dispatch() will return after to_ms milliseconds
-regardless of how many packets are received. If to_ms is zero pcap_dispatch()
-will block waiting for data indefinitely.
-
-pcap_dispatch() will block on and process a minimum of 64kB of data (before
-filtering) for efficiency. This can introduce high latencies on quiet
-interfaces unless a timeout value is set. The timeout expiring will override
-the 64kB minimum causing pcap_dispatch() to process any available data and
-return.
-
-pcap_setnonblock is supported. When nonblock is set, pcap_dispatch() will
-check once for available data, process any data available up to count, then
-return immediately.
-
-pcap_findalldevs() is supported, e.g. dag0, dag1...
-
-Some DAG cards can provide more than one 'stream' of received data.
-This can be data from different physical ports, or separated by filtering
-or load balancing mechanisms. Receive streams have even numbers, e.g.
-dag0:0, dag0:2 etc. Specifying transmit streams for capture is not supported.
-
-pcap_setfilter() is supported, BPF programs run in userspace.
-
-pcap_setdirection() is not supported. Only received traffic is captured.
-DAG cards normally do not have IP or link layer addresses assigned as
-they are used to passively monitor links.
-
-pcap_breakloop() is supported.
-
-pcap_datalink() and pcap_list_datalinks() are supported. The DAG card does
-not attempt to set the correct datalink type automatically where more than
-one type is possible.
-
-pcap_stats() is supported. ps_drop is the number of packets dropped due to
-RX stream buffer overflow, this count is before filters are applied (it will
-include packets that would have been dropped by the filter). The RX stream
-buffer size is user configurable outside libpcap, typically 16-512MB.
-
-pcap_get_selectable_fd() is not supported, as DAG cards do not support
-poll/select methods.
-
-pcap_inject() and pcap_sendpacket() are not supported.
-
-Some DAG cards now support capturing to multiple virtual interfaces, called
-streams. Capture streams have even numbers. These are available via libpcap
-as separate interfaces, e.g. dag0:0, dag0:2, dag0:4 etc. dag0:0 is the same
-as dag0. These are visible via pcap_findalldevs().
-
-libpcap now does NOT set the card's hardware snaplen (slen). This must now be
-set using the appropriate DAG coniguration program, e.g. dagthree, dagfour,
-dagsix, dagconfig. This is because the snaplen is currently shared between
-all of the streams. In future this may change if per-stream slen is
-implemented.
-
-DAG cards by default capture entire packets including the L2
-CRC/FCS. If the card is not configured to discard the CRC/FCS, this
-can confuse applications that use libpcap if they're not prepared for
-packets to have an FCS. Libpcap now reads the environment variable
-ERF_FCS_BITS to determine how many bits of CRC/FCS to strip from the
-end of the captured frame. This defaults to 32 for use with
-Ethernet. If the card is configured to strip the CRC/FCS, then set
-ERF_FCS_BITS=0. If used with a HDLC/PoS/PPP/Frame Relay link with 16
-bit CRC/FCS, then set ERF_FCS_BITS=16.
-
-----------------------------------------------------------------------
-
-Please submit bug reports via <support@endace.com>.
-
-Please also visit our Web site at:
-
-        http://www.endace.com/
-
-For more information about Endace DAG cards contact <sales@endace.com>.
diff --git a/contrib/libpcap/README.hpux b/contrib/libpcap/README.hpux
deleted file mode 100644
index 88c27f8..0000000
--- a/contrib/libpcap/README.hpux
+++ /dev/null
@@ -1,254 +0,0 @@
-For HP-UX 11i (11.11) and later, there are no known issues with
-promiscuous mode under HP-UX.  If you are using a earlier version of
-HP-UX and cannot upgrade, please continue reading.
-
-HP-UX patches to fix packet capture problems
-
-Note that packet-capture programs such as tcpdump may, on HP-UX, not be
-able to see packets sent from the machine on which they're running. 
-Some articles on groups.google.com discussing this are:
-
-	http://groups.google.com/groups?selm=82ld3v%2480i%241%40mamenchi.zrz.TU-Berlin.DE
-
-which says:
-
-  Newsgroups: comp.sys.hp.hpux 
-  Subject:  Re: Did someone made tcpdump working on 10.20 ?
-  Date: 12/08/1999
-  From: Lutz Jaenicke <jaenicke@emserv1.ee.TU-Berlin.DE>
-
-  In article <82ks5i$5vc$1@news1.dti.ne.jp>, mtsat <mtsat@iris.dti.ne.jp>
-  wrote:
-   >Hello,
-   >
-   >I downloaded and compiled tcpdump3.4 a couple of week ago. I tried to use
-   >it, but I can only see incoming data, never outgoing.
-   >Someone (raj) explained me that a patch was missing, and that this patch
-   >must me "patched" (poked) in order to see outbound data in promiscuous mode.
-   >Many things to do .... So the question is : did someone has already this
-   >"ready to use" PHNE_**** patch ?
-  
-   Two things:
-   1. You do need a late "LAN products cumulative patch" (e.g.  PHNE_18173
-  for   s700/10.20).
-   2. You must use
-echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
-     You can insert this e.g. into /sbin/init.d/lan
-  
-   Best regards,
-   Lutz
-
-and
-
-	http://groups.google.com/groups?selm=88cf4t%24p03%241%40web1.cup.hp.com
-
-which says:
-
-  Newsgroups: comp.sys.hp.hpux 
-  Subject: Re: tcpdump only shows incoming packets
-  Date: 02/15/2000
-  From: Rick Jones <foo@bar.baz.invalid>
-
-  Harald Skotnes <harald@cc.uit.no> wrote:
-  > I am running HPUX 11.0 on a C200 hanging on a 100Mb switch. I have
-  > compiled libpcap-0.4 an tcpdump-3.4 and it seems to work. But at a
-  > closer look I only get to see the incoming packets not the
-  > outgoing. I have tried tcpflow-0.12 which also uses libpcap and the
-  > same thing happens.  Could someone please give me a hint on how to
-  > get this right?
-  
-  Search/Read the archives ?-)
-  
-  What you are seeing is expected, un-patched, behaviour for an HP-UX
-  system.  On 11.00, you need to install the latest lancommon/DLPI
-  patches, and then the latest driver patch for the interface(s) in use. 
-  At that point, a miracle happens and you should start seeing outbound
-  traffic.
-
-[That article also mentions the patch that appears below.]
-
-and
-
-	http://groups.google.com/groups?selm=38AA973E.96BE7DF7%40cc.uit.no
-
-which says:
-
-  Newsgroups: comp.sys.hp.hpux
-  Subject: Re: tcpdump only shows incoming packets
-  Date: 02/16/2000
-  From: Harald Skotnes <harald@cc.uit.no>
-
-  Rick Jones wrote:
-  
-	...
-
-  > What you are seeing is expected, un-patched, behaviour for an HP-UX
-  > system. On 11.00, you need to install the latest lancommon/DLPI
-  > patches, and then the latest driver patch for the interface(s) in
-  > use. At that point, a miracle happens and you should start seeing
-  > outbound traffic.
-  
-  Thanks a lot.  I have this problem on several machines running HPUX
-  10.20 and 11.00.  The machines where patched up before y2k so did not
-  know what to think.  Anyway I have now installed PHNE_19766,
-  PHNE_19826, PHNE_20008, PHNE_20735 on the C200 and now I can see the
-  outbound traffic too.  Thanks again.
-
-(although those patches may not be the ones to install - there may be
-later patches).
-
-And another message to tcpdump-workers@tcpdump.org, from Rick Jones:
-
-  Date: Mon, 29 Apr 2002 15:59:55 -0700
-  From: Rick Jones
-  To: tcpdump-workers@tcpdump.org 
-  Subject: Re: [tcpdump-workers] I Can't Capture the Outbound Traffic
-
-	...
-
-  http://itrc.hp.com/ would be one place to start in a search for the most
-  up-to-date patches for DLPI and the lan driver(s) used on your system (I
-  cannot guess because 9000/800 is too generic - one hs to use the "model"
-  command these days and/or an ioscan command (see manpage) to guess what
-  the drivers (btlan[3456], gelan, etc) might be involved in addition to
-  DLPI.
-
-  Another option is to upgrade to 11i as outbound promiscuous mode support
-  is there in the base OS, no patches required.
-
-Another posting:
-
-	http://groups.google.com/groups?selm=7d6gvn%24b3%241%40ocean.cup.hp.com
-
-indicates that you need to install the optional STREAMS product to do
-captures on HP-UX 9.x:
-
-  Newsgroups: comp.sys.hp.hpux
-  Subject:  Re: tcpdump HP/UX 9.x
-  Date: 03/22/1999
-  From: Rick Jones <foo@bar.baz>
-
-  Dave Barr (barr@cis.ohio-state.edu) wrote:
-  : Has anyone ported tcpdump (or something similar) to HP/UX 9.x?
-  
-  I'm reasonably confident that any port of tcpdump to 9.X would require
-  the (then optional) STREAMS product.  This would bring DLPI, which is
-  what one uses to access interfaces in promiscuous mode.
-  
-  I'm not sure that HP even sells the 9.X STREAMS product any longer,
-  since HP-UX 9.X is off the pricelist (well, maybe 9.10 for the old 68K
-  devices). 
-  
-  Your best bet is to be up on 10.20 or better if that is at all
-  possible.  If your hardware is supported by it, I'd go with HP-UX 11. 
-  If you want to see the system's own outbound traffic, you'll never get
-  that functionality on 9.X, but it might happen at some point for 10.20
-  and 11.X. 
-  
-  rick jones
-
-(as per other messages cited here, the ability to see the system's own
-outbound traffic did happen).
-
-Rick Jones reports that HP-UX 11i needs no patches for outbound
-promiscuous mode support.
-
-An additional note, from Jost Martin, for HP-UX 10.20:
-
-	Q: How do I get ethereral on HPUX to capture the _outgoing_ packets
-	   of an interface
-	A: You need to get PHNE_20892,PHNE_20725 and PHCO_10947 (or
-	   newer, this is as of 4.4.00) and its dependencies.  Then you can
-	   enable the feature as descibed below:
-
-	Patch Name: PHNE_20892
-	Patch Description: s700 10.20 PCI 100Base-T cumulative patch
-		To trace the outbound packets, please do the following
-		to turn on a global promiscuous switch before running
-		the promiscuous applications like snoop or tcpdump:
-
-		adb -w /stand/vmunix /dev/mem
-		lanc_outbound_promisc_flag/W 1
-		(adb will echo the result showing that the flag has
-		been changed)
-		$quit
-	(Thanks for this part to HP-support, Ratingen)
-
-		The attached hack does this and some security-related stuff
-	(thanks to hildeb@www.stahl.bau.tu-bs.de (Ralf Hildebrandt) who
-	posted the security-part some time ago)
-
-		 <<hack_ip_stack>> 
-
-		(Don't switch IP-forwarding off, if you need it !)
-		Install the hack as /sbin/init.d/hacl_ip_stack (adjust
-	permissions !) and make a sequencing-symlink
-	/sbin/rc2.d/S350hack_ip_stack pointing to this script. 
-		Now all this is done on every reboot.
-
-According to Rick Jones, the global promiscuous switch also has to be
-turned on for HP-UX 11.00, but not for 11i - and, in fact, the switch
-doesn't even exist on 11i.
-
-Here's the "hack_ip_stack" script:
-
------------------------------------Cut Here-------------------------------------
-#!/sbin/sh
-#
-# nettune:  hack kernel parms for safety
-
-OKAY=0
-ERROR=-1
-
-# /usr/contrib/bin fuer nettune auf Pfad
-PATH=/sbin:/usr/sbin:/usr/bin:/usr/contrib/bin
-export PATH
-
-
-##########
-#  main  #
-##########
-
-case $1 in
-   start_msg)
-      print "Tune IP-Stack for security"
-      exit $OKAY
-      ;;
-
-   stop_msg)
-      print "This action is not applicable"
-      exit $OKAY
-      ;;
-
-   stop)
-      exit $OKAY
-      ;;
-
-   start)
-      ;;  # fall through
-
-   *)
-      print "USAGE: $0 {start_msg | stop_msg | start | stop}" >&2
-      exit $ERROR
-      ;;
-   esac
-
-###########
-#  start  #
-###########
-
-#
-# tcp-Sequence-Numbers nicht mehr inkrementieren sondern random
-# Syn-Flood-Protection an
-# ip_forwarding aus
-# Source-Routing aus
-# Ausgehende Packets an ethereal/tcpdump etc.
-
-/usr/contrib/bin/nettune -s tcp_random_seq 2 || exit $ERROR
-/usr/contrib/bin/nettune -s hp_syn_protect 1 || exit $ERROR
-/usr/contrib/bin/nettune -s ip_forwarding 0 || exit $ERROR
-echo 'ip_block_source_routed/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem || exit $ERROR
-echo 'lanc_outbound_promisc_flag/W 1' | adb -w /stand/vmunix /dev/mem  || exit $ERROR
-
-exit $OKAY
------------------------------------Cut Here-------------------------------------
diff --git a/contrib/libpcap/README.linux b/contrib/libpcap/README.linux
deleted file mode 100644
index dd95913..0000000
--- a/contrib/libpcap/README.linux
+++ /dev/null
@@ -1,88 +0,0 @@
-In order for libpcap to be able to capture packets on a Linux system,
-the "packet" protocol must be supported by your kernel.  If it is not,
-you may get error messages such as
-
-	modprobe: can't locate module net-pf-17
-
-in "/var/adm/messages", or may get messages such as
-
-	socket: Address family not supported by protocol
-
-from applications using libpcap.
-
-You must configure the kernel with the CONFIG_PACKET option for this
-protocol; the following note is from the Linux "Configure.help" file for
-the 2.0[.x] kernel:
-
-	Packet socket
-	CONFIG_PACKET
-	  The Packet protocol is used by applications which communicate
-	  directly with network devices without an intermediate network
-	  protocol implemented in the kernel, e.g. tcpdump. If you want them
-	  to work, choose Y. 
-
-	  This driver is also available as a module called af_packet.o ( =
-	  code which can be inserted in and removed from the running kernel
-	  whenever you want). If you want to compile it as a module, say M
-	  here and read Documentation/modules.txt; if you use modprobe or
-	  kmod, you may also want to add "alias net-pf-17 af_packet" to 
-	  /etc/modules.conf.
-
-and the note for the 2.2[.x] kernel says:
-
-	Packet socket
-	CONFIG_PACKET
-	  The Packet protocol is used by applications which communicate
-	  directly with network devices without an intermediate network
-	  protocol implemented in the kernel, e.g. tcpdump. If you want them
-	  to work, choose Y. This driver is also available as a module called
-	  af_packet.o ( = code which can be inserted in and removed from the
-	  running kernel whenever you want). If you want to compile it as a
-	  module, say M here and read Documentation/modules.txt.  You will
-	  need to add 'alias net-pf-17 af_packet' to your /etc/conf.modules
-	  file for the module version to function automatically.  If unsure,
-	  say Y.
-
-In addition, there is an option that, in 2.2 and later kernels, will
-allow packet capture filters specified to programs such as tcpdump to be
-executed in the kernel, so that packets that don't pass the filter won't
-be copied from the kernel to the program, rather than having all packets
-copied to the program and libpcap doing the filtering in user mode. 
-
-Copying packets from the kernel to the program consumes a significant
-amount of CPU, so filtering in the kernel can reduce the overhead of
-capturing packets if a filter has been specified that discards a
-significant number of packets.  (If no filter is specified, it makes no
-difference whether the filtering isn't performed in the kernel or isn't
-performed in user mode. :-))
-
-The option for this is the CONFIG_FILTER option; the "Configure.help"
-file says:
-
-	Socket filtering
-	CONFIG_FILTER
-	  The Linux Socket Filter is derived from the Berkeley Packet Filter.
-	  If you say Y here, user-space programs can attach a filter to any
-	  socket and thereby tell the kernel that it should allow or disallow
-	  certain types of data to get through the socket. Linux Socket
-	  Filtering works on all socket types except TCP for now. See the text
-	  file linux/Documentation/networking/filter.txt for more information.
-	  If unsure, say N.
-
-
-Statistics:
-Statistics reported by pcap are platform specific.  The statistics
-reported by pcap_stats on Linux are as follows:
-
-2.2.x
-=====
-ps_recv   Number of packets that were accepted by the pcap filter
-ps_drops  Always 0, this statistic is not gatherd on this platform
-
-2.4.x
-=====
-ps_rec    Number of packets that were accepted by the pcap filter
-ps_drops  Number of packets that had passed filtering but were not
-          passed on to pcap due to things like buffer shortage, etc.
-			 This is useful because these are packets you are interested in
-			 but won't be reported by, for example, tcpdump output.
diff --git a/contrib/libpcap/README.macosx b/contrib/libpcap/README.macosx
deleted file mode 100644
index 25794d8..0000000
--- a/contrib/libpcap/README.macosx
+++ /dev/null
@@ -1,43 +0,0 @@
-As with other systems using BPF, Mac OS X allows users with read access
-to the BPF devices to capture packets with libpcap and allows users with
-write access to the BPF devices to send packets with libpcap.
-
-On some systems that use BPF, the BPF devices live on the root file
-system, and the permissions and/or ownership on those devices can be
-changed to give users other than root permission to read or write those
-devices.
-
-On newer versions of FreeBSD, the BPF devices live on devfs, and devfs
-can be configured to set the permissions and/or ownership of those
-devices to give users other than root permission to read or write those
-devices.
-
-On Mac OS X, the BPF devices live on devfs, but the OS X version of
-devfs is based on an older (non-default) FreeBSD devfs, and that version
-of devfs cannot be configured to set the permissions and/or ownership of
-those devices.
-
-Therefore, we supply a "startup item" for OS X that will change the
-ownership of the BPF devices so that the "admin" group owns them, and
-will change the permission of the BPF devices to rw-rw----, so that all
-users in the "admin" group - i.e., all users with "Allow user to
-administer this computer" turned on - have both read and write access to
-them.
-
-The startup item is in the ChmodBPF directory in the source tree.  A
-/Library/StartupItems directory should be created if it doesn't already
-exist, and the ChmodBPF directory should be copied to the
-/Library/StartupItems directory (copy the entire directory, so that
-there's a /Library/StartupItems/ChmodBPF directory, containing all the
-files in the source tree's ChmodBPF directory; don't copy the individual
-items in that directory to /Library/StartupItems).
-
-If you want to give a particular user permission to access the BPF
-devices, rather than giving all administrative users permission to
-access them, you can have the ChmodBPF/ChmodBPF script change the
-ownership of /dev/bpf* without changing the permissions.  If you want to
-give a particular user permission to read and write the BPF devices and
-give the administrative users permission to read but not write the BPF
-devices, you can have the script change the owner to that user, the
-group to "admin", and the permissions to rw-r-----.  Other possibilities
-are left as an exercise for the reader.
diff --git a/contrib/libpcap/README.septel b/contrib/libpcap/README.septel
deleted file mode 100644
index fbc88df..0000000
--- a/contrib/libpcap/README.septel
+++ /dev/null
@@ -1,50 +0,0 @@
-The following instructions apply if you have a Linux platform and want
-libpcap to support the Septel range of passive network monitoring cards
-from Intel (http://www.intel.com)
-
-1) Install and build the Septel software distribution by following the
-instructions supplied with that package.
-
-2) Configure libcap. To allow the 'configure' script to locate the Septel
-software distribution use the '--with-septel' option:
-
-        ./configure --with-septel=DIR
-
-where DIR is the root of the Septel software distribution, for example
-/var/src/septel.
-
-By default (if you write only ./configure --with-septel) it takes
-./../septel as argument for DIR. 
-
-If the Septel software is correctly detected 'configure' will
-report:
-
-        checking whether we have Septel API... yes
-
-If 'configure' reports that there is no Septel API, the directory may have been
-incorrectly specified or the Septel software was not built before configuring
-libpcap.
-
-See also the libpcap INSTALL.txt file for further libpcap configuration
-options.
-
-Building libpcap at this stage will include support for both the native
-packet capture stream and for capturing from Septel cards.  To build
-libpcap with only Septel support specify the capture type as 'septel'
-when configuring libpcap:
-
-        ./configure --with-septel=DIR --with-pcap=septel
-
-Applications built with libpcap configured in this way will only detect Septel
-cards and will not capture from the native OS packet stream.
-
-Note: As mentioned in pcap-septel.c we should first edit the system.txt
-file to change the user part example (UPE) module id to 0xdd instead of
-0x2d for technical reason.  So this change in system.txt is crutial and
-things will go wrong if it's not done.  System.txt along with config.txt
-are configuration files that are edited by the user before running the
-gctload program that uses these files for initialising modules and
-configuring parameters.
-
-----------------------------------------------------------------------
-for more information please contact me : gil_hoyek@hotmail.com
diff --git a/contrib/libpcap/README.tru64 b/contrib/libpcap/README.tru64
deleted file mode 100644
index 7fe1ef0..0000000
--- a/contrib/libpcap/README.tru64
+++ /dev/null
@@ -1,49 +0,0 @@
-The following instructions are applicable to Tru64 UNIX 
-(formerly Digital UNIX (formerly DEC OSF/1)) version 4.0, and
-probably to later versions as well; at least some options apply to
-Digital UNIX 3.2 - perhaps all do.
-
-In order to use kernel packet filtering on this system, you have
-to configure it in such a way:
-
-Kernel configuration
---------------------
-
-The packet filtering kernel option must be enabled at kernel
-installation.  If it was not the case, you can rebuild the kernel with
-"doconfig -c" after adding the following line in the kernel
-configuration file (/sys/conf/<HOSTNAME>):
-
-	option PACKETFILTER
-
-or use "doconfig" without any arguments to add the packet filter driver
-option via the kernel option menu (see the system administration
-documentation for information on how to do this).
-
-Device configuration
---------------------
-
-Devices used for packet filtering must be created thanks to
-the following command (executed in the /dev directory):
-
-	./MAKEDEV pfilt
-
-Interface configuration
------------------------
-
-In order to capture all packets on a network, you may want to allow
-applications to put the interface on that network into "local copy"
-mode, so that tcpdump can see packets sent by the host on which it's
-running as well as packets received by that host, and to put the
-interface into "promiscuous" mode, so that tcpdump can see packets on
-the network segment not sent to the host on which it's running, by using
-the pfconfig(1) command:
-
-	pfconfig +c +p <network_device>
-
-or allow application to put any interface into "local copy" or
-"promiscuous" mode by using the command:
-
-	pfconfig +c +p -a
-
-Note: all instructions given require root privileges.
diff --git a/contrib/libpcap/VERSION b/contrib/libpcap/VERSION
index e3e1807..3eefcb9 100644
--- a/contrib/libpcap/VERSION
+++ b/contrib/libpcap/VERSION
@@ -1 +1 @@
-0.9.8
+1.0.0
diff --git a/contrib/libpcap/acsite.m4 b/contrib/libpcap/acsite.m4
deleted file mode 100644
index 746faf1..0000000
--- a/contrib/libpcap/acsite.m4
+++ /dev/null
@@ -1,505 +0,0 @@
-dnl @(#) $Header: acsite.m4,v 1.41 96/11/29 15:30:40 leres Exp $ (LBL)
-dnl
-dnl Copyright (c) 1995, 1996
-dnl	The Regents of the University of California.  All rights reserved.
-dnl
-dnl Redistribution and use in source and binary forms, with or without
-dnl modification, are permitted provided that: (1) source code distributions
-dnl retain the above copyright notice and this paragraph in its entirety, (2)
-dnl distributions including binary code include the above copyright notice and
-dnl this paragraph in its entirety in the documentation or other materials
-dnl provided with the distribution, and (3) all advertising materials mentioning
-dnl features or use of this software display the following acknowledgement:
-dnl ``This product includes software developed by the University of California,
-dnl Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
-dnl the University nor the names of its contributors may be used to endorse
-dnl or promote products derived from this software without specific prior
-dnl written permission.
-dnl THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
-dnl WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
-dnl MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-dnl
-dnl LBL autoconf macros
-dnl
-
-dnl
-dnl Determine which compiler we're using (cc or gcc)
-dnl If using gcc, determine the version number
-dnl If using cc, require that it support ansi prototypes
-dnl If using gcc, use -O2 (otherwise use -O)
-dnl If using cc, explicitly specify /usr/local/include
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_C_INIT(copt, incls)
-dnl
-dnl results:
-dnl
-dnl	$1 (copt set)
-dnl	$2 (incls set)
-dnl	CC
-dnl	ac_cv_gcc_vers
-dnl	LBL_CFLAGS
-dnl
-dnl XXX need to add test to make sure ac_prog_cc hasn't been called
-AC_DEFUN(AC_LBL_C_INIT,
-    [AC_PREREQ(2.12)
-    $1=-O
-    $2=""
-    if test "${CFLAGS+set}" = set; then
-	    LBL_CFLAGS="$CFLAGS"
-    fi
-    if test -z "$CC" ; then
-	    case "$target_os" in
-
-	    bsdi*)
-		    AC_CHECK_PROG(SHLICC2, shlicc2, yes, no)
-		    if test $SHLICC2 = yes ; then
-			    CC=shlicc2
-			    export CC
-		    fi
-		    ;;
-	    esac
-    fi
-    AC_PROG_CC
-    if test $ac_cv_prog_gcc = yes ; then
-	    if test "$SHLICC2" = yes ; then
-		    ac_cv_gcc_vers=2
-		    $1=-O2
-	    else
-		    AC_MSG_CHECKING(gcc version)
-		    AC_CACHE_VAL(ac_cv_gcc_vers,
-			ac_cv_gcc_vers=`$CC -v 2>&1 | \
-			    sed -n -e '$s/.* //' -e '$s/\..*//p'`)
-		    AC_MSG_RESULT($ac_cv_gcc_vers)
-		    if test $ac_cv_gcc_vers -gt 1 ; then
-			    $1=-O2
-		    fi
-	    fi
-    else
-	    AC_MSG_CHECKING(that $CC handles ansi prototypes)
-	    AC_CACHE_VAL(ac_cv_cc_ansi_prototypes,
-		AC_TRY_COMPILE(
-		    [#include <sys/types.h>],
-		    [int frob(int, char *)],
-		    ac_cv_cc_ansi_prototypes=yes,
-		    ac_cv_cc_ansi_prototypes=no))
-	    AC_MSG_RESULT($ac_cv_cc_ansi_prototypes)
-	    if test $ac_cv_cc_ansi_prototypes = no ; then
-		    case "$target_os" in
-
-		    hpux*)
-			    AC_MSG_CHECKING(for HP-UX ansi compiler ($CC -Aa -D_HPUX_SOURCE))
-			    savedcflags="$CFLAGS"
-			    CFLAGS="-Aa -D_HPUX_SOURCE $CFLAGS"
-			    AC_CACHE_VAL(ac_cv_cc_hpux_cc_aa,
-				AC_TRY_COMPILE(
-				    [#include <sys/types.h>],
-				    [int frob(int, char *)],
-				    ac_cv_cc_hpux_cc_aa=yes,
-				    ac_cv_cc_hpux_cc_aa=no))
-			    AC_MSG_RESULT($ac_cv_cc_hpux_cc_aa)
-			    if test $ac_cv_cc_hpux_cc_aa = no ; then
-				    AC_MSG_ERROR(see the INSTALL for more info)
-			    fi
-			    CFLAGS="$savedcflags"
-			    V_CCOPT="-Aa $V_CCOPT"
-			    AC_DEFINE(_HPUX_SOURCE)
-			    ;;
-
-		    *)
-			    AC_MSG_ERROR(see the INSTALL for more info)
-			    ;;
-		    esac
-	    fi
-	    $2=-I/usr/local/include
-
-	    case "$target_os" in
-
-	    irix*)
-		    V_CCOPT="$V_CCOPT -xansi -signed -g3"
-		    ;;
-
-	    osf*)
-		    V_CCOPT="$V_CCOPT -g3"
-		    ;;
-
-	    ultrix*)
-		    AC_MSG_CHECKING(that Ultrix $CC hacks const in prototypes)
-		    AC_CACHE_VAL(ac_cv_cc_const_proto,
-			AC_TRY_COMPILE(
-			    [#include <sys/types.h>],
-			    [struct a { int b; };
-			    void c(const struct a *)],
-			    ac_cv_cc_const_proto=yes,
-			    ac_cv_cc_const_proto=no))
-		    AC_MSG_RESULT($ac_cv_cc_const_proto)
-		    if test $ac_cv_cc_const_proto = no ; then
-			    AC_DEFINE(const,)
-		    fi
-		    ;;
-	    esac
-    fi
-])
-
-dnl
-dnl Use pfopen.c if available and pfopen() not in standard libraries
-dnl Require libpcap
-dnl Look for libpcap in ..
-dnl Use the installed libpcap if there is no local version
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_LIBPCAP(pcapdep, incls)
-dnl
-dnl results:
-dnl
-dnl	$1 (pcapdep set)
-dnl	$2 (incls appended)
-dnl	LIBS
-dnl
-AC_DEFUN(AC_LBL_LIBPCAP,
-    [pfopen=/usr/examples/packetfilter/pfopen.c
-    if test -f $pfopen ; then
-	    AC_CHECK_FUNCS(pfopen)
-	    if test $ac_cv_func_pfopen = "no" ; then
-		    AC_MSG_RESULT(Using $pfopen)
-		    LIBS="$LIBS $pfopen"
-	    fi
-    fi
-    AC_MSG_CHECKING(for local pcap library)
-    libpcap=FAIL
-    lastdir=FAIL
-    places=`ls .. | sed -e 's,/$,,' -e 's,^,../,' | \
-	egrep '/libpcap-[[0-9]]*\.[[0-9]]*(\.[[0-9]]*)?([[ab]][[0-9]]*)?$'`
-    for dir in $places ../libpcap libpcap ; do
-	    basedir=`echo $dir | sed -e 's/[[ab]][[0-9]]*$//'`
-	    if test $lastdir = $basedir ; then
-		    dnl skip alphas when an actual release is present
-		    continue;
-	    fi
-	    lastdir=$dir
-	    if test -r $dir/pcap.c ; then
-		    libpcap=$dir/libpcap.a
-		    d=$dir
-		    dnl continue and select the last one that exists
-	    fi
-    done
-    if test $libpcap = FAIL ; then
-	    AC_MSG_RESULT(not found)
-	    AC_CHECK_LIB(pcap, main, libpcap="-lpcap")
-	    if test $libpcap = FAIL ; then
-		    AC_MSG_ERROR(see the INSTALL doc for more info)
-	    fi
-    else
-	    $1=$libpcap
-	    $2="-I$d $$2"
-	    AC_MSG_RESULT($libpcap)
-    fi
-    LIBS="$libpcap $LIBS"])
-
-dnl
-dnl Define RETSIGTYPE and RETSIGVAL
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_TYPE_SIGNAL
-dnl
-dnl results:
-dnl
-dnl	RETSIGTYPE (defined)
-dnl	RETSIGVAL (defined)
-dnl
-AC_DEFUN(AC_LBL_TYPE_SIGNAL,
-    [AC_TYPE_SIGNAL
-    if test "$ac_cv_type_signal" = void ; then
-	    AC_DEFINE(RETSIGVAL,)
-    else
-	    AC_DEFINE(RETSIGVAL,(0))
-    fi
-    case "$target_os" in
-
-    irix*)
-	    AC_DEFINE(_BSD_SIGNALS)
-	    ;;
-
-    *)
-	    AC_CHECK_FUNCS(sigset)
-	    if test $ac_cv_func_sigset = yes ; then
-		    AC_DEFINE(signal, sigset)
-	    fi
-	    ;;
-    esac])
-
-dnl
-dnl If using gcc, see if fixincludes should be run
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_FIXINCLUDES
-dnl
-AC_DEFUN(AC_LBL_FIXINCLUDES,
-    [if test $ac_cv_prog_gcc = yes ; then
-	    AC_MSG_CHECKING(if fixincludes is needed)
-	    AC_CACHE_VAL(ac_cv_gcc_fixincludes,
-		AC_TRY_COMPILE(
-		    [/*
-		     * This generates a "duplicate case value" when fixincludes
-		     * has not be run.
-		     */
-#		include <sys/types.h>
-#		include <sys/time.h>
-#		include <sys/ioctl.h>
-#		ifdef HAVE_SYS_IOCCOM_H
-#		include <sys/ioccom.h>
-#		endif],
-		    [switch (0) {
-		    case _IO('A', 1):;
-		    case _IO('B', 1):;
-		    }],
-		    ac_cv_gcc_fixincludes=yes,
-		    ac_cv_gcc_fixincludes=no))
-	    AC_MSG_RESULT($ac_cv_gcc_fixincludes)
-	    if test $ac_cv_gcc_fixincludes = no ; then
-		    # Don't cache failure
-		    unset ac_cv_gcc_fixincludes
-		    AC_MSG_ERROR(see the INSTALL for more info)
-	    fi
-    fi])
-
-dnl
-dnl Check for flex, default to lex
-dnl Require flex 2.4 or higher
-dnl Check for bison, default to yacc
-dnl Default to lex/yacc if both flex and bison are not available
-dnl Define the yy prefix string if using flex and bison
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_LEX_AND_YACC(lex, yacc, yyprefix)
-dnl
-dnl results:
-dnl
-dnl	$1 (lex set)
-dnl	$2 (yacc appended)
-dnl	$3 (optional flex and bison -P prefix)
-dnl
-AC_DEFUN(AC_LBL_LEX_AND_YACC,
-    [AC_CHECK_PROGS($1, flex, lex)
-    if test "$$1" = flex ; then
-	    # The -V flag was added in 2.4
-	    AC_MSG_CHECKING(for flex 2.4 or higher)
-	    AC_CACHE_VAL(ac_cv_flex_v24,
-		if flex -V >/dev/null 2>&1; then
-			ac_cv_flex_v24=yes
-		else
-			ac_cv_flex_v24=no
-		fi)
-	    AC_MSG_RESULT($ac_cv_flex_v24)
-	    if test $ac_cv_flex_v24 = no ; then
-		    s="2.4 or higher required"
-		    AC_MSG_WARN(ignoring obsolete flex executable ($s))
-		    $1=lex
-	    fi
-    fi
-    AC_CHECK_PROGS($2, bison, yacc)
-    if test "$$2" = bison ; then
-	    $2="$$2 -y"
-    fi
-    if test "$$1" != lex -a "$$2" = yacc -o "$$1" = lex -a "$$2" != yacc ; then
-	    AC_MSG_WARN(don't have both flex and bison; reverting to lex/yacc)
-	    $1=lex
-	    $2=yacc
-    fi
-    if test "$$1" = flex -a -n "$3" ; then
-	    $1="$$1 -P$3"
-	    $2="$$2 -p $3"
-    fi])
-
-dnl
-dnl Checks to see if union wait is used with WEXITSTATUS()
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_UNION_WAIT
-dnl
-dnl results:
-dnl
-dnl	DECLWAITSTATUS (defined)
-dnl
-AC_DEFUN(AC_LBL_UNION_WAIT,
-    [AC_MSG_CHECKING(if union wait is used)
-    AC_CACHE_VAL(ac_cv_union_wait,
-	AC_TRY_COMPILE([
-#	include <sys/types.h>
-#	include <sys/wait.h>],
-	    [int status;
-	    u_int i = WEXITSTATUS(status);
-	    u_int j = waitpid(0, &status, 0);],
-	    ac_cv_union_wait=no,
-	    ac_cv_union_wait=yes))
-    AC_MSG_RESULT($ac_cv_union_wait)
-    if test $ac_cv_union_wait = yes ; then
-	    AC_DEFINE(DECLWAITSTATUS,union wait)
-    else
-	    AC_DEFINE(DECLWAITSTATUS,int)
-    fi])
-
-dnl
-dnl Checks to see if the sockaddr struct has the 4.4 BSD sa_len member
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_SOCKADDR_SA_LEN
-dnl
-dnl results:
-dnl
-dnl	HAVE_SOCKADDR_SA_LEN (defined)
-dnl
-AC_DEFUN(AC_LBL_SOCKADDR_SA_LEN,
-    [AC_MSG_CHECKING(if sockaddr struct has sa_len member)
-    AC_CACHE_VAL(ac_cv_sockaddr_has_sa_len,
-	AC_TRY_COMPILE([
-#	include <sys/types.h>
-#	include <sys/socket.h>],
-	[u_int i = sizeof(((struct sockaddr *)0)->sa_len)],
-	ac_cv_sockaddr_has_sa_len=yes,
-	ac_cv_sockaddr_has_sa_len=no))
-    AC_MSG_RESULT($ac_cv_sockaddr_has_sa_len)
-    if test $ac_cv_sockaddr_has_sa_len = yes ; then
-	    AC_DEFINE(HAVE_SOCKADDR_SA_LEN)
-    fi])
-
-dnl
-dnl Checks to see if -R is used
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_HAVE_RUN_PATH
-dnl
-dnl results:
-dnl
-dnl	ac_cv_have_run_path (yes or no)
-dnl
-AC_DEFUN(AC_LBL_HAVE_RUN_PATH,
-    [AC_MSG_CHECKING(for ${CC-cc} -R)
-    AC_CACHE_VAL(ac_cv_have_run_path,
-	[echo 'main(){}' > conftest.c
-	${CC-cc} -o conftest conftest.c -R/a1/b2/c3 >conftest.out 2>&1
-	if test ! -s conftest.out ; then
-		ac_cv_have_run_path=yes
-	else
-		ac_cv_have_run_path=no
-	fi
-	rm -f conftest*])
-    AC_MSG_RESULT($ac_cv_have_run_path)
-    ])
-
-dnl
-dnl Checks to see if unaligned memory accesses fail
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_UNALIGNED_ACCESS
-dnl
-dnl results:
-dnl
-dnl	LBL_ALIGN (DEFINED)
-dnl
-AC_DEFUN(AC_LBL_UNALIGNED_ACCESS,
-    [AC_MSG_CHECKING(if unaligned accesses fail)
-    AC_CACHE_VAL(ac_cv_unaligned_fail,
-	[case "$target_cpu" in
-
-	alpha|hp*|mips|sparc)
-		ac_cv_unaligned_fail=yes
-		;;
-
-	*)
-		cat >conftest.c <<EOF
-#		include <sys/types.h>
-#		include <sys/wait.h>
-#		include <stdio.h>
-		unsigned char a[[5]] = { 1, 2, 3, 4, 5 };
-		main() {
-		unsigned int i;
-		pid_t pid;
-		int status;
-		/* avoid "core dumped" message */
-		pid = fork();
-		if (pid <  0)
-			exit(2);
-		if (pid > 0) {
-			/* parent */
-			pid = waitpid(pid, &status, 0);
-			if (pid < 0)
-				exit(3);
-			exit(!WIFEXITED(status));
-		}
-		/* child */
-		i = *(unsigned int *)&a[[1]];
-		printf("%d\n", i);
-		exit(0);
-		}
-EOF
-		${CC-cc} -o conftest $CFLAGS $CPPFLAGS $LDFLAGS \
-		    conftest.c $LIBS >/dev/null 2>&1
-		if test ! -x conftest ; then
-			dnl failed to compile for some reason
-			ac_cv_unaligned_fail=yes
-		else
-			./conftest >conftest.out
-			if test ! -s conftest.out ; then
-				ac_cv_unaligned_fail=yes
-			else
-				ac_cv_unaligned_fail=no
-			fi
-		fi
-		rm -f conftest* core core.conftest
-		;;
-	esac])
-    AC_MSG_RESULT($ac_cv_unaligned_fail)
-    if test $ac_cv_unaligned_fail = yes ; then
-	    AC_DEFINE(LBL_ALIGN)
-    fi])
-
-dnl
-dnl If using gcc and the file .devel exists:
-dnl	Compile with -g (if supported) and -Wall
-dnl	If using gcc 2, do extra prototype checking
-dnl	If an os prototype include exists, symlink os-proto.h to it
-dnl
-dnl usage:
-dnl
-dnl	AC_LBL_DEVEL(copt)
-dnl
-dnl results:
-dnl
-dnl	$1 (copt appended)
-dnl	HAVE_OS_PROTO_H (defined)
-dnl	os-proto.h (symlinked)
-dnl
-AC_DEFUN(AC_LBL_DEVEL,
-    [rm -f os-proto.h
-    if test "${LBL_CFLAGS+set}" = set; then
-	    $1="$$1 ${LBL_CFLAGS}"
-    fi
-    if test $ac_cv_prog_gcc = yes -a -f .devel ; then
-	    if test "${LBL_CFLAGS+set}" != set; then
-		    if test "$ac_cv_prog_cc_g" = yes ; then
-			    $1="-g $$1"
-		    fi
-		    $1="$$1 -Wall"
-		    if test $ac_cv_gcc_vers -gt 1 ; then
-			    $1="$$1 -Wmissing-prototypes -Wstrict-prototypes"
-		    fi
-	    fi
-	    os=`echo $target_os | sed -e 's/\([[0-9]][[0-9]]*\)[[^0-9]].*$/\1/'`
-	    name="lbl/os-$os.h"
-	    if test -f $name ; then
-		    ln -s $name os-proto.h
-		    AC_DEFINE(HAVE_OS_PROTO_H)
-	    else
-		    AC_MSG_WARN(can't find $name)
-	    fi
-    fi])
diff --git a/contrib/libpcap/atmuni31.h b/contrib/libpcap/atmuni31.h
index 877ed68..11242b8 100644
--- a/contrib/libpcap/atmuni31.h
+++ b/contrib/libpcap/atmuni31.h
@@ -29,18 +29,18 @@
  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * @(#) $Header: /tcpdump/master/libpcap/atmuni31.h,v 1.1 2002/07/11 09:06:32 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/atmuni31.h,v 1.1.6.2 2007/10/22 19:30:14 guy Exp $ (LBL)
  */
 
 /* Based on UNI3.1 standard by ATM Forum */
 
 /* ATM traffic types based on VPI=0 and (the following VCI */
-#define PPC			0x05	/* Point-to-point signal msg */
-#define BCC			0x02	/* Broadcast signal msg */
-#define OAMF4SC			0x03	/* Segment OAM F4 flow cell */
-#define OAMF4EC			0x04	/* End-to-end OAM F4 flow cell */
-#define METAC			0x01	/* Meta signal msg */
-#define ILMIC			0x10	/* ILMI msg */
+#define VCI_PPC			0x05	/* Point-to-point signal msg */
+#define VCI_BCC			0x02	/* Broadcast signal msg */
+#define VCI_OAMF4SC		0x03	/* Segment OAM F4 flow cell */
+#define VCI_OAMF4EC		0x04	/* End-to-end OAM F4 flow cell */
+#define VCI_METAC		0x01	/* Meta signal msg */
+#define VCI_ILMIC		0x10	/* ILMI msg */
 
 /* Q.2931 signalling messages */
 #define CALL_PROCEED		0x02	/* call proceeding */
diff --git a/contrib/libpcap/bpf/net/bpf_filter.c b/contrib/libpcap/bpf/net/bpf_filter.c
index 40df32a..a2733d1 100644
--- a/contrib/libpcap/bpf/net/bpf_filter.c
+++ b/contrib/libpcap/bpf/net/bpf_filter.c
@@ -40,7 +40,7 @@
 
 #if !(defined(lint) || defined(KERNEL) || defined(_KERNEL))
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.44 2003/11/15 23:24:07 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -71,7 +71,7 @@ static const char rcsid[] _U_ =
 
 #endif /* WIN32 */
 
-#include <pcap-bpf.h>
+#include <pcap/bpf.h>
 
 #if !defined(KERNEL) && !defined(_KERNEL)
 #include <stdlib.h>
@@ -200,8 +200,8 @@ m_xhalf(m, k, err)
  */
 u_int
 bpf_filter(pc, p, wirelen, buflen)
-	register struct bpf_insn *pc;
-	register u_char *p;
+	register const struct bpf_insn *pc;
+	register const u_char *p;
 	u_int wirelen;
 	register u_int buflen;
 {
@@ -512,54 +512,155 @@ bpf_filter(pc, p, wirelen, buflen)
 	}
 }
 
-
 /*
  * Return true if the 'fcode' is a valid filter program.
  * The constraints are that each jump be forward and to a valid
- * code.  The code must terminate with either an accept or reject.
- * 'valid' is an array for use by the routine (it must be at least
- * 'len' bytes long).
+ * code, that memory accesses are within valid ranges (to the
+ * extent that this can be checked statically; loads of packet
+ * data have to be, and are, also checked at run time), and that
+ * the code terminates with either an accept or reject.
  *
  * The kernel needs to be able to verify an application's filter code.
  * Otherwise, a bogus program could easily crash the system.
  */
 int
 bpf_validate(f, len)
-	struct bpf_insn *f;
+	const struct bpf_insn *f;
 	int len;
 {
-	register int i;
-	register struct bpf_insn *p;
+	u_int i, from;
+	const struct bpf_insn *p;
+
+	if (len < 1)
+		return 0;
+	/*
+	 * There's no maximum program length in userland.
+	 */
+#if defined(KERNEL) || defined(_KERNEL)
+	if (len > BPF_MAXINSNS)
+		return 0;
+#endif
 
 	for (i = 0; i < len; ++i) {
+		p = &f[i];
+		switch (BPF_CLASS(p->code)) {
 		/*
-		 * Check that that jumps are forward, and within
-		 * the code block.
+		 * Check that memory operations use valid addresses.
 		 */
-		p = &f[i];
-		if (BPF_CLASS(p->code) == BPF_JMP) {
-			register int from = i + 1;
-
-			if (BPF_OP(p->code) == BPF_JA) {
-				if (from + p->k >= (unsigned)len)
+		case BPF_LD:
+		case BPF_LDX:
+			switch (BPF_MODE(p->code)) {
+			case BPF_IMM:
+				break;
+			case BPF_ABS:
+			case BPF_IND:
+			case BPF_MSH:
+				/*
+				 * There's no maximum packet data size
+				 * in userland.  The runtime packet length
+				 * check suffices.
+				 */
+#if defined(KERNEL) || defined(_KERNEL)
+				/*
+				 * More strict check with actual packet length
+				 * is done runtime.
+				 */
+				if (p->k >= bpf_maxbufsize)
 					return 0;
+#endif
+				break;
+			case BPF_MEM:
+				if (p->k >= BPF_MEMWORDS)
+					return 0;
+				break;
+			case BPF_LEN:
+				break;
+			default:
+				return 0;
 			}
-			else if (from + p->jt >= len || from + p->jf >= len)
+			break;
+		case BPF_ST:
+		case BPF_STX:
+			if (p->k >= BPF_MEMWORDS)
 				return 0;
-		}
-		/*
-		 * Check that memory operations use valid addresses.
-		 */
-		if ((BPF_CLASS(p->code) == BPF_ST ||
-		     (BPF_CLASS(p->code) == BPF_LD &&
-		      (p->code & 0xe0) == BPF_MEM)) &&
-		    (p->k >= BPF_MEMWORDS || p->k < 0))
-			return 0;
-		/*
-		 * Check for constant division by 0.
-		 */
-		if (p->code == (BPF_ALU|BPF_DIV|BPF_K) && p->k == 0)
+			break;
+		case BPF_ALU:
+			switch (BPF_OP(p->code)) {
+			case BPF_ADD:
+			case BPF_SUB:
+			case BPF_MUL:
+			case BPF_OR:
+			case BPF_AND:
+			case BPF_LSH:
+			case BPF_RSH:
+			case BPF_NEG:
+				break;
+			case BPF_DIV:
+				/*
+				 * Check for constant division by 0.
+				 */
+				if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
+					return 0;
+				break;
+			default:
+				return 0;
+			}
+			break;
+		case BPF_JMP:
+			/*
+			 * Check that jumps are within the code block,
+			 * and that unconditional branches don't go
+			 * backwards as a result of an overflow.
+			 * Unconditional branches have a 32-bit offset,
+			 * so they could overflow; we check to make
+			 * sure they don't.  Conditional branches have
+			 * an 8-bit offset, and the from address is <=
+			 * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
+			 * is sufficiently small that adding 255 to it
+			 * won't overflow.
+			 *
+			 * We know that len is <= BPF_MAXINSNS, and we
+			 * assume that BPF_MAXINSNS is < the maximum size
+			 * of a u_int, so that i + 1 doesn't overflow.
+			 *
+			 * For userland, we don't know that the from
+			 * or len are <= BPF_MAXINSNS, but we know that
+			 * from <= len, and, except on a 64-bit system,
+			 * it's unlikely that len, if it truly reflects
+			 * the size of the program we've been handed,
+			 * will be anywhere near the maximum size of
+			 * a u_int.  We also don't check for backward
+			 * branches, as we currently support them in
+			 * userland for the protochain operation.
+			 */
+			from = i + 1;
+			switch (BPF_OP(p->code)) {
+			case BPF_JA:
+#if defined(KERNEL) || defined(_KERNEL)
+				if (from + p->k < from || from + p->k >= len)
+#else
+				if (from + p->k >= len)
+#endif
+					return 0;
+				break;
+			case BPF_JEQ:
+			case BPF_JGT:
+			case BPF_JGE:
+			case BPF_JSET:
+				if (from + p->jt >= len || from + p->jf >= len)
+					return 0;
+				break;
+			default:
+				return 0;
+			}
+			break;
+		case BPF_RET:
+			break;
+		case BPF_MISC:
+			break;
+		default:
 			return 0;
+		}
 	}
 	return BPF_CLASS(f[len - 1].code) == BPF_RET;
 }
diff --git a/contrib/libpcap/bpf_dump.c b/contrib/libpcap/bpf_dump.c
index 303602e..5c0033d 100644
--- a/contrib/libpcap/bpf_dump.c
+++ b/contrib/libpcap/bpf_dump.c
@@ -20,7 +20,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14 2003/11/15 23:23:57 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14.4.1 2008/01/02 04:22:16 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -31,9 +31,9 @@ static const char rcsid[] _U_ =
 #include <stdio.h>
 
 void
-bpf_dump(struct bpf_program *p, int option)
+bpf_dump(const struct bpf_program *p, int option)
 {
-	struct bpf_insn *insn;
+	const struct bpf_insn *insn;
 	int i;
 	int n = p->bf_len;
 
diff --git a/contrib/libpcap/bpf_image.c b/contrib/libpcap/bpf_image.c
index 2e76128..91f7cef 100644
--- a/contrib/libpcap/bpf_image.c
+++ b/contrib/libpcap/bpf_image.c
@@ -21,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.26.2.1 2007/06/11 09:52:04 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -39,7 +39,7 @@ static const char rcsid[] _U_ =
 
 char *
 bpf_image(p, n)
-	struct bpf_insn *p;
+	const struct bpf_insn *p;
 	int n;
 {
 	int v;
diff --git a/contrib/libpcap/chmod_bpf b/contrib/libpcap/chmod_bpf
new file mode 100755
index 0000000..0a30d99
--- /dev/null
+++ b/contrib/libpcap/chmod_bpf
@@ -0,0 +1,19 @@
+#! /bin/sh
+
+#
+# Unfortunately, Mac OS X's devfs is based on the old FreeBSD
+# one, not the current one, so there's no way to configure it
+# to create BPF devices with particular owners or groups.
+# This startup item will make it owned by the admin group,
+# with permissions rw-rw----, so that anybody in the admin
+# group can use programs that capture or send raw packets.
+#
+# Change this as appropriate for your site, e.g. to make
+# it owned by a particular user without changing the permissions,
+# so only that user and the super-user can capture or send raw
+# packets, or give it the permissions rw-r-----, so that
+# only the super-user can send raw packets but anybody in the
+# admin group can capture packets.
+#
+chgrp admin /dev/bpf*
+chmod g+rw /dev/bpf*
diff --git a/contrib/libpcap/config.h.in b/contrib/libpcap/config.h.in
index 8aa879c..403cbfa 100644
--- a/contrib/libpcap/config.h.in
+++ b/contrib/libpcap/config.h.in
@@ -19,6 +19,9 @@
 /* define if you have dag_get_erf_types() */
 #undef HAVE_DAG_GET_ERF_TYPES
 
+/* define if you have dag_get_stream_erf_types() */
+#undef HAVE_DAG_GET_STREAM_ERF_TYPES
+
 /* define if you have streams capable DAG API */
 #undef HAVE_DAG_STREAMS_API
 
@@ -29,9 +32,15 @@
 /* define if you have a /dev/dlpi */
 #undef HAVE_DEV_DLPI
 
+/* if passive_req_t primitive exists */
+#undef HAVE_DLPI_PASSIVE
+
 /* Define to 1 if you have the `ether_hostton' function. */
 #undef HAVE_ETHER_HOSTTON
 
+/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
+#undef HAVE_FSEEKO
+
 /* on HP-UX 10.20 or later */
 #undef HAVE_HPUX10_20_OR_LATER
 
@@ -44,9 +53,18 @@
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
+/* if libdlpi exists */
+#undef HAVE_LIBDLPI
+
 /* Define to 1 if you have the <limits.h> header file. */
 #undef HAVE_LIMITS_H
 
+/* if tp_vlan_tci exists */
+#undef HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI
+
+/* Define to 1 if you have the <linux/wireless.h> header file. */
+#undef HAVE_LINUX_WIRELESS_H
+
 /* Define to 1 if you have the <memory.h> header file. */
 #undef HAVE_MEMORY_H
 
@@ -56,6 +74,9 @@
 /* Define to 1 if you have the <netinet/if_ether.h> header file. */
 #undef HAVE_NETINET_IF_ETHER_H
 
+/* Define to 1 if you have the <net/if_media.h> header file. */
+#undef HAVE_NET_IF_MEDIA_H
+
 /* Define to 1 if you have the <net/pfvar.h> header file. */
 #undef HAVE_NET_PFVAR_H
 
@@ -65,6 +86,9 @@
 /* Define to 1 if you have the <paths.h> header file. */
 #undef HAVE_PATHS_H
 
+/* define if net/pfvar.h defines PF_NAT through PF_NORDR */
+#undef HAVE_PF_NAT_THROUGH_PF_NORDR
+
 /* define if you have a /proc/net/dev */
 #undef HAVE_PROC_NET_DEV
 
@@ -80,6 +104,9 @@
 /* if struct sockaddr_storage exists */
 #undef HAVE_SOCKADDR_STORAGE
 
+/* define if socklen_t is defined */
+#undef HAVE_SOCKLEN_T
+
 /* On solaris */
 #undef HAVE_SOLARIS
 
@@ -134,6 +161,9 @@
 /* Define to 1 if you have the `vsnprintf' function. */
 #undef HAVE_VSNPRINTF
 
+/* define if the system supports zerocopy BPF */
+#undef HAVE_ZEROCOPY_BPF
+
 /* define if your compiler has __attribute__ */
 #undef HAVE___ATTRIBUTE__
 
@@ -143,6 +173,9 @@
 /* if unaligned access fails */
 #undef LBL_ALIGN
 
+/* path for device for USB sniffing */
+#undef LINUX_USB_MON_DEV
+
 /* Define to 1 if netinet/ether.h declares `ether_hostton' */
 #undef NETINET_ETHER_H_DECLARES_ETHER_HOSTTON
 
@@ -170,15 +203,33 @@
 /* /dev/dlpi directory */
 #undef PCAP_DEV_PREFIX
 
+/* target host supports Bluetooth sniffing */
+#undef PCAP_SUPPORT_BT
+
+/* target host supports USB sniffing */
+#undef PCAP_SUPPORT_USB
+
+/* include ACN support */
+#undef SITA
+
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
 /* Enable parser debugging */
 #undef YYDEBUG
 
+/* Number of bits in a file offset, on hosts where this is settable. */
+#undef _FILE_OFFSET_BITS
+
 /* needed on HP-UX */
 #undef _HPUX_SOURCE
 
+/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
+#undef _LARGEFILE_SOURCE
+
+/* Define for large files, on AIX-style hosts. */
+#undef _LARGE_FILES
+
 /* define on AIX to get certain functions */
 #undef _SUN
 
@@ -194,5 +245,8 @@
 /* if we have u_int32_t */
 #undef u_int32_t
 
+/* if we have u_int64_t */
+#undef u_int64_t
+
 /* if we have u_int8_t */
 #undef u_int8_t
diff --git a/contrib/libpcap/configure b/contrib/libpcap/configure
index 38e035e..bd8da0b 100755
--- a/contrib/libpcap/configure
+++ b/contrib/libpcap/configure
@@ -1,5 +1,5 @@
 #! /bin/sh
-# From configure.in Revision: 1.120.2.13 .
+# From configure.in Revision: 1.138.2.22 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.61.
 #
@@ -684,10 +684,16 @@ V_INCLS
 V_LIBS
 V_PCAP
 V_FINDALLDEVS
-V_RANLIB
 SSRC
 DYEXT
 DAGLIBS
+DEPLIBS
+MAN_FILE_FORMATS
+MAN_MISC_INFO
+PCAP_SUPPORT_USB
+USB_SRC
+PCAP_SUPPORT_BT
+BT_SRC
 INSTALL_PROGRAM
 INSTALL_SCRIPT
 INSTALL_DATA
@@ -1275,8 +1281,9 @@ if test -n "$ac_init_help"; then
 Optional Features:
   --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
   --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
+  --disable-largefile     omit support for large files
   --disable-protochain    disable \"protochain\" insn
-  --enable-ipv6           build IPv6-capable version
+  --enable-ipv6           build IPv6-capable version [default=yes, if getaddrinfo available]
   --enable-optimizer-dbg  build optimizer debugging code
   --enable-yydebug        build parser debugging code
 
@@ -1284,6 +1291,7 @@ Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
   --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
   --without-gcc           don't use gcc
+  --with-sita             include SITA support
   --with-pcap=TYPE        use packet capture TYPE
   --with-dag[=DIR]        include Endace DAG support ("yes", "no" or DIR; default="yes" on BSD and Linux if present)
   --with-dag-includes=DIR   Endace DAG include directory
@@ -1902,7 +1910,7 @@ fi
 	    LBL_CFLAGS="$CFLAGS"
     fi
     if test -z "$CC" ; then
-	    case "$target_os" in
+	    case "$host_os" in
 
 	    bsdi*)
 		    # Extract the first word of "shlicc2", so it can be a program name with args.
@@ -2949,7 +2957,7 @@ fi
 	    { echo "$as_me:$LINENO: result: $ac_cv_lbl_cc_ansi_prototypes" >&5
 echo "${ECHO_T}$ac_cv_lbl_cc_ansi_prototypes" >&6; }
 	    if test $ac_cv_lbl_cc_ansi_prototypes = no ; then
-		    case "$target_os" in
+		    case "$host_os" in
 
 		    hpux*)
 			    { echo "$as_me:$LINENO: checking for HP-UX ansi compiler ($CC -Aa -D_HPUX_SOURCE)" >&5
@@ -3028,7 +3036,7 @@ echo "$as_me: error: see the INSTALL doc for more info" >&2;}
 	    V_INCLS="$V_INCLS -I/usr/local/include"
 	    LDFLAGS="$LDFLAGS -L/usr/local/lib"
 
-	    case "$target_os" in
+	    case "$host_os" in
 
 	    irix*)
 		    V_CCOPT="$V_CCOPT -xansi -signed -g3"
@@ -3450,6 +3458,543 @@ cat >>confdefs.h <<\_ACEOF
 _ACEOF
 
     fi
+{ echo "$as_me:$LINENO: checking for u_int64_t using $CC" >&5
+echo $ECHO_N "checking for u_int64_t using $CC... $ECHO_C" >&6; }
+    if test "${ac_cv_lbl_have_u_int64_t+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#	include "confdefs.h"
+#	include <sys/types.h>
+#	if STDC_HEADERS
+#	include <stdlib.h>
+#	include <stddef.h>
+#	endif
+int
+main ()
+{
+u_int64_t i
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_lbl_have_u_int64_t=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_lbl_have_u_int64_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+    { echo "$as_me:$LINENO: result: $ac_cv_lbl_have_u_int64_t" >&5
+echo "${ECHO_T}$ac_cv_lbl_have_u_int64_t" >&6; }
+    if test $ac_cv_lbl_have_u_int64_t = no ; then
+
+cat >>confdefs.h <<\_ACEOF
+#define u_int64_t unsigned long long
+_ACEOF
+
+    fi
+
+#
+# Try to arrange for large file support.
+#
+# Check whether --enable-largefile was given.
+if test "${enable_largefile+set}" = set; then
+  enableval=$enable_largefile;
+fi
+
+if test "$enable_largefile" != no; then
+
+  { echo "$as_me:$LINENO: checking for special C compiler options needed for large files" >&5
+echo $ECHO_N "checking for special C compiler options needed for large files... $ECHO_C" >&6; }
+if test "${ac_cv_sys_largefile_CC+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_cv_sys_largefile_CC=no
+     if test "$GCC" != yes; then
+       ac_save_CC=$CC
+       while :; do
+	 # IRIX 6.2 and later do not support large files by default,
+	 # so use the C compiler's -n32 option if that helps.
+	 cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/types.h>
+ /* Check that off_t can represent 2**63 - 1 correctly.
+    We can't simply define LARGE_OFF_T to be 9223372036854775807,
+    since some C++ compilers masquerading as C compilers
+    incorrectly reject 9223372036854775807.  */
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
+		       && LARGE_OFF_T % 2147483647 == 1)
+		      ? 1 : -1];
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+	 rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext
+	 CC="$CC -n32"
+	 rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_sys_largefile_CC=' -n32'; break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext
+	 break
+       done
+       CC=$ac_save_CC
+       rm -f conftest.$ac_ext
+    fi
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sys_largefile_CC" >&5
+echo "${ECHO_T}$ac_cv_sys_largefile_CC" >&6; }
+  if test "$ac_cv_sys_largefile_CC" != no; then
+    CC=$CC$ac_cv_sys_largefile_CC
+  fi
+
+  { echo "$as_me:$LINENO: checking for _FILE_OFFSET_BITS value needed for large files" >&5
+echo $ECHO_N "checking for _FILE_OFFSET_BITS value needed for large files... $ECHO_C" >&6; }
+if test "${ac_cv_sys_file_offset_bits+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  while :; do
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/types.h>
+ /* Check that off_t can represent 2**63 - 1 correctly.
+    We can't simply define LARGE_OFF_T to be 9223372036854775807,
+    since some C++ compilers masquerading as C compilers
+    incorrectly reject 9223372036854775807.  */
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
+		       && LARGE_OFF_T % 2147483647 == 1)
+		      ? 1 : -1];
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_sys_file_offset_bits=no; break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#define _FILE_OFFSET_BITS 64
+#include <sys/types.h>
+ /* Check that off_t can represent 2**63 - 1 correctly.
+    We can't simply define LARGE_OFF_T to be 9223372036854775807,
+    since some C++ compilers masquerading as C compilers
+    incorrectly reject 9223372036854775807.  */
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
+		       && LARGE_OFF_T % 2147483647 == 1)
+		      ? 1 : -1];
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_sys_file_offset_bits=64; break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  ac_cv_sys_file_offset_bits=unknown
+  break
+done
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sys_file_offset_bits" >&5
+echo "${ECHO_T}$ac_cv_sys_file_offset_bits" >&6; }
+case $ac_cv_sys_file_offset_bits in #(
+  no | unknown) ;;
+  *)
+cat >>confdefs.h <<_ACEOF
+#define _FILE_OFFSET_BITS $ac_cv_sys_file_offset_bits
+_ACEOF
+;;
+esac
+rm -f conftest*
+  if test $ac_cv_sys_file_offset_bits = unknown; then
+    { echo "$as_me:$LINENO: checking for _LARGE_FILES value needed for large files" >&5
+echo $ECHO_N "checking for _LARGE_FILES value needed for large files... $ECHO_C" >&6; }
+if test "${ac_cv_sys_large_files+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  while :; do
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/types.h>
+ /* Check that off_t can represent 2**63 - 1 correctly.
+    We can't simply define LARGE_OFF_T to be 9223372036854775807,
+    since some C++ compilers masquerading as C compilers
+    incorrectly reject 9223372036854775807.  */
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
+		       && LARGE_OFF_T % 2147483647 == 1)
+		      ? 1 : -1];
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_sys_large_files=no; break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#define _LARGE_FILES 1
+#include <sys/types.h>
+ /* Check that off_t can represent 2**63 - 1 correctly.
+    We can't simply define LARGE_OFF_T to be 9223372036854775807,
+    since some C++ compilers masquerading as C compilers
+    incorrectly reject 9223372036854775807.  */
+#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62))
+  int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721
+		       && LARGE_OFF_T % 2147483647 == 1)
+		      ? 1 : -1];
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_sys_large_files=1; break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+  ac_cv_sys_large_files=unknown
+  break
+done
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sys_large_files" >&5
+echo "${ECHO_T}$ac_cv_sys_large_files" >&6; }
+case $ac_cv_sys_large_files in #(
+  no | unknown) ;;
+  *)
+cat >>confdefs.h <<_ACEOF
+#define _LARGE_FILES $ac_cv_sys_large_files
+_ACEOF
+;;
+esac
+rm -f conftest*
+  fi
+fi
+
+{ echo "$as_me:$LINENO: checking for _LARGEFILE_SOURCE value needed for large files" >&5
+echo $ECHO_N "checking for _LARGEFILE_SOURCE value needed for large files... $ECHO_C" >&6; }
+if test "${ac_cv_sys_largefile_source+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  while :; do
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdio.h>
+int
+main ()
+{
+return fseeko (stdin, 0, 0) && (fseeko) (stdin, 0, 0);
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext &&
+       $as_test_x conftest$ac_exeext; then
+  ac_cv_sys_largefile_source=no; break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#define _LARGEFILE_SOURCE 1
+#include <stdio.h>
+int
+main ()
+{
+return fseeko (stdin, 0, 0) && (fseeko) (stdin, 0, 0);
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext &&
+       $as_test_x conftest$ac_exeext; then
+  ac_cv_sys_largefile_source=1; break
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
+  ac_cv_sys_largefile_source=unknown
+  break
+done
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_sys_largefile_source" >&5
+echo "${ECHO_T}$ac_cv_sys_largefile_source" >&6; }
+case $ac_cv_sys_largefile_source in #(
+  no | unknown) ;;
+  *)
+cat >>confdefs.h <<_ACEOF
+#define _LARGEFILE_SOURCE $ac_cv_sys_largefile_source
+_ACEOF
+;;
+esac
+rm -f conftest*
+
+# We used to try defining _XOPEN_SOURCE=500 too, to work around a bug
+# in glibc 2.1.3, but that breaks too many other things.
+# If you want fseeko and ftello with glibc, upgrade to a fixed glibc.
+if test $ac_cv_sys_largefile_source != unknown; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_FSEEKO 1
+_ACEOF
+
+fi
+
 
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -4290,6 +4835,66 @@ fi
 
 done
 
+if test "$ac_cv_header_net_pfvar_h" = yes; then
+	#
+	# Check for various PF actions.
+	#
+	{ echo "$as_me:$LINENO: checking whether net/pfvar.h defines PF_NAT through PF_NORDR" >&5
+echo $ECHO_N "checking whether net/pfvar.h defines PF_NAT through PF_NORDR... $ECHO_C" >&6; }
+	cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/types.h>
+	    #include <sys/socket.h>
+	    #include <net/if.h>
+	    #include <net/pfvar.h>
+int
+main ()
+{
+return PF_NAT+PF_NONAT+PF_BINAT+PF_NOBINAT+PF_RDR+PF_NORDR;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+
+		{ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_PF_NAT_THROUGH_PF_NORDR 1
+_ACEOF
+
+
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
 
 for ac_header in netinet/if_ether.h
 do
@@ -5622,6 +6227,26 @@ fi
 { echo "$as_me:$LINENO: result: ${enable_protochain}" >&5
 echo "${ECHO_T}${enable_protochain}" >&6; }
 
+#
+# SITA support is mutually exclusive with native capture support;
+# "--with-sita" selects SITA support.
+#
+
+# Check whether --with-sita was given.
+if test "${with_sita+set}" = set; then
+  withval=$with_sita;
+
+cat >>confdefs.h <<\_ACEOF
+#define SITA 1
+_ACEOF
+
+	{ echo "$as_me:$LINENO: Enabling SITA ACN support" >&5
+echo "$as_me: Enabling SITA ACN support" >&6;}
+	V_PCAP=sita
+	V_FINDALLDEVS=sita
+
+else
+
 if test -z "$with_pcap" && test "$cross_compiling" = yes; then
 	{ { echo "$as_me:$LINENO: error: pcap type not determined when cross-compiling; use --with-pcap=..." >&5
 echo "$as_me: error: pcap type not determined when cross-compiling; use --with-pcap=..." >&2;}
@@ -5682,6 +6307,829 @@ fi
 { echo "$as_me:$LINENO: result: $V_PCAP" >&5
 echo "${ECHO_T}$V_PCAP" >&6; }
 
+#
+# Do capture-mechanism-dependent tests.
+#
+case "$V_PCAP" in
+dlpi)
+	#
+	# Checks to see if Solaris has the public libdlpi(3LIB) library.
+	# Note: The existence of /usr/include/libdlpi.h does not mean it is the
+	# public libdlpi(3LIB) version. Before libdlpi was made public, a
+	# private version also existed, which did not have the same APIs.
+	# Due to a gcc bug, the default search path for 32-bit libraries does
+	# not include /lib, we add it explicitly here.
+	# [http://bugs.opensolaris.org/view_bug.do?bug_id=6619485].
+	# Also, due to the bug above applications that link to libpcap with
+	# libdlpi will have to add "-L/lib" option to "configure".
+	#
+	saved_ldflags=$LDFLAGS
+	LDFLAGS="$LIBS -L/lib"
+	{ echo "$as_me:$LINENO: checking for dlpi_walk in -ldlpi" >&5
+echo $ECHO_N "checking for dlpi_walk in -ldlpi... $ECHO_C" >&6; }
+if test "${ac_cv_lib_dlpi_dlpi_walk+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-ldlpi  $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char dlpi_walk ();
+int
+main ()
+{
+return dlpi_walk ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext &&
+       $as_test_x conftest$ac_exeext; then
+  ac_cv_lib_dlpi_dlpi_walk=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_lib_dlpi_dlpi_walk=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_dlpi_dlpi_walk" >&5
+echo "${ECHO_T}$ac_cv_lib_dlpi_dlpi_walk" >&6; }
+if test $ac_cv_lib_dlpi_dlpi_walk = yes; then
+  LIBS="-ldlpi $LIBS"
+		V_PCAP=libdlpi
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_LIBDLPI 1
+_ACEOF
+
+else
+  V_PCAP=dlpi
+fi
+
+	LDFLAGS=$saved_ldflags
+
+	#
+	# Checks whether <sys/dlpi.h> is usable, to catch weird SCO
+	# versions of DLPI.
+	#
+	{ echo "$as_me:$LINENO: checking whether <sys/dlpi.h> is usable" >&5
+echo $ECHO_N "checking whether <sys/dlpi.h> is usable... $ECHO_C" >&6; }
+	if test "${ac_cv_sys_dlpi_usable+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+			#include <sys/types.h>
+			#include <sys/time.h>
+			#include <sys/dlpi.h>
+
+int
+main ()
+{
+int i = DL_PROMISC_PHYS;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_sys_dlpi_usable=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_sys_dlpi_usable=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+	{ echo "$as_me:$LINENO: result: $ac_cv_sys_dlpi_usable" >&5
+echo "${ECHO_T}$ac_cv_sys_dlpi_usable" >&6; }
+	if test $ac_cv_sys_dlpi_usable = no ; then
+		{ { echo "$as_me:$LINENO: error: <sys/dlpi.h> is not usable on this system; it probably has a non-standard DLPI" >&5
+echo "$as_me: error: <sys/dlpi.h> is not usable on this system; it probably has a non-standard DLPI" >&2;}
+   { (exit 1); exit 1; }; }
+	fi
+
+	#
+	# Check whether we have a /dev/dlpi device or have multiple devices.
+	#
+	{ echo "$as_me:$LINENO: checking for /dev/dlpi device" >&5
+echo $ECHO_N "checking for /dev/dlpi device... $ECHO_C" >&6; }
+	if test -c /dev/dlpi ; then
+		{ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_DEV_DLPI 1
+_ACEOF
+
+	else
+		{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+		dir="/dev/dlpi"
+		{ echo "$as_me:$LINENO: checking for $dir directory" >&5
+echo $ECHO_N "checking for $dir directory... $ECHO_C" >&6; }
+		if test -d $dir ; then
+			{ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+
+cat >>confdefs.h <<_ACEOF
+#define PCAP_DEV_PREFIX "$dir"
+_ACEOF
+
+		else
+			{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+		fi
+	fi
+
+	#
+	# This check is for Solaris with DLPI support for passive modes.
+	# See dlpi(7P) for more details.
+	#
+	{ echo "$as_me:$LINENO: checking if dl_passive_req_t struct exists" >&5
+echo $ECHO_N "checking if dl_passive_req_t struct exists... $ECHO_C" >&6; }
+       if test "${ac_cv_lbl_has_dl_passive_req_t+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#       include <sys/types.h>
+#       include <sys/dlpi.h>
+int
+main ()
+{
+u_int i = sizeof(dl_passive_req_t)
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_lbl_has_dl_passive_req_t=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_lbl_has_dl_passive_req_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+    { echo "$as_me:$LINENO: result: $ac_cv_lbl_has_dl_passive_req_t" >&5
+echo "${ECHO_T}$ac_cv_lbl_has_dl_passive_req_t" >&6; }
+    if test $ac_cv_lbl_has_dl_passive_req_t = yes ; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_DLPI_PASSIVE 1
+_ACEOF
+
+    fi
+	;;
+
+linux)
+	{ echo "$as_me:$LINENO: checking Linux kernel version" >&5
+echo $ECHO_N "checking Linux kernel version... $ECHO_C" >&6; }
+ 	if test "$cross_compiling" = yes; then
+ 		if test "${ac_cv_linux_vers+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_cv_linux_vers=unknown
+fi
+
+ 	else
+ 		if test "${ac_cv_linux_vers+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_cv_linux_vers=`uname -r 2>&1 | \
+ 			sed -n -e '$s/.* //' -e '$s/\..*//p'`
+fi
+
+ 	fi
+	{ echo "$as_me:$LINENO: result: $ac_cv_linux_vers" >&5
+echo "${ECHO_T}$ac_cv_linux_vers" >&6; }
+ 	if test $ac_cv_linux_vers = unknown ; then
+ 		{ { echo "$as_me:$LINENO: error: cannot determine linux version when cross-compiling" >&5
+echo "$as_me: error: cannot determine linux version when cross-compiling" >&2;}
+   { (exit 1); exit 1; }; }
+ 	fi
+	if test $ac_cv_linux_vers -lt 2 ; then
+		{ { echo "$as_me:$LINENO: error: version 2 or higher required; see the INSTALL doc for more info" >&5
+echo "$as_me: error: version 2 or higher required; see the INSTALL doc for more info" >&2;}
+   { (exit 1); exit 1; }; }
+	fi
+
+for ac_header in linux/wireless.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <sys/socket.h>
+#include <net/if.h>
+#include <linux/types.h>
+
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  eval "$as_ac_Header=yes"
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+	for ac_header in
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+  # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_header_compiler=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } >/dev/null && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       }; then
+  ac_header_preproc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+  ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+  yes:no: )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+    ac_header_preproc=yes
+    ;;
+  no:yes:* )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header:     check for missing prerequisite headers?" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+
+    ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+	{ echo "$as_me:$LINENO: checking if if_packet.h has tpacket_stats defined" >&5
+echo $ECHO_N "checking if if_packet.h has tpacket_stats defined... $ECHO_C" >&6; }
+   if test "${ac_cv_lbl_tpacket_stats+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#  include <linux/if_packet.h>
+int
+main ()
+{
+struct tpacket_stats stats
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_lbl_tpacket_stats=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_lbl_tpacket_stats=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+   { echo "$as_me:$LINENO: result: $ac_cv_lbl_tpacket_stats" >&5
+echo "${ECHO_T}$ac_cv_lbl_tpacket_stats" >&6; }
+   if test $ac_cv_lbl_tpacket_stats = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_TPACKET_STATS 1
+_ACEOF
+
+   fi
+	{ echo "$as_me:$LINENO: checking if tpacket_auxdata struct has tp_vlan_tci member" >&5
+echo $ECHO_N "checking if tpacket_auxdata struct has tp_vlan_tci member... $ECHO_C" >&6; }
+    if test "${ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#	include <linux/if_packet.h>
+int
+main ()
+{
+u_int i = sizeof(((struct tpacket_auxdata *)0)->tp_vlan_tci)
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_lbl_linux_tpacket_auxdata_tp_vlan_tci=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_lbl_linux_tpacket_auxdata_tp_vlan_tci=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+    { echo "$as_me:$LINENO: result: $ac_cv_lbl_linux_tpacket_auxdata_tp_vlan_tci" >&5
+echo "${ECHO_T}$ac_cv_lbl_linux_tpacket_auxdata_tp_vlan_tci" >&6; }
+    if test $ac_cv_lbl_linux_tpacket_auxdata_tp_vlan_tci = yes ; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI 1
+_ACEOF
+
+    fi
+	;;
+
+bpf)
+	#
+	# Check whether we have the *BSD-style ioctls.
+	#
+
+for ac_header in net/if_media.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+  # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_header_compiler=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } >/dev/null && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       }; then
+  ac_header_preproc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+  ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+  yes:no: )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+    ac_header_preproc=yes
+    ;;
+  no:yes:* )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header:     check for missing prerequisite headers?" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+
+    ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+
+	{ echo "$as_me:$LINENO: checking whether the system supports zerocopy BPF" >&5
+echo $ECHO_N "checking whether the system supports zerocopy BPF... $ECHO_C" >&6; }
+	cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/socket.h>
+	    #include <sys/ioctl.h>
+	    #include <net/if.h>
+	    #include <net/bpf.h>
+int
+main ()
+{
+return (BIOCROTZBUF + BPF_BUFMODE_ZBUF);
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+
+		{ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ZEROCOPY_BPF 1
+_ACEOF
+
+
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+	;;
+
+dag)
+	V_DEFS="$V_DEFS -DDAG_ONLY"
+	;;
+
+septel)
+	V_DEFS="$V_DEFS -DSEPTEL_ONLY"
+	;;
+
+null)
+	{ echo "$as_me:$LINENO: WARNING: cannot determine packet capture interface" >&5
+echo "$as_me: WARNING: cannot determine packet capture interface" >&2;}
+	{ echo "$as_me:$LINENO: WARNING: (see the INSTALL doc for more info)" >&5
+echo "$as_me: WARNING: (see the INSTALL doc for more info)" >&2;}
+	;;
+esac
+
 if test "$V_PCAP" = null
 then
 	#
@@ -5940,142 +7388,7 @@ else
 		#
 		case "$V_PCAP" in
 
-		dlpi)
-			#
-			# This might be Solaris 8 or later, with
-			# SIOCGLIFCONF, or it might be some other OS
-			# or some older version of Solaris, with
-			# just SIOCGIFCONF.
-			#
-			{ echo "$as_me:$LINENO: checking whether we have SIOCGLIFCONF" >&5
-echo $ECHO_N "checking whether we have SIOCGLIFCONF... $ECHO_C" >&6; }
-			if test "${ac_cv_lbl_have_siocglifconf+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-#include <sys/param.h>
-				#include <sys/file.h>
-				#include <sys/ioctl.h>
-				#include <sys/socket.h>
-				#include <sys/sockio.h>
-int
-main ()
-{
-ioctl(0, SIOCGLIFCONF, (char *)0);
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext
-if { (ac_try="$ac_compile"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_compile") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then
-  ac_cv_lbl_have_siocglifconf=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	ac_cv_lbl_have_siocglifconf=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-
-			{ echo "$as_me:$LINENO: result: $ac_cv_lbl_have_siocglifconf" >&5
-echo "${ECHO_T}$ac_cv_lbl_have_siocglifconf" >&6; }
-			if test $ac_cv_lbl_have_siocglifconf = yes ; then
-				V_FINDALLDEVS=glifc
-			else
-				V_FINDALLDEVS=gifc
-			fi
-			;;
-
-		*)
-			#
-			# Assume we just have SIOCGIFCONF.
-			# (XXX - on at least later Linux kernels, there's
-			# another mechanism, and we should be using that
-			# instead.)
-			#
-			V_FINDALLDEVS=gifc
-			;;
-		esac
-fi
-
-fi
-
-{ echo "$as_me:$LINENO: checking if --enable-ipv6 option is specified" >&5
-echo $ECHO_N "checking if --enable-ipv6 option is specified... $ECHO_C" >&6; }
-# Check whether --enable-ipv6 was given.
-if test "${enable_ipv6+set}" = set; then
-  enableval=$enable_ipv6;
-fi
-
-if test "$enable_ipv6" = "yes"; then
-
-cat >>confdefs.h <<\_ACEOF
-#define INET6 1
-_ACEOF
-
-fi
-{ echo "$as_me:$LINENO: result: ${enable_ipv6-no}" >&5
-echo "${ECHO_T}${enable_ipv6-no}" >&6; }
-
-{ echo "$as_me:$LINENO: checking whether to build optimizer debugging code" >&5
-echo $ECHO_N "checking whether to build optimizer debugging code... $ECHO_C" >&6; }
-# Check whether --enable-optimizer-dbg was given.
-if test "${enable_optimizer_dbg+set}" = set; then
-  enableval=$enable_optimizer_dbg;
-fi
-
-if test "$enable_optimizer_dbg" = "yes"; then
-
-cat >>confdefs.h <<\_ACEOF
-#define BDEBUG 1
-_ACEOF
-
-fi
-{ echo "$as_me:$LINENO: result: ${enable_optimizer_dbg-no}" >&5
-echo "${ECHO_T}${enable_optimizer_dbg-no}" >&6; }
-
-{ echo "$as_me:$LINENO: checking whether to build parser debugging code" >&5
-echo $ECHO_N "checking whether to build parser debugging code... $ECHO_C" >&6; }
-# Check whether --enable-yydebug was given.
-if test "${enable_yydebug+set}" = set; then
-  enableval=$enable_yydebug;
-fi
-
-if test "$enable_yydebug" = "yes"; then
-
-cat >>confdefs.h <<\_ACEOF
-#define YYDEBUG 1
-_ACEOF
-
-fi
-{ echo "$as_me:$LINENO: result: ${enable_yydebug-no}" >&5
-echo "${ECHO_T}${enable_yydebug-no}" >&6; }
-
-case "$V_PCAP" in
-
-dlpi)
+		dlpi|libdlpi)
 
 
 for ac_header in sys/bufmod.h sys/dlpi_ext.h
@@ -6217,71 +7530,161 @@ fi
 
 done
 
-	{ echo "$as_me:$LINENO: checking for /dev/dlpi device" >&5
-echo $ECHO_N "checking for /dev/dlpi device... $ECHO_C" >&6; }
-	if test -c /dev/dlpi ; then
-		{ echo "$as_me:$LINENO: result: yes" >&5
-echo "${ECHO_T}yes" >&6; }
-
-cat >>confdefs.h <<\_ACEOF
-#define HAVE_DEV_DLPI 1
+			#
+			# This might be Solaris 8 or later, with
+			# SIOCGLIFCONF, or it might be some other OS
+			# or some older version of Solaris, with
+			# just SIOCGIFCONF.
+			#
+			{ echo "$as_me:$LINENO: checking whether we have SIOCGLIFCONF" >&5
+echo $ECHO_N "checking whether we have SIOCGLIFCONF... $ECHO_C" >&6; }
+			if test "${ac_cv_lbl_have_siocglifconf+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
 _ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/param.h>
+				#include <sys/file.h>
+				#include <sys/ioctl.h>
+				#include <sys/socket.h>
+				#include <sys/sockio.h>
+int
+main ()
+{
+ioctl(0, SIOCGLIFCONF, (char *)0);
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_lbl_have_siocglifconf=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
 
-	else
-		{ echo "$as_me:$LINENO: result: no" >&5
-echo "${ECHO_T}no" >&6; }
-		dir="/dev/dlpi"
-		{ echo "$as_me:$LINENO: checking for $dir directory" >&5
-echo $ECHO_N "checking for $dir directory... $ECHO_C" >&6; }
-		if test -d $dir ; then
-			{ echo "$as_me:$LINENO: result: yes" >&5
-echo "${ECHO_T}yes" >&6; }
+	ac_cv_lbl_have_siocglifconf=no
+fi
 
-cat >>confdefs.h <<_ACEOF
-#define PCAP_DEV_PREFIX "$dir"
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+			{ echo "$as_me:$LINENO: result: $ac_cv_lbl_have_siocglifconf" >&5
+echo "${ECHO_T}$ac_cv_lbl_have_siocglifconf" >&6; }
+			if test $ac_cv_lbl_have_siocglifconf = yes ; then
+				V_FINDALLDEVS=glifc
+			else
+				V_FINDALLDEVS=gifc
+			fi
+			#
+			# Needed for common functions used by pcap-[dlpi,libdlpi].c
+			#
+		 	SSRC="dlpisubs.c"
+			;;
+
+		*)
+			#
+			# Assume we just have SIOCGIFCONF.
+			# (XXX - on at least later Linux kernels, there's
+			# another mechanism, and we should be using that
+			# instead.)
+			#
+			V_FINDALLDEVS=gifc
+			;;
+		esac
+fi
+
+fi
+
+fi
+
+
+{ echo "$as_me:$LINENO: checking for socklen_t" >&5
+echo $ECHO_N "checking for socklen_t... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
 _ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
 
-		else
-			{ echo "$as_me:$LINENO: result: no" >&5
-echo "${ECHO_T}no" >&6; }
-		fi
-	fi
-	;;
+	#include <sys/types.h>
+	#include <sys/socket.h>
 
-linux)
-	{ echo "$as_me:$LINENO: checking Linux kernel version" >&5
-echo $ECHO_N "checking Linux kernel version... $ECHO_C" >&6; }
- 	if test "$cross_compiling" = yes; then
- 		if test "${ac_cv_linux_vers+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
+int
+main ()
+{
+ socklen_t x;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  have_socklen_t=yes
 else
-  ac_cv_linux_vers=unknown
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	have_socklen_t=no
 fi
 
- 	else
- 		if test "${ac_cv_linux_vers+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+if test "x$have_socklen_t" = "xyes"; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_SOCKLEN_T 1
+_ACEOF
+
+fi
+{ echo "$as_me:$LINENO: result: $have_socklen_t" >&5
+echo "${ECHO_T}$have_socklen_t" >&6; }
+
+# Check whether --enable-ipv6 was given.
+if test "${enable_ipv6+set}" = set; then
+  enableval=$enable_ipv6;
 else
-  ac_cv_linux_vers=`uname -r 2>&1 | \
- 			sed -n -e '$s/.* //' -e '$s/\..*//p'`
+  enable_ipv6=ifavailable
 fi
 
- 	fi
-	{ echo "$as_me:$LINENO: result: $ac_cv_linux_vers" >&5
-echo "${ECHO_T}$ac_cv_linux_vers" >&6; }
- 	if test $ac_cv_linux_vers = unknown ; then
- 		{ { echo "$as_me:$LINENO: error: cannot determine linux version when cross-compiling" >&5
-echo "$as_me: error: cannot determine linux version when cross-compiling" >&2;}
-   { (exit 1); exit 1; }; }
- 	fi
-	if test $ac_cv_linux_vers -lt 2 ; then
-		{ { echo "$as_me:$LINENO: error: version 2 or higher required; see the INSTALL doc for more info" >&5
-echo "$as_me: error: version 2 or higher required; see the INSTALL doc for more info" >&2;}
-   { (exit 1); exit 1; }; }
-	fi
-	{ echo "$as_me:$LINENO: checking if if_packet.h has tpacket_stats defined" >&5
-echo $ECHO_N "checking if if_packet.h has tpacket_stats defined... $ECHO_C" >&6; }
-   if test "${ac_cv_lbl_tpacket_stats+set}" = set; then
+if test "$enable_ipv6" != "no"; then
+	{ echo "$as_me:$LINENO: checking for getaddrinfo" >&5
+echo $ECHO_N "checking for getaddrinfo... $ECHO_C" >&6; }
+if test "${ac_cv_func_getaddrinfo+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
@@ -6290,24 +7693,53 @@ _ACEOF
 cat confdefs.h >>conftest.$ac_ext
 cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
+/* Define getaddrinfo to an innocuous variant, in case <limits.h> declares getaddrinfo.
+   For example, HP-UX 11i <limits.h> declares gettimeofday.  */
+#define getaddrinfo innocuous_getaddrinfo
+
+/* System header to define __stub macros and hopefully few prototypes,
+    which can conflict with char getaddrinfo (); below.
+    Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+    <limits.h> exists even on freestanding compilers.  */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef getaddrinfo
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char getaddrinfo ();
+/* The GNU C library defines this for functions which it implements
+    to always fail with ENOSYS.  Some functions are actually named
+    something starting with __ and the normal name is an alias.  */
+#if defined __stub_getaddrinfo || defined __stub___getaddrinfo
+choke me
+#endif
 
-#  include <linux/if_packet.h>
 int
 main ()
 {
-struct tpacket_stats stats
+return getaddrinfo ();
   ;
   return 0;
 }
 _ACEOF
-rm -f conftest.$ac_objext
-if { (ac_try="$ac_compile"
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
 case "(($ac_try" in
   *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
   *) ac_try_echo=$ac_try;;
 esac
 eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_compile") 2>conftest.er1
+  (eval "$ac_link") 2>conftest.er1
   ac_status=$?
   grep -v '^ *+' conftest.er1 >conftest.err
   rm -f conftest.er1
@@ -6316,45 +7748,76 @@ eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
   (exit $ac_status); } && {
 	 test -z "$ac_c_werror_flag" ||
 	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then
-  ac_cv_lbl_tpacket_stats=yes
+       } && test -s conftest$ac_exeext &&
+       $as_test_x conftest$ac_exeext; then
+  ac_cv_func_getaddrinfo=yes
 else
   echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-	ac_cv_lbl_tpacket_stats=no
+	ac_cv_func_getaddrinfo=no
 fi
 
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
 fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_getaddrinfo" >&5
+echo "${ECHO_T}$ac_cv_func_getaddrinfo" >&6; }
+if test $ac_cv_func_getaddrinfo = yes; then
 
-   { echo "$as_me:$LINENO: result: $ac_cv_lbl_tpacket_stats" >&5
-echo "${ECHO_T}$ac_cv_lbl_tpacket_stats" >&6; }
-   if test $ac_cv_lbl_tpacket_stats = yes; then
 
 cat >>confdefs.h <<\_ACEOF
-#define HAVE_TPACKET_STATS 1
+#define INET6 1
 _ACEOF
 
-   fi
-	;;
 
-dag)
-	V_DEFS="$V_DEFS -DDAG_ONLY"
-	;;
+else
 
-septel)
-	V_DEFS="$V_DEFS -DSEPTEL_ONLY"
-	;;
+		if test "$enable_ipv6" != "ifavailable"; then
+			{ { echo "$as_me:$LINENO: error: --enable-ipv6 was given, but getaddrinfo isn't available
+See \`config.log' for more details." >&5
+echo "$as_me: error: --enable-ipv6 was given, but getaddrinfo isn't available
+See \`config.log' for more details." >&2;}
+   { (exit 1); exit 1; }; }
+		fi
 
-null)
-	{ echo "$as_me:$LINENO: WARNING: cannot determine packet capture interface" >&5
-echo "$as_me: WARNING: cannot determine packet capture interface" >&2;}
-	{ echo "$as_me:$LINENO: WARNING: (see the INSTALL doc for more info)" >&5
-echo "$as_me: WARNING: (see the INSTALL doc for more info)" >&2;}
-	;;
+fi
 
-esac
+fi
+
+{ echo "$as_me:$LINENO: checking whether to build optimizer debugging code" >&5
+echo $ECHO_N "checking whether to build optimizer debugging code... $ECHO_C" >&6; }
+# Check whether --enable-optimizer-dbg was given.
+if test "${enable_optimizer_dbg+set}" = set; then
+  enableval=$enable_optimizer_dbg;
+fi
+
+if test "$enable_optimizer_dbg" = "yes"; then
+
+cat >>confdefs.h <<\_ACEOF
+#define BDEBUG 1
+_ACEOF
+
+fi
+{ echo "$as_me:$LINENO: result: ${enable_optimizer_dbg-no}" >&5
+echo "${ECHO_T}${enable_optimizer_dbg-no}" >&6; }
+
+{ echo "$as_me:$LINENO: checking whether to build parser debugging code" >&5
+echo $ECHO_N "checking whether to build parser debugging code... $ECHO_C" >&6; }
+# Check whether --enable-yydebug was given.
+if test "${enable_yydebug+set}" = set; then
+  enableval=$enable_yydebug;
+fi
+
+if test "$enable_yydebug" = "yes"; then
+
+cat >>confdefs.h <<\_ACEOF
+#define YYDEBUG 1
+_ACEOF
+
+fi
+{ echo "$as_me:$LINENO: result: ${enable_yydebug-no}" >&5
+echo "${ECHO_T}${enable_yydebug-no}" >&6; }
 
 { echo "$as_me:$LINENO: checking whether we have /proc/net/dev" >&5
 echo $ECHO_N "checking whether we have /proc/net/dev... $ECHO_C" >&6; }
@@ -6491,11 +7954,11 @@ echo $ECHO_N "checking dagapi.o... $ECHO_C" >&6; }
 		dagapi_obj=$dag_lib_dir/dagapi.o
 	elif test -r $dag_lib_dir/libdag.a; then
 		# 2.5.x.
-		ar x $dag_lib_dir/libdag.a dagapi.o
+		ar x $dag_lib_dir/libdag.a dagapi.o 2>/dev/null
 		if test -r ./dagapi.o; then
 		    dagapi_obj=./dagapi.o
 		else
-		    ar x $dag_lib_dir/libdag.a libdag_la-dagapi.o
+		    ar x $dag_lib_dir/libdag.a libdag_la-dagapi.o 2>/dev/null
 		    if test -r ./libdag_la-dagapi.o; then
 		       dagapi_obj=./libdag_la-dagapi.o
 		    fi
@@ -6525,11 +7988,11 @@ echo $ECHO_N "checking dagopts.o... $ECHO_C" >&6; }
 		dagopts_obj=$dag_lib_dir/dagopts.o
 	elif test -r $dag_lib_dir/libdag.a; then
 		# 2.5.x.
-		ar x $dag_lib_dir/libdag.a dagopts.o
+		ar x $dag_lib_dir/libdag.a dagopts.o 2>/dev/null
 		if test -r ./dagopts.o; then
 		    dagopts_obj=./dagopts.o
 		else
-		    ar x $dag_lib_dir/libdag.a libdag_la-dagopts.o
+		    ar x $dag_lib_dir/libdag.a libdag_la-dagopts.o 2>/dev/null
 		    if test -r ./libdag_la-dagopts.o; then
 		       dagopts_obj=./libdag_la-dagopts.o
 		    fi
@@ -6557,11 +8020,11 @@ echo $ECHO_N "checking dagreg.o... $ECHO_C" >&6; }
 			dagreg_obj=$dag_lib_dir/dagreg.o
 		elif test -r $dag_lib_dir/libdag.a; then
 			# Extract from libdag.a.
-			ar x $dag_lib_dir/libdag.a dagreg.o
+			ar x $dag_lib_dir/libdag.a dagreg.o 2>/dev/null
 			if test -r ./dagreg.o; then
 				dagreg_obj=./dagreg.o
 			else
-				ar x $dag_lib_dir/libdag.a libdag_la-dagreg.o
+				ar x $dag_lib_dir/libdag.a libdag_la-dagreg.o 2>/dev/null
 				if test -r ./libdag_la-dagreg.o; then
 				   dagreg_obj=./libdag_la-dagreg.o
 				fi
@@ -6653,9 +8116,9 @@ fi
 { echo "$as_me:$LINENO: result: $ac_cv_lib_dag_dag_attach_stream" >&5
 echo "${ECHO_T}$ac_cv_lib_dag_dag_attach_stream" >&6; }
 if test $ac_cv_lib_dag_dag_attach_stream = yes; then
-  dag_version="2.5.x"
+  dag_streams="1"
 else
-  dag_version="2.4.x"
+  dag_streams="0"
 fi
 
 	{ echo "$as_me:$LINENO: checking for dag_get_erf_types in -ldag" >&5
@@ -6726,12 +8189,81 @@ cat >>confdefs.h <<\_ACEOF
 #define HAVE_DAG_GET_ERF_TYPES 1
 _ACEOF
 
+fi
+
+	{ echo "$as_me:$LINENO: checking for dag_get_stream_erf_types in -ldag" >&5
+echo $ECHO_N "checking for dag_get_stream_erf_types in -ldag... $ECHO_C" >&6; }
+if test "${ac_cv_lib_dag_dag_get_stream_erf_types+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-ldag  $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char dag_get_stream_erf_types ();
+int
+main ()
+{
+return dag_get_stream_erf_types ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext &&
+       $as_test_x conftest$ac_exeext; then
+  ac_cv_lib_dag_dag_get_stream_erf_types=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_lib_dag_dag_get_stream_erf_types=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_dag_dag_get_stream_erf_types" >&5
+echo "${ECHO_T}$ac_cv_lib_dag_dag_get_stream_erf_types" >&6; }
+if test $ac_cv_lib_dag_dag_get_stream_erf_types = yes; then
+
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_DAG_GET_STREAM_ERF_TYPES 1
+_ACEOF
 
 fi
 
 	LDFLAGS=$saved_ldflags
 
-	if test "$dag_version" = 2.5.x; then
+	if test "$dag_streams" = 1; then
 
 cat >>confdefs.h <<\_ACEOF
 #define HAVE_DAG_STREAMS_API 1
@@ -6740,14 +8272,6 @@ _ACEOF
 		DAGLIBS="-ldag"
 	fi
 
-	# See if we can find a specific version string.
-	{ echo "$as_me:$LINENO: checking the DAG API version" >&5
-echo $ECHO_N "checking the DAG API version... $ECHO_C" >&6; }
-	if test -r "$dag_root/VERSION"; then
-		dag_version="`cat $dag_root/VERSION`"
-	fi
-	{ echo "$as_me:$LINENO: result: $dag_version" >&5
-echo "${ECHO_T}$dag_version" >&6; }
 
 cat >>confdefs.h <<\_ACEOF
 #define HAVE_DAG_API 1
@@ -6755,7 +8279,12 @@ _ACEOF
 
 fi
 
+{ echo "$as_me:$LINENO: checking whether we have the DAG API" >&5
+echo $ECHO_N "checking whether we have the DAG API... $ECHO_C" >&6; }
+
 if test $ac_cv_lbl_dag_api = no; then
+	{ echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
 	if test "$want_dag" = yes; then
         	# User wanted DAG support but we couldn't find it.
 		{ { echo "$as_me:$LINENO: error: DAG API requested, but not found at $dag_root: use --without-dag" >&5
@@ -6770,6 +8299,9 @@ echo "$as_me: error: DAG API requested, but not found at $dag_root: use --withou
 echo "$as_me: error: Specifying the capture type as \"dag\" requires the DAG API to be present; use the --with-dag options to specify the location. (Try \"./configure --help\" for more information.)" >&2;}
    { (exit 1); exit 1; }; }
 	fi
+else
+	{ echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
 fi
 
 
@@ -7044,7 +8576,14 @@ echo "$as_me: error: Your operating system's lex is insufficient to compile
 	fi
 fi
 
+#
+# Assume a.out/ELF convention for shared library names (".so"), and
+# V7/BSD convention for man pages (file formats in section 5,
+# miscellaneous info in section 7).
+#
 DYEXT="so"
+MAN_FILE_FORMATS=5
+MAN_MISC_INFO=7
 case "$host_os" in
 
 aix*)
@@ -7053,6 +8592,15 @@ cat >>confdefs.h <<\_ACEOF
 #define _SUN 1
 _ACEOF
 
+
+	# We need "-lodm" and "-lcfg", as libpcap requires them on
+	# AIX.
+	DEPLIBS="-lodm -lcfg"
+	;;
+
+darwin*)
+	DYEXT="dylib"
+	V_CCOPT="$V_CCOPT -fno-common"
 	;;
 
 hpux9*)
@@ -7061,12 +8609,30 @@ cat >>confdefs.h <<\_ACEOF
 #define HAVE_HPUX9 1
 _ACEOF
 
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 hpux10.0*)
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 hpux10.1*)
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 hpux*)
@@ -7075,6 +8641,32 @@ cat >>confdefs.h <<\_ACEOF
 #define HAVE_HPUX10_20_OR_LATER 1
 _ACEOF
 
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
+	;;
+
+irix*)
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
+	;;
+
+linux*)
+	V_CCOPT="$V_CCOPT -fPIC"
+	;;
+
+osf*)
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 sinix*)
@@ -7143,17 +8735,13 @@ cat >>confdefs.h <<\_ACEOF
 #define HAVE_SOLARIS 1
 _ACEOF
 
-	;;
 
-darwin*)
-	DYEXT="dylib"
-	V_CCOPT="$V_CCOPT -fno-common"
-	;;
-
-linux*)
-	V_CCOPT="$V_CCOPT -fPIC"
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
-
 esac
 
 if test -n "$ac_tool_prefix"; then
@@ -7269,7 +8857,7 @@ rm -f os-proto.h
 			    fi
 		    fi
 	    else
-		    case "$target_os" in
+		    case "$host_os" in
 
 		    irix6*)
 			    V_CCOPT="$V_CCOPT -n32"
@@ -7279,7 +8867,7 @@ rm -f os-proto.h
 			    ;;
 		    esac
 	    fi
-	    os=`echo $target_os | sed -e 's/\([0-9][0-9]*\)[^0-9].*$/\1/'`
+	    os=`echo $host_os | sed -e 's/\([0-9][0-9]*\)[^0-9].*$/\1/'`
 	    name="lbl/os-$os.h"
 	    if test -f $name ; then
 		    ln -s $name os-proto.h
@@ -7514,7 +9102,7 @@ else
 	# know it does work, and have the script just fail on other
 	# cpu types and update it when such a failure occurs.
 	#
-	alpha*|arm*|hp*|mips*|sh*|sparc*|ia64|nv1)
+	alpha*|arm*|bfin*|hp*|mips*|sh*|sparc*|ia64|nv1)
 		ac_cv_lbl_unaligned_fail=yes
 		;;
 
@@ -7598,6 +9186,194 @@ ln -s ${srcdir}/bpf/net net
 
 
 
+
+
+{ echo "$as_me:$LINENO: checking for USB sniffing support" >&5
+echo $ECHO_N "checking for USB sniffing support... $ECHO_C" >&6; }
+case "$host_os" in
+linux*)
+
+cat >>confdefs.h <<\_ACEOF
+#define PCAP_SUPPORT_USB 1
+_ACEOF
+
+       USB_SRC=pcap-usb-linux.c
+       { echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6; }
+       ac_usb_dev_name=`udevinfo -q name -p /sys/class/usb_device/usbmon 2>/dev/null`
+       if test $? -ne 0 ; then
+               ac_usb_dev_name="usbmon"
+       fi
+
+cat >>confdefs.h <<_ACEOF
+#define LINUX_USB_MON_DEV "/dev/$ac_usb_dev_name"
+_ACEOF
+
+       { echo "$as_me:$LINENO: Device for USB sniffing is /dev/$ac_usb_dev_name" >&5
+echo "$as_me: Device for USB sniffing is /dev/$ac_usb_dev_name" >&6;}
+       ;;
+*)
+       { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+       ;;
+esac
+
+
+
+case "$host_os" in
+linux*)
+       if test "${ac_cv_header_bluetooth_bluetooth_h+set}" = set; then
+  { echo "$as_me:$LINENO: checking for bluetooth/bluetooth.h" >&5
+echo $ECHO_N "checking for bluetooth/bluetooth.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_bluetooth_bluetooth_h+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_bluetooth_bluetooth_h" >&5
+echo "${ECHO_T}$ac_cv_header_bluetooth_bluetooth_h" >&6; }
+else
+  # Is the header compilable?
+{ echo "$as_me:$LINENO: checking bluetooth/bluetooth.h usability" >&5
+echo $ECHO_N "checking bluetooth/bluetooth.h usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <bluetooth/bluetooth.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_header_compiler=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking bluetooth/bluetooth.h presence" >&5
+echo $ECHO_N "checking bluetooth/bluetooth.h presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <bluetooth/bluetooth.h>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } >/dev/null && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       }; then
+  ac_header_preproc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+  ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+  yes:no: )
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h: proceeding with the compiler's result" >&2;}
+    ac_header_preproc=yes
+    ;;
+  no:yes:* )
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h: present but cannot be compiled" >&2;}
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h:     check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h:     check for missing prerequisite headers?" >&2;}
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h: see the Autoconf documentation" >&2;}
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h:     section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h: proceeding with the preprocessor's result" >&2;}
+    { echo "$as_me:$LINENO: WARNING: bluetooth/bluetooth.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: bluetooth/bluetooth.h: in the future, the compiler will take precedence" >&2;}
+
+    ;;
+esac
+{ echo "$as_me:$LINENO: checking for bluetooth/bluetooth.h" >&5
+echo $ECHO_N "checking for bluetooth/bluetooth.h... $ECHO_C" >&6; }
+if test "${ac_cv_header_bluetooth_bluetooth_h+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_cv_header_bluetooth_bluetooth_h=$ac_header_preproc
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_header_bluetooth_bluetooth_h" >&5
+echo "${ECHO_T}$ac_cv_header_bluetooth_bluetooth_h" >&6; }
+
+fi
+if test $ac_cv_header_bluetooth_bluetooth_h = yes; then
+
+
+cat >>confdefs.h <<\_ACEOF
+#define PCAP_SUPPORT_BT 1
+_ACEOF
+
+          BT_SRC=pcap-bt-linux.c
+          { echo "$as_me:$LINENO: Bluetooth sniffing is supported" >&5
+echo "$as_me: Bluetooth sniffing is supported" >&6;}
+
+else
+  { echo "$as_me:$LINENO: Bluetooth sniffing is not supported; install bluez-lib devel to enable it" >&5
+echo "$as_me: Bluetooth sniffing is not supported; install bluez-lib devel to enable it" >&6;}
+
+fi
+
+
+       ;;
+*)
+       { echo "$as_me:$LINENO: no Bluetooth sniffing support" >&5
+echo "$as_me: no Bluetooth sniffing support" >&6;}
+       ;;
+esac
+
+
+
 # Find a good install program.  We prefer a C program (faster),
 # so one script is as good as another.  But avoid the broken or
 # incompatible versions:
@@ -7682,7 +9458,7 @@ test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
 ac_config_headers="$ac_config_headers config.h"
 
 
-ac_config_files="$ac_config_files Makefile"
+ac_config_files="$ac_config_files Makefile pcap-filter.manmisc pcap-linktype.manmisc pcap-savefile.manfile pcap.3pcap pcap_compile.3pcap pcap_datalink.3pcap pcap_dump_open.3pcap pcap_list_datalinks.3pcap pcap_open_dead.3pcap pcap_open_offline.3pcap"
 
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -8239,6 +10015,16 @@ do
   case $ac_config_target in
     "config.h") CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;;
     "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
+    "pcap-filter.manmisc") CONFIG_FILES="$CONFIG_FILES pcap-filter.manmisc" ;;
+    "pcap-linktype.manmisc") CONFIG_FILES="$CONFIG_FILES pcap-linktype.manmisc" ;;
+    "pcap-savefile.manfile") CONFIG_FILES="$CONFIG_FILES pcap-savefile.manfile" ;;
+    "pcap.3pcap") CONFIG_FILES="$CONFIG_FILES pcap.3pcap" ;;
+    "pcap_compile.3pcap") CONFIG_FILES="$CONFIG_FILES pcap_compile.3pcap" ;;
+    "pcap_datalink.3pcap") CONFIG_FILES="$CONFIG_FILES pcap_datalink.3pcap" ;;
+    "pcap_dump_open.3pcap") CONFIG_FILES="$CONFIG_FILES pcap_dump_open.3pcap" ;;
+    "pcap_list_datalinks.3pcap") CONFIG_FILES="$CONFIG_FILES pcap_list_datalinks.3pcap" ;;
+    "pcap_open_dead.3pcap") CONFIG_FILES="$CONFIG_FILES pcap_open_dead.3pcap" ;;
+    "pcap_open_offline.3pcap") CONFIG_FILES="$CONFIG_FILES pcap_open_offline.3pcap" ;;
 
   *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5
 echo "$as_me: error: invalid argument: $ac_config_target" >&2;}
@@ -8370,17 +10156,23 @@ V_INCLS!$V_INCLS$ac_delim
 V_LIBS!$V_LIBS$ac_delim
 V_PCAP!$V_PCAP$ac_delim
 V_FINDALLDEVS!$V_FINDALLDEVS$ac_delim
-V_RANLIB!$V_RANLIB$ac_delim
 SSRC!$SSRC$ac_delim
 DYEXT!$DYEXT$ac_delim
 DAGLIBS!$DAGLIBS$ac_delim
+DEPLIBS!$DEPLIBS$ac_delim
+MAN_FILE_FORMATS!$MAN_FILE_FORMATS$ac_delim
+MAN_MISC_INFO!$MAN_MISC_INFO$ac_delim
+PCAP_SUPPORT_USB!$PCAP_SUPPORT_USB$ac_delim
+USB_SRC!$USB_SRC$ac_delim
+PCAP_SUPPORT_BT!$PCAP_SUPPORT_BT$ac_delim
+BT_SRC!$BT_SRC$ac_delim
 INSTALL_PROGRAM!$INSTALL_PROGRAM$ac_delim
 INSTALL_SCRIPT!$INSTALL_SCRIPT$ac_delim
 INSTALL_DATA!$INSTALL_DATA$ac_delim
 LTLIBOBJS!$LTLIBOBJS$ac_delim
 _ACEOF
 
-  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 78; then
+  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 84; then
     break
   elif $ac_last_try; then
     { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
diff --git a/contrib/libpcap/configure.in b/contrib/libpcap/configure.in
index 5cd8b14..7d12309 100755
--- a/contrib/libpcap/configure.in
+++ b/contrib/libpcap/configure.in
@@ -1,4 +1,4 @@
-dnl @(#) $Header: /tcpdump/master/libpcap/configure.in,v 1.120.2.13 2007/09/12 19:17:24 guy Exp $ (LBL)
+dnl @(#) $Header: /tcpdump/master/libpcap/configure.in,v 1.138.2.22 2008-10-24 07:30:18 guy Exp $ (LBL)
 dnl
 dnl Copyright (c) 1994, 1995, 1996, 1997
 dnl	The Regents of the University of California.  All rights reserved.
@@ -6,7 +6,7 @@ dnl
 dnl Process this file with autoconf to produce a configure script.
 dnl
 
-AC_REVISION($Revision: 1.120.2.13 $)
+AC_REVISION($Revision: 1.138.2.22 $)
 AC_PREREQ(2.50)
 AC_INIT(pcap.c)
 
@@ -19,6 +19,13 @@ AC_C___ATTRIBUTE__
 AC_LBL_CHECK_TYPE(u_int8_t, u_char)
 AC_LBL_CHECK_TYPE(u_int16_t, u_short)
 AC_LBL_CHECK_TYPE(u_int32_t, u_int)
+AC_LBL_CHECK_TYPE(u_int64_t, unsigned long long)
+
+#
+# Try to arrange for large file support.
+#
+AC_SYS_LARGEFILE
+AC_FUNC_FSEEKO
 
 dnl
 dnl libpcap doesn't itself use <sys/ioccom.h>; however, the test program
@@ -30,6 +37,24 @@ AC_CHECK_HEADERS(sys/ioccom.h sys/sockio.h limits.h paths.h)
 AC_CHECK_HEADERS(net/pfvar.h, , , [#include <sys/types.h>
 #include <sys/socket.h>
 #include <net/if.h>])
+if test "$ac_cv_header_net_pfvar_h" = yes; then
+	#
+	# Check for various PF actions.
+	#
+	AC_MSG_CHECKING(whether net/pfvar.h defines PF_NAT through PF_NORDR)
+	AC_TRY_COMPILE(
+	    [#include <sys/types.h>
+	    #include <sys/socket.h>
+	    #include <net/if.h>
+	    #include <net/pfvar.h>],
+	    [return PF_NAT+PF_NONAT+PF_BINAT+PF_NOBINAT+PF_RDR+PF_NORDR;],
+	    [
+		AC_MSG_RESULT(yes)
+		AC_DEFINE(HAVE_PF_NAT_THROUGH_PF_NORDR, 1,
+		    [define if net/pfvar.h defines PF_NAT through PF_NORDR])
+	    ],
+	    AC_MSG_RESULT(no))
+fi
 AC_CHECK_HEADERS(netinet/if_ether.h, , , [#include <sys/types.h>
 #include <sys/socket.h>])
 if test "$ac_cv_header_netinet_if_ether_h" != yes; then
@@ -172,6 +197,18 @@ if test "$enable_protochain" = "disabled"; then
 fi
 AC_MSG_RESULT(${enable_protochain})
 
+#
+# SITA support is mutually exclusive with native capture support;
+# "--with-sita" selects SITA support.
+#
+AC_ARG_WITH(sita, [  --with-sita             include SITA support],
+[
+	AC_DEFINE(SITA,1,[include ACN support])
+	AC_MSG_NOTICE(Enabling SITA ACN support)
+	V_PCAP=sita
+	V_FINDALLDEVS=sita
+],
+[
 dnl
 dnl Not all versions of test support -c (character special) but it's a
 dnl better way of testing since the device might be protected. So we
@@ -227,6 +264,140 @@ else
 fi
 AC_MSG_RESULT($V_PCAP)
 
+#
+# Do capture-mechanism-dependent tests.
+#
+case "$V_PCAP" in
+dlpi)
+	#
+	# Checks to see if Solaris has the public libdlpi(3LIB) library.
+	# Note: The existence of /usr/include/libdlpi.h does not mean it is the
+	# public libdlpi(3LIB) version. Before libdlpi was made public, a 
+	# private version also existed, which did not have the same APIs. 
+	# Due to a gcc bug, the default search path for 32-bit libraries does
+	# not include /lib, we add it explicitly here.
+	# [http://bugs.opensolaris.org/view_bug.do?bug_id=6619485]. 
+	# Also, due to the bug above applications that link to libpcap with
+	# libdlpi will have to add "-L/lib" option to "configure".
+	#
+	saved_ldflags=$LDFLAGS
+	LDFLAGS="$LIBS -L/lib"
+	AC_CHECK_LIB(dlpi, dlpi_walk,
+		LIBS="-ldlpi $LIBS"
+		V_PCAP=libdlpi
+		AC_DEFINE(HAVE_LIBDLPI,1,[if libdlpi exists]),
+		V_PCAP=dlpi)
+	LDFLAGS=$saved_ldflags
+
+	#
+	# Checks whether <sys/dlpi.h> is usable, to catch weird SCO
+	# versions of DLPI.
+	#
+	AC_MSG_CHECKING(whether <sys/dlpi.h> is usable)
+	AC_CACHE_VAL(ac_cv_sys_dlpi_usable,
+		AC_TRY_COMPILE(
+		    [
+			#include <sys/types.h>
+			#include <sys/time.h>
+			#include <sys/dlpi.h>
+		    ],
+		    [int i = DL_PROMISC_PHYS;],
+		    ac_cv_sys_dlpi_usable=yes,
+		    ac_cv_sys_dlpi_usable=no))
+	AC_MSG_RESULT($ac_cv_sys_dlpi_usable)
+	if test $ac_cv_sys_dlpi_usable = no ; then
+		AC_MSG_ERROR(<sys/dlpi.h> is not usable on this system; it probably has a non-standard DLPI)
+	fi
+
+	#
+	# Check whether we have a /dev/dlpi device or have multiple devices.
+	#
+	AC_MSG_CHECKING(for /dev/dlpi device)
+	if test -c /dev/dlpi ; then
+		AC_MSG_RESULT(yes)
+		AC_DEFINE(HAVE_DEV_DLPI, 1, [define if you have a /dev/dlpi])
+	else
+		AC_MSG_RESULT(no)
+		dir="/dev/dlpi"
+		AC_MSG_CHECKING(for $dir directory)
+		if test -d $dir ; then
+			AC_MSG_RESULT(yes)
+			AC_DEFINE_UNQUOTED(PCAP_DEV_PREFIX, "$dir", [/dev/dlpi directory])
+		else
+			AC_MSG_RESULT(no)
+		fi
+	fi
+
+	#
+	# This check is for Solaris with DLPI support for passive modes.
+	# See dlpi(7P) for more details.
+	#
+	AC_LBL_DL_PASSIVE_REQ_T
+	;;
+
+linux)
+	AC_MSG_CHECKING(Linux kernel version)
+ 	if test "$cross_compiling" = yes; then
+ 		AC_CACHE_VAL(ac_cv_linux_vers,
+ 		    ac_cv_linux_vers=unknown)
+ 	else
+ 		AC_CACHE_VAL(ac_cv_linux_vers,
+ 		    ac_cv_linux_vers=`uname -r 2>&1 | \
+ 			sed -n -e '$s/.* //' -e '$s/\..*//p'`)
+ 	fi
+	AC_MSG_RESULT($ac_cv_linux_vers)
+ 	if test $ac_cv_linux_vers = unknown ; then
+ 		AC_MSG_ERROR(cannot determine linux version when cross-compiling)
+ 	fi
+	if test $ac_cv_linux_vers -lt 2 ; then
+		AC_MSG_ERROR(version 2 or higher required; see the INSTALL doc for more info)
+	fi
+	AC_CHECK_HEADERS(linux/wireless.h, [], [],
+	[
+#include <sys/socket.h>
+#include <net/if.h>
+#include <linux/types.h>
+	])
+	AC_CHECK_HEADERS()
+	AC_LBL_TPACKET_STATS
+	AC_LBL_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI
+	;;
+
+bpf)
+	#
+	# Check whether we have the *BSD-style ioctls.
+	#
+	AC_CHECK_HEADERS(net/if_media.h)
+
+	AC_MSG_CHECKING(whether the system supports zerocopy BPF)
+	AC_TRY_COMPILE(
+	    [#include <sys/socket.h>
+	    #include <sys/ioctl.h>
+	    #include <net/if.h>
+	    #include <net/bpf.h>],
+	    [return (BIOCROTZBUF + BPF_BUFMODE_ZBUF);],
+	    [  
+		AC_MSG_RESULT(yes)
+		AC_DEFINE(HAVE_ZEROCOPY_BPF, 1,
+		[define if the system supports zerocopy BPF])
+	    ],
+	    AC_MSG_RESULT(no))
+	;;
+
+dag)
+	V_DEFS="$V_DEFS -DDAG_ONLY"
+	;;
+
+septel)
+	V_DEFS="$V_DEFS -DSEPTEL_ONLY"
+	;;
+
+null)
+	AC_MSG_WARN(cannot determine packet capture interface)
+	AC_MSG_WARN((see the INSTALL doc for more info))
+	;;
+esac
+
 dnl
 dnl Now figure out how we get a list of interfaces and addresses,
 dnl if we support capturing.  Don't bother if we don't support
@@ -273,7 +444,8 @@ else
 		#
 		case "$V_PCAP" in
 
-		dlpi)
+		dlpi|libdlpi)
+			AC_CHECK_HEADERS(sys/bufmod.h sys/dlpi_ext.h)
 			#
 			# This might be Solaris 8 or later, with
 			# SIOCGLIFCONF, or it might be some other OS
@@ -297,6 +469,10 @@ else
 			else
 				V_FINDALLDEVS=gifc
 			fi
+			#
+			# Needed for common functions used by pcap-[dlpi,libdlpi].c
+			#
+		 	SSRC="dlpisubs.c"
 			;;
 
 		*)
@@ -310,13 +486,35 @@ else
 			;;
 		esac])
 fi
+])
 
-AC_MSG_CHECKING(if --enable-ipv6 option is specified)
-AC_ARG_ENABLE(ipv6, [  --enable-ipv6           build IPv6-capable version])
-if test "$enable_ipv6" = "yes"; then
-	AC_DEFINE(INET6,1,[IPv6])
+AC_MSG_CHECKING(for socklen_t)
+AC_TRY_COMPILE([
+	#include <sys/types.h>
+	#include <sys/socket.h>
+	],
+	[ socklen_t x; ],
+	have_socklen_t=yes,
+	have_socklen_t=no)
+if test "x$have_socklen_t" = "xyes"; then
+	AC_DEFINE(HAVE_SOCKLEN_T, 1, [define if socklen_t is defined])
+fi
+AC_MSG_RESULT($have_socklen_t)
+
+AC_ARG_ENABLE(ipv6, [  --enable-ipv6           build IPv6-capable version @<:@default=yes, if getaddrinfo available@:>@],
+    [],
+    [enable_ipv6=ifavailable])
+if test "$enable_ipv6" != "no"; then
+	AC_CHECK_FUNC(getaddrinfo,
+	    [
+		AC_DEFINE(INET6,1,[IPv6])
+	    ],
+	    [
+		if test "$enable_ipv6" != "ifavailable"; then
+			AC_MSG_FAILURE([--enable-ipv6 was given, but getaddrinfo isn't available])
+		fi
+	    ])
 fi
-AC_MSG_RESULT(${enable_ipv6-no})
 
 AC_MSG_CHECKING(whether to build optimizer debugging code)
 AC_ARG_ENABLE(optimizer-dbg, [  --enable-optimizer-dbg  build optimizer debugging code])
@@ -332,62 +530,6 @@ if test "$enable_yydebug" = "yes"; then
 fi
 AC_MSG_RESULT(${enable_yydebug-no})
 
-case "$V_PCAP" in
-
-dlpi)
-	AC_CHECK_HEADERS(sys/bufmod.h sys/dlpi_ext.h)
-	AC_MSG_CHECKING(for /dev/dlpi device)
-	if test -c /dev/dlpi ; then
-		AC_MSG_RESULT(yes)
-		AC_DEFINE(HAVE_DEV_DLPI, 1, [define if you have a /dev/dlpi])
-	else
-		AC_MSG_RESULT(no)
-		dir="/dev/dlpi"
-		AC_MSG_CHECKING(for $dir directory)
-		if test -d $dir ; then
-			AC_MSG_RESULT(yes)
-			AC_DEFINE_UNQUOTED(PCAP_DEV_PREFIX, "$dir", [/dev/dlpi directory])
-		else
-			AC_MSG_RESULT(no)
-		fi
-	fi
-	;;
-
-linux)
-	AC_MSG_CHECKING(Linux kernel version)
- 	if test "$cross_compiling" = yes; then
- 		AC_CACHE_VAL(ac_cv_linux_vers,
- 		    ac_cv_linux_vers=unknown)
- 	else
- 		AC_CACHE_VAL(ac_cv_linux_vers,
- 		    ac_cv_linux_vers=`uname -r 2>&1 | \
- 			sed -n -e '$s/.* //' -e '$s/\..*//p'`)
- 	fi
-	AC_MSG_RESULT($ac_cv_linux_vers)
- 	if test $ac_cv_linux_vers = unknown ; then
- 		AC_MSG_ERROR(cannot determine linux version when cross-compiling)
- 	fi
-	if test $ac_cv_linux_vers -lt 2 ; then
-		AC_MSG_ERROR(version 2 or higher required; see the INSTALL doc for more info)
-	fi
-	AC_LBL_TPACKET_STATS
-	;;
-
-dag)
-	V_DEFS="$V_DEFS -DDAG_ONLY"
-	;;
-
-septel)
-	V_DEFS="$V_DEFS -DSEPTEL_ONLY"
-	;;
-
-null)
-	AC_MSG_WARN(cannot determine packet capture interface)
-	AC_MSG_WARN((see the INSTALL doc for more info))
-	;;
-
-esac
-
 AC_MSG_CHECKING(whether we have /proc/net/dev)
 if test -r /proc/net/dev ; then
 	ac_cv_lbl_proc_net_dev=yes
@@ -498,11 +640,11 @@ if test $ac_cv_lbl_dag_api = yes; then
 		dagapi_obj=$dag_lib_dir/dagapi.o
 	elif test -r $dag_lib_dir/libdag.a; then
 		# 2.5.x.
-		ar x $dag_lib_dir/libdag.a dagapi.o
+		ar x $dag_lib_dir/libdag.a dagapi.o 2>/dev/null
 		if test -r ./dagapi.o; then
 		    dagapi_obj=./dagapi.o
 		else
-		    ar x $dag_lib_dir/libdag.a libdag_la-dagapi.o
+		    ar x $dag_lib_dir/libdag.a libdag_la-dagapi.o 2>/dev/null
 		    if test -r ./libdag_la-dagapi.o; then
 		       dagapi_obj=./libdag_la-dagapi.o
 		    fi		
@@ -529,11 +671,11 @@ if test $ac_cv_lbl_dag_api = yes; then
 		dagopts_obj=$dag_lib_dir/dagopts.o
 	elif test -r $dag_lib_dir/libdag.a; then
 		# 2.5.x.
-		ar x $dag_lib_dir/libdag.a dagopts.o
+		ar x $dag_lib_dir/libdag.a dagopts.o 2>/dev/null
 		if test -r ./dagopts.o; then
 		    dagopts_obj=./dagopts.o
 		else
-		    ar x $dag_lib_dir/libdag.a libdag_la-dagopts.o
+		    ar x $dag_lib_dir/libdag.a libdag_la-dagopts.o 2>/dev/null
 		    if test -r ./libdag_la-dagopts.o; then
 		       dagopts_obj=./libdag_la-dagopts.o
 		    fi
@@ -558,11 +700,11 @@ if test $ac_cv_lbl_dag_api = yes; then
 			dagreg_obj=$dag_lib_dir/dagreg.o
 		elif test -r $dag_lib_dir/libdag.a; then
 			# Extract from libdag.a.
-			ar x $dag_lib_dir/libdag.a dagreg.o
+			ar x $dag_lib_dir/libdag.a dagreg.o 2>/dev/null
 			if test -r ./dagreg.o; then
 				dagreg_obj=./dagreg.o
 			else
-				ar x $dag_lib_dir/libdag.a libdag_la-dagreg.o
+				ar x $dag_lib_dir/libdag.a libdag_la-dagreg.o 2>/dev/null
 				if test -r ./libdag_la-dagreg.o; then
 				   dagreg_obj=./libdag_la-dagreg.o
 				fi
@@ -590,27 +732,25 @@ if test $ac_cv_lbl_dag_api = yes; then
 	# included if there's a found-action (arg 3).
 	saved_ldflags=$LDFLAGS
 	LDFLAGS="-L$dag_lib_dir"
-	AC_CHECK_LIB([dag], [dag_attach_stream], [dag_version="2.5.x"], [dag_version="2.4.x"])
+	AC_CHECK_LIB([dag], [dag_attach_stream], [dag_streams="1"], [dag_streams="0"])
 	AC_CHECK_LIB([dag],[dag_get_erf_types], [
-		AC_DEFINE(HAVE_DAG_GET_ERF_TYPES, 1, [define if you have dag_get_erf_types()])]
-	)
+		AC_DEFINE(HAVE_DAG_GET_ERF_TYPES, 1, [define if you have dag_get_erf_types()])])
+	AC_CHECK_LIB([dag],[dag_get_stream_erf_types], [
+		AC_DEFINE(HAVE_DAG_GET_STREAM_ERF_TYPES, 1, [define if you have dag_get_stream_erf_types()])])
 	LDFLAGS=$saved_ldflags
 
-	if test "$dag_version" = 2.5.x; then
+	if test "$dag_streams" = 1; then
 		AC_DEFINE(HAVE_DAG_STREAMS_API, 1, [define if you have streams capable DAG API])
 		DAGLIBS="-ldag"
 	fi
 
-	# See if we can find a specific version string.
-	AC_MSG_CHECKING([the DAG API version])
-	if test -r "$dag_root/VERSION"; then
-		dag_version="`cat $dag_root/VERSION`"
-	fi
-	AC_MSG_RESULT([$dag_version])
 	AC_DEFINE(HAVE_DAG_API, 1, [define if you have the DAG API])
 fi
 
+AC_MSG_CHECKING(whether we have the DAG API)
+
 if test $ac_cv_lbl_dag_api = no; then
+	AC_MSG_RESULT(no)
 	if test "$want_dag" = yes; then
         	# User wanted DAG support but we couldn't find it.
 		AC_MSG_ERROR([DAG API requested, but not found at $dag_root: use --without-dag])
@@ -621,6 +761,8 @@ if test $ac_cv_lbl_dag_api = no; then
 		# found.
 		AC_MSG_ERROR([Specifying the capture type as "dag" requires the DAG API to be present; use the --with-dag options to specify the location. (Try "./configure --help" for more information.)])
 	fi
+else
+	AC_MSG_RESULT(yes)
 fi
 
 AC_ARG_WITH(septel, [  --with-septel[[=DIR]]     include Septel support (located in directory DIR, if supplied).  [default=yes, on Linux, if present]],
@@ -724,22 +866,56 @@ if test "$V_LEX" = lex ; then
 	fi
 fi
 
+#
+# Assume a.out/ELF convention for shared library names (".so"), and
+# V7/BSD convention for man pages (file formats in section 5,
+# miscellaneous info in section 7).
+#
 DYEXT="so"
+MAN_FILE_FORMATS=5
+MAN_MISC_INFO=7
 case "$host_os" in
 
 aix*)
 	dnl Workaround to enable certain features
 	AC_DEFINE(_SUN,1,[define on AIX to get certain functions])
+
+	# We need "-lodm" and "-lcfg", as libpcap requires them on
+	# AIX.
+	DEPLIBS="-lodm -lcfg"
+	;;
+
+darwin*)
+	DYEXT="dylib"
+	V_CCOPT="$V_CCOPT -fno-common"
 	;;
 
 hpux9*)
 	AC_DEFINE(HAVE_HPUX9,1,[on HP-UX 9.x])
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 hpux10.0*)
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 hpux10.1*)
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 hpux*)
@@ -750,6 +926,32 @@ hpux*)
 	dnl for 32-bit PA-RISC, but should be left as "so" for
 	dnl 64-bit PA-RISC or, I suspect, IA-64.
 	AC_DEFINE(HAVE_HPUX10_20_OR_LATER,1,[on HP-UX 10.20 or later])
+
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
+	;;
+
+irix*)
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
+	;;
+
+linux*)
+	V_CCOPT="$V_CCOPT -fPIC"
+	;;
+
+osf*)
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
 
 sinix*)
@@ -768,17 +970,13 @@ sinix*)
 
 solaris*)
 	AC_DEFINE(HAVE_SOLARIS,1,[On solaris])
-	;;
 
-darwin*)
-	DYEXT="dylib"
-	V_CCOPT="$V_CCOPT -fno-common"
-	;;
-
-linux*)
-	V_CCOPT="$V_CCOPT -fPIC"
+	#
+	# Use System V conventions for man pages.
+	#
+	MAN_FILE_FORMATS=4
+	MAN_MISC_INFO=5
 	;;
-
 esac
 
 AC_PROG_RANLIB
@@ -809,17 +1007,63 @@ AC_SUBST(V_LIBS)
 AC_SUBST(V_LEX)
 AC_SUBST(V_PCAP)
 AC_SUBST(V_FINDALLDEVS)
-AC_SUBST(V_RANLIB)
 AC_SUBST(V_YACC)
 AC_SUBST(SSRC)
 AC_SUBST(DYEXT)
 AC_SUBST(DAGLIBS)
+AC_SUBST(DEPLIBS)
+AC_SUBST(MAN_FILE_FORMATS)
+AC_SUBST(MAN_MISC_INFO)
+
+dnl check for USB sniffing support
+AC_MSG_CHECKING(for USB sniffing support)
+case "$host_os" in
+linux*)
+       AC_DEFINE(PCAP_SUPPORT_USB, 1, [target host supports USB sniffing])
+       USB_SRC=pcap-usb-linux.c
+       AC_MSG_RESULT(yes)
+       ac_usb_dev_name=`udevinfo -q name -p /sys/class/usb_device/usbmon 2>/dev/null`
+       if test $? -ne 0 ; then
+               ac_usb_dev_name="usbmon"
+       fi
+       AC_DEFINE_UNQUOTED(LINUX_USB_MON_DEV, "/dev/$ac_usb_dev_name", [path for device for USB sniffing])
+       AC_MSG_NOTICE(Device for USB sniffing is /dev/$ac_usb_dev_name)
+       ;;
+*)
+       AC_MSG_RESULT(no)
+       ;;
+esac
+AC_SUBST(PCAP_SUPPORT_USB)
+AC_SUBST(USB_SRC)
+
+dnl check for bluetooth sniffing support
+case "$host_os" in
+linux*)
+       AC_CHECK_HEADER(bluetooth/bluetooth.h,
+       	[
+	  AC_DEFINE(PCAP_SUPPORT_BT, 1, [target host supports Bluetooth sniffing])
+          BT_SRC=pcap-bt-linux.c
+          AC_MSG_NOTICE(Bluetooth sniffing is supported)
+	],
+	AC_MSG_NOTICE(Bluetooth sniffing is not supported; install bluez-lib devel to enable it)
+       )
+       ;;
+*)
+       AC_MSG_NOTICE(no Bluetooth sniffing support)
+       ;;
+esac
+AC_SUBST(PCAP_SUPPORT_BT)
+AC_SUBST(BT_SRC)
 
 AC_PROG_INSTALL
 
 AC_CONFIG_HEADER(config.h)
 
-AC_OUTPUT(Makefile)
+AC_OUTPUT(Makefile pcap-filter.manmisc pcap-linktype.manmisc
+	pcap-savefile.manfile pcap.3pcap pcap_compile.3pcap
+	pcap_datalink.3pcap pcap_dump_open.3pcap
+	pcap_list_datalinks.3pcap pcap_open_dead.3pcap
+	pcap_open_offline.3pcap)
 
 if test -f .devel ; then
 	make depend
diff --git a/contrib/libpcap/dlpisubs.c b/contrib/libpcap/dlpisubs.c
new file mode 100644
index 0000000..441b8c0
--- /dev/null
+++ b/contrib/libpcap/dlpisubs.c
@@ -0,0 +1,349 @@
+/*
+ * This code is derived from code formerly in pcap-dlpi.c, originally
+ * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College
+ * London, and subsequently modified by Guy Harris (guy@alum.mit.edu),
+ * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>,
+ * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
+ */
+
+/*
+ * This file contains dlpi/libdlpi related common functions used
+ * by pcap-[dlpi,libdlpi].c.
+ */
+#ifndef lint
+static const char rcsid[] _U_ =
+	"@(#) $Header: /tcpdump/master/libpcap/dlpisubs.c,v 1.1.2.2 2008-04-04 19:39:05 guy Exp $ (LBL)";
+#endif
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef HAVE_SYS_BUFMOD_H
+	/*
+	 * Size of a bufmod chunk to pass upstream; that appears to be the
+	 * biggest value to which you can set it, and setting it to that value
+	 * (which is bigger than what appears to be the Solaris default of 8192)
+	 * reduces the number of packet drops.
+	 */
+#define	CHUNKSIZE	65536
+
+	/*
+	 * Size of the buffer to allocate for packet data we read; it must be
+	 * large enough to hold a chunk.
+	 */
+#define	PKTBUFSIZE	CHUNKSIZE
+
+#else /* HAVE_SYS_BUFMOD_H */
+
+	/*
+	 * Size of the buffer to allocate for packet data we read; this is
+	 * what the value used to be - there's no particular reason why it
+	 * should be tied to MAXDLBUF, but we'll leave it as this for now.
+	 */
+#define	PKTBUFSIZE	(MAXDLBUF * sizeof(bpf_u_int32))
+
+#endif
+
+#include <sys/types.h>
+#include <sys/time.h>
+#ifdef HAVE_SYS_BUFMOD_H
+#include <sys/bufmod.h>
+#endif
+#include <sys/dlpi.h>
+#include <sys/stream.h>
+
+#include <errno.h>
+#include <memory.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stropts.h>
+#include <unistd.h>
+
+#include "pcap-int.h"
+#include "dlpisubs.h"
+
+static void pcap_stream_err(const char *, int, char *);
+
+/*
+ * Get the packet statistics.
+ */
+int
+pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps)
+{
+
+	/*
+	 * "ps_recv" counts packets handed to the filter, not packets
+	 * that passed the filter.  As filtering is done in userland,
+	 * this would not include packets dropped because we ran out
+	 * of buffer space; in order to make this more like other
+	 * platforms (Linux 2.4 and later, BSDs with BPF), where the
+	 * "packets received" count includes packets received but dropped
+	 * due to running out of buffer space, and to keep from confusing
+	 * applications that, for example, compute packet drop percentages,
+	 * we also make it count packets dropped by "bufmod" (otherwise we
+	 * might run the risk of the packet drop count being bigger than
+	 * the received-packet count).
+	 *
+	 * "ps_drop" counts packets dropped by "bufmod" because of
+	 * flow control requirements or resource exhaustion; it doesn't
+	 * count packets dropped by the interface driver, or packets
+	 * dropped upstream.  As filtering is done in userland, it counts
+	 * packets regardless of whether they would've passed the filter.
+	 *
+	 * These statistics don't include packets not yet read from
+	 * the kernel by libpcap, but they may include packets not
+	 * yet read from libpcap by the application.
+	 */
+	*ps = p->md.stat;
+
+	/*
+	 * Add in the drop count, as per the above comment.
+	 */
+	ps->ps_recv += ps->ps_drop;
+	return (0);
+}
+
+/*
+ * Loop through the packets and call the callback for each packet.
+ * Return the number of packets read.
+ */
+int
+pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user,
+	int count, u_char *bufp, int len)
+{
+	int n, caplen, origlen;
+	u_char *ep, *pk;
+	struct pcap_pkthdr pkthdr;
+#ifdef HAVE_SYS_BUFMOD_H
+	struct sb_hdr *sbp;
+#ifdef LBL_ALIGN
+	struct sb_hdr sbhdr;
+#endif
+#endif
+
+	/* Loop through packets */
+	ep = bufp + len;
+	n = 0;
+
+#ifdef HAVE_SYS_BUFMOD_H
+	while (bufp < ep) {
+		/*
+		 * Has "pcap_breakloop()" been called?
+		 * If so, return immediately - if we haven't read any
+		 * packets, clear the flag and return -2 to indicate
+		 * that we were told to break out of the loop, otherwise
+		 * leave the flag set, so that the *next* call will break
+		 * out of the loop without having read any packets, and
+		 * return the number of packets we've processed so far.
+		 */
+		if (p->break_loop) {
+			if (n == 0) {
+				p->break_loop = 0;
+				return (-2);
+			} else {
+				p->bp = bufp;
+				p->cc = ep - bufp;
+				return (n);
+			}
+		}
+#ifdef LBL_ALIGN
+		if ((long)bufp & 3) {
+			sbp = &sbhdr;
+			memcpy(sbp, bufp, sizeof(*sbp));
+		} else
+#endif
+			sbp = (struct sb_hdr *)bufp;
+		p->md.stat.ps_drop = sbp->sbh_drops;
+		pk = bufp + sizeof(*sbp);
+		bufp += sbp->sbh_totlen;
+		origlen = sbp->sbh_origlen;
+		caplen = sbp->sbh_msglen;
+#else
+		origlen = len;
+		caplen = min(p->snapshot, len);
+		pk = bufp;
+		bufp += caplen;
+#endif
+		++p->md.stat.ps_recv;
+		if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
+#ifdef HAVE_SYS_BUFMOD_H
+			pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
+			pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
+#else
+			(void) gettimeofday(&pkthdr.ts, NULL);
+#endif
+			pkthdr.len = origlen;
+			pkthdr.caplen = caplen;
+			/* Insure caplen does not exceed snapshot */
+			if (pkthdr.caplen > p->snapshot)
+				pkthdr.caplen = p->snapshot;
+			(*callback)(user, &pkthdr, pk);
+			if (++n >= count && count >= 0) {
+				p->cc = ep - bufp;
+				p->bp = bufp;
+				return (n);
+			}
+		}
+#ifdef HAVE_SYS_BUFMOD_H
+	}
+#endif
+	p->cc = 0;
+	return (n);
+}
+
+/*
+ * Process the mac type. Returns -1 if no matching mac type found, otherwise 0.
+ */
+int
+pcap_process_mactype(pcap_t *p, u_int mactype)
+{
+	int retv = 0;
+
+	switch (mactype) {
+
+	case DL_CSMACD:
+	case DL_ETHER:
+		p->linktype = DLT_EN10MB;
+		p->offset = 2;
+		/*
+		 * This is (presumably) a real Ethernet capture; give it a
+		 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
+		 * that an application can let you choose it, in case you're
+		 * capturing DOCSIS traffic that a Cisco Cable Modem
+		 * Termination System is putting out onto an Ethernet (it
+		 * doesn't put an Ethernet header onto the wire, it puts raw
+		 * DOCSIS frames out on the wire inside the low-level
+		 * Ethernet framing).
+		 */
+		p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2);
+		/*
+		 * If that fails, just leave the list empty.
+		 */
+		if (p->dlt_list != NULL) {
+			p->dlt_list[0] = DLT_EN10MB;
+			p->dlt_list[1] = DLT_DOCSIS;
+			p->dlt_count = 2;
+		}
+		break;
+
+	case DL_FDDI:
+		p->linktype = DLT_FDDI;
+		p->offset = 3;
+		break;
+
+	case DL_TPR:
+		/* XXX - what about DL_TPB?  Is that Token Bus?  */
+		p->linktype = DLT_IEEE802;
+		p->offset = 2;
+		break;
+
+#ifdef HAVE_SOLARIS
+	case DL_IPATM:
+		p->linktype = DLT_SUNATM;
+		p->offset = 0;  /* works for LANE and LLC encapsulation */
+		break;
+#endif
+
+	default:
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype %u",
+		    mactype);
+		retv = -1;
+	}
+
+	return (retv);
+}
+
+#ifdef HAVE_SYS_BUFMOD_H
+/*
+ * Push and configure the buffer module. Returns -1 for error, otherwise 0.
+ */
+int
+pcap_conf_bufmod(pcap_t *p, int snaplen, int timeout)
+{
+	int retv = 0;
+
+	bpf_u_int32 ss, chunksize;
+
+	/* Non-standard call to get the data nicely buffered. */
+	if (ioctl(p->fd, I_PUSH, "bufmod") != 0) {
+		pcap_stream_err("I_PUSH bufmod", errno, p->errbuf);
+		retv = -1;
+	}
+
+	ss = snaplen;
+	if (ss > 0 &&
+	    strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) {
+		pcap_stream_err("SBIOCSSNAP", errno, p->errbuf);
+		retv = -1;
+	}
+
+	/* Set up the bufmod timeout. */
+	if (timeout != 0) {
+		struct timeval to;
+
+		to.tv_sec = timeout / 1000;
+		to.tv_usec = (timeout * 1000) % 1000000;
+		if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
+			pcap_stream_err("SBIOCSTIME", errno, p->errbuf);
+			retv = -1;
+		}
+	}
+
+	/* Set the chunk length. */
+	chunksize = CHUNKSIZE;
+	if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize)
+	    != 0) {
+		pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf);
+		retv = -1;
+	}
+
+	return (retv);
+}
+#endif /* HAVE_SYS_BUFMOD_H */
+
+/*
+ * Allocate data buffer. Returns -1 if memory allocation fails, else 0.
+ */
+int
+pcap_alloc_databuf(pcap_t *p)
+{
+	p->bufsize = PKTBUFSIZE;
+	p->buffer = (u_char *)malloc(p->bufsize + p->offset);
+	if (p->buffer == NULL) {
+		strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
+		return (-1);
+	}
+
+	return (0);
+}
+
+/*
+ * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise
+ * length of returned data on success.
+ */
+int
+strioctl(int fd, int cmd, int len, char *dp)
+{
+	struct strioctl str;
+	int retv;
+
+	str.ic_cmd = cmd;
+	str.ic_timout = -1;
+	str.ic_len = len;
+	str.ic_dp = dp;
+	if ((retv = ioctl(fd, I_STR, &str)) < 0)
+		return (retv);
+
+	return (str.ic_len);
+}
+
+/*
+ * Write stream error message to errbuf.
+ */
+static void
+pcap_stream_err(const char *func, int err, char *errbuf)
+{
+	snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err));
+}
diff --git a/contrib/libpcap/dlpisubs.h b/contrib/libpcap/dlpisubs.h
new file mode 100644
index 0000000..67acd29
--- /dev/null
+++ b/contrib/libpcap/dlpisubs.h
@@ -0,0 +1,28 @@
+/*
+ * @(#) $Header: /tcpdump/master/libpcap/dlpisubs.h,v 1.1.2.2 2008-04-04 19:39:05 guy Exp $
+ */
+
+#ifndef dlpisubs_h
+#define	dlpisubs_h
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Functions used by dlpisubs.c.
+ */
+int pcap_stats_dlpi(pcap_t *, struct pcap_stat *);
+int pcap_process_pkts(pcap_t *, pcap_handler, u_char *, int, u_char *, int);
+int pcap_process_mactype(pcap_t *, u_int);
+#ifdef HAVE_SYS_BUFMOD_H
+int pcap_conf_bufmod(pcap_t *, int, int);
+#endif
+int pcap_alloc_databuf(pcap_t *);
+int strioctl(int, int, int, char *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/contrib/libpcap/doc/pcap.html b/contrib/libpcap/doc/pcap.html
deleted file mode 100644
index 94e3514..0000000
--- a/contrib/libpcap/doc/pcap.html
+++ /dev/null
@@ -1,997 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<html lang="en"><head><title>PCAP New Generation Dump File Format</title>
-<meta name="description" content="PCAP New Generation Dump File Format">
-<meta name="keywords" content="Internet-Draft, Libpcap, dump file format">
-<meta name="generator" content="xml2rfc v1.22 (http://xml.resource.org/)">
-<style type='text/css'>
-<!--
-    body {
-        font-family: verdana, charcoal, helvetica, arial, sans-serif;
-        font-size: small ; color: #000000 ; background-color: #ffffff ; }
-    .title { color: #990000; font-size: x-large ;
-        font-weight: bold; text-align: right;
-        font-family: helvetica, monaco, "MS Sans Serif", arial, sans-serif;
-        background-color: transparent; }
-    .filename { color: #666666; font-size: 18px; line-height: 28px;
-        font-weight: bold; text-align: right;
-        font-family: helvetica, arial, sans-serif;
-        background-color: transparent; }
-    td.rfcbug { background-color: #000000 ; width: 30px ; height: 30px ; 
-        text-align: justify; vertical-align: middle ; padding-top: 2px ; }
-    td.rfcbug span.RFC { color: #666666; font-weight: bold; text-decoration: none;
-        background-color: #000000 ;
-        font-family: monaco, charcoal, geneva, "MS Sans Serif", helvetica, verdana, sans-serif;
-        font-size: x-small ; }
-    td.rfcbug span.hotText { color: #ffffff; font-weight: normal; text-decoration: none;
-        text-align: center ;
-        font-family: charcoal, monaco, geneva, "MS Sans Serif", helvetica, verdana, sans-serif;
-        font-size: x-small ; background-color: #000000; }
-
-     A { font-weight: bold; }
-     A:link { color: #990000; background-color: transparent ; }
-     A:visited { color: #333333; background-color: transparent ; }
-     A:active { color: #333333; background-color: transparent ; }
-
-    p { margin-left: 2em; margin-right: 2em; }
-    p.copyright { font-size: x-small ; }
-    p.toc { font-size: small ; font-weight: bold ; margin-left: 3em ;}
-
-    span.emph { font-style: italic; }
-    span.strong { font-weight: bold; }
-    span.verb { font-family: "Courier New", Courier, monospace ; }
-
-    ol.text { margin-left: 2em; margin-right: 2em; }
-    ul.text { margin-left: 2em; margin-right: 2em; }
-    li { margin-left: 3em;  }
-
-    pre { margin-left: 3em; color: #333333;  background-color: transparent;
-        font-family: "Courier New", Courier, monospace ; font-size: small ;
-        }
-
-    h3 { color: #333333; font-size: medium ;
-        font-family: helvetica, arial, sans-serif ;
-        background-color: transparent; }
-    h4 { font-size: small; font-family: helvetica, arial, sans-serif ; }
-
-    table.bug { width: 30px ; height: 15px ; }
-    td.bug { color: #ffffff ; background-color: #990000 ;
-        text-align: center ; width: 30px ; height: 15px ;
-         }
-    td.bug A.link2 { color: #ffffff ; font-weight: bold;
-        text-decoration: none;
-        font-family: monaco, charcoal, geneva, "MS Sans Serif", helvetica, sans-serif;
-        font-size: x-small ; background-color: transparent }
-
-    td.header { color: #ffffff; font-size: x-small ;
-        font-family: arial, helvetica, sans-serif; vertical-align: top;
-        background-color: #666666 ; width: 33% ; }
-    td.author { font-weight: bold; margin-left: 4em; font-size: x-small ; }
-    td.author-text { font-size: x-small; }
-    table.data { vertical-align: top ; border-collapse: collapse ;
-        border-style: solid solid solid solid ;
-        border-color: black black black black ;
-        font-size: small ; text-align: center ; }
-    table.data th { font-weight: bold ;
-        border-style: solid solid solid solid ;
-        border-color: black black black black ; }
-    table.data td {
-        border-style: solid solid solid solid ;
-        border-color: #333333 #333333 #333333 #333333 ; }
-
-    hr { height: 1px }
--->
-</style>
-</head>
-<body>
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<table summary="layout" width="66%" border="0" cellpadding="0" cellspacing="0"><tr><td><table summary="layout" width="100%" border="0" cellpadding="2" cellspacing="1">
-<tr><td class="header">Network Working Group</td><td class="header">L. Degioanni</td></tr>
-<tr><td class="header">Internet-Draft</td><td class="header">F. Risso</td></tr>
-<tr><td class="header">Expires: August 30, 2004</td><td class="header">Politecnico di Torino</td></tr>
-<tr><td class="header">&nbsp;</td><td class="header">March 2004</td></tr>
-</table></td></tr></table>
-<div align="right"><span class="title"><br />PCAP New Generation Dump File Format</span></div>
-<div align="right"><span class="title"><br />pcap</span></div>
-
-<h3>Status of this Memo</h3>
-<p>
-This document is an Internet-Draft and is
-in full conformance with all provisions of Section 10 of RFC2026.</p>
-<p>
-Internet-Drafts are working documents of the Internet Engineering
-Task Force (IETF), its areas, and its working groups.
-Note that other groups may also distribute working documents as
-Internet-Drafts.</p>
-<p>
-Internet-Drafts are draft documents valid for a maximum of six months
-and may be updated, replaced, or obsoleted by other documents at any time.
-It is inappropriate to use Internet-Drafts as reference material or to cite
-them other than as "work in progress."</p>
-<p>
-The list of current Internet-Drafts can be accessed at
-<a href='http://www.ietf.org/ietf/1id-abstracts.txt'>http://www.ietf.org/ietf/1id-abstracts.txt</a>.</p>
-<p>
-The list of Internet-Draft Shadow Directories can be accessed at
-<a href='http://www.ietf.org/shadow.html'>http://www.ietf.org/shadow.html</a>.</p>
-<p>
-This Internet-Draft will expire on August 30, 2004.</p>
-
-<h3>Copyright Notice</h3>
-<p>
-Copyright (C) The Internet Society (2004). All Rights Reserved.</p>
-
-<h3>Abstract</h3>
-
-<p>This document describes a format to dump captured packets on a file. This format is extensible and it is currently proposed for implementation in the libpcap/WinPcap packet capture library.
-</p><a name="toc"></a><br /><hr />
-<h3>Table of Contents</h3>
-<p class="toc">
-<a href="#anchor1">1.</a>&nbsp;
-Objectives<br />
-<a href="#anchor2">2.</a>&nbsp;
-General File Structure<br />
-<a href="#sectionblock">2.1</a>&nbsp;
-General Block Structure<br />
-<a href="#anchor3">2.2</a>&nbsp;
-Block Types<br />
-<a href="#anchor4">2.3</a>&nbsp;
-Block Hierarchy and Precedence<br />
-<a href="#anchor5">2.4</a>&nbsp;
-Data format<br />
-<a href="#anchor6">3.</a>&nbsp;
-Block Definition<br />
-<a href="#sectionshb">3.1</a>&nbsp;
-Section Header Block (mandatory)<br />
-<a href="#sectionidb">3.2</a>&nbsp;
-Interface Description Block (mandatory)<br />
-<a href="#sectionpb">3.3</a>&nbsp;
-Packet Block (optional)<br />
-<a href="#anchor7">3.4</a>&nbsp;
-Simple Packet Block (optional)<br />
-<a href="#anchor8">3.5</a>&nbsp;
-Name Resolution Block (optional)<br />
-<a href="#anchor9">3.6</a>&nbsp;
-Interface Statistics Block (optional)<br />
-<a href="#sectionopt">4.</a>&nbsp;
-Options<br />
-<a href="#anchor10">5.</a>&nbsp;
-Experimental Blocks (deserved to a further investigation)<br />
-<a href="#anchor11">5.1</a>&nbsp;
-Other Packet Blocks (experimental)<br />
-<a href="#anchor12">5.2</a>&nbsp;
-Compression Block (experimental)<br />
-<a href="#anchor13">5.3</a>&nbsp;
-Encryption Block (experimental)<br />
-<a href="#anchor14">5.4</a>&nbsp;
-Fixed Length Block (experimental)<br />
-<a href="#anchor15">5.5</a>&nbsp;
-Directory Block (experimental)<br />
-<a href="#anchor16">5.6</a>&nbsp;
-Traffic Statistics and Monitoring Blocks (experimental)<br />
-<a href="#anchor17">5.7</a>&nbsp;
-Event/Security Block (experimental)<br />
-<a href="#anchor18">6.</a>&nbsp;
-Conclusions<br />
-<a href="#anchor19">7.</a>&nbsp;
-Most important open issues<br />
-<a href="#rfc.copyright">&#167;</a>&nbsp;
-Intellectual Property and Copyright Statements<br />
-</p>
-<br clear="all" />
-
-<a name="anchor1"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<a name="rfc.section.1"></a><h3>1.&nbsp;Objectives</h3>
-
-<p>The problem of exchanging packet traces becomes more and more critical every day; unfortunately, no standard solutions exist for this task right now. One of the most accepted packet interchange formats is the one defined by libpcap, which is rather old and does not fit for some of the nowadays applications especially in terms of extensibility.
-</p>
-<p>This document proposes a new format for dumping packet traces. The following goals are being pursued:
-</p>
-<ul class="text">
-<li>Extensibility: aside of some common functionalities, third parties should be able to enrich the information embedded in the file with proprietary extensions, which will be ignored by tools that are not able to understand them.
-</li>
-<li>Portability: a capture trace must contain all the information needed to read data independently from network, hardware and operating system of the machine that made the capture.
-</li>
-<li>Merge/Append data: it should be possible to add data at the end of a given file, and the resulting file must still be readable.
-</li>
-</ul>
-<a name="anchor2"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<a name="rfc.section.2"></a><h3>2.&nbsp;General File Structure</h3>
-
-<a name="rfc.section.2.1"></a><h4><a name="sectionblock">2.1</a>&nbsp;General Block Structure</h4>
-
-<p>A capture file is organized in blocks, that are appended one to another to form the file. All the blocks share a common format, which is shown in <a href="#formatblock">Figure 1</a>.
-</p><br /><hr />
-<a name="formatblock"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                          Block Type                           |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                      Block Total Length                       |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                          Block Body                           /
-   /          /* variable length, aligned to 32 bits */            /
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                      Block Total Length                       |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-</pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Basic block structure.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The fields have the following meaning:
-</p>
-<ul class="text">
-<li>Block Type (32 bits): unique value that identifies the block. Values whose Most Significant Bit (MSB) is equal to 1 are reserved for local use. They allow to save private data to the file and to extend the file format.
-</li>
-<li>Block Total Length: total size of this block, in bytes. For instance, a block that does not have a body has a length of 12 bytes.
-</li>
-<li>Block Body: content of the block.
-</li>
-<li>Block Total Length: total size of this block, in bytes. This field is duplicated for permitting backward file navigation.
-</li>
-</ul>
-<p>This structure, shared among all blocks, makes easy to process a file and to skip unneeded or unknown blocks. Blocks can be nested one inside the others (NOTE: needed?). Some of the blocks are mandatory, i.e. a dump file is not valid if they are not present, other are optional.
-</p>
-<p>The structure of the blocks allows to define other blocks if needed. A parser that does non understand them can simply ignore their content.
-</p>
-<a name="rfc.section.2.2"></a><h4><a name="anchor3">2.2</a>&nbsp;Block Types</h4>
-
-<p>The currently defined blocks are the following:
-</p>
-<ol class="text">
-<li>Section Header Block: it defines the most important characteristics of the capture file.
-</li>
-<li>Interface Description Block: it defines the most important characteristics of the interface(s) used for capturing traffic.
-</li>
-<li>Packet Block: it contains a single captured packet, or a portion of it.
-</li>
-<li>Simple Packet Block: it contains a single captured packet, or a portion of it, with only a minimal set of information about it.
-</li>
-<li>Name Resolution Block: it defines the mapping from numeric addresses present in the packet dump and the canonical name counterpart.
-</li>
-<li>Capture Statistics Block: it defines how to store some statistical data (e.g. packet dropped, etc) which can be useful to undestand the conditions in which the capture has been made.
-</li>
-<li>Compression Marker Block: TODO
-</li>
-<li>Encryption Marker Block: TODO
-</li>
-<li>Fixed Length Marker Block: TODO
-</li>
-</ol>
-<p>The following blocks instead are considered interesting but the authors believe that they deserve more in-depth discussion before being defined:
-</p>
-<ol class="text">
-<li>Further Packet Blocks
-</li>
-<li>Directory Block
-</li>
-<li>Traffic Statistics and Monitoring Blocks
-</li>
-<li>Alert and Security Blocks
-</li>
-</ol>
-<p>TODO Currently standardized Block Type codes are specified in Appendix 1.
-</p>
-<a name="rfc.section.2.3"></a><h4><a name="anchor4">2.3</a>&nbsp;Block Hierarchy and Precedence</h4>
-
-<p>The file must begin with a Section Header Block. However, more than one Section Header Block can be present on the dump, each one covering the data following it till the next one (or the end of file). A Section includes the data delimited by two Section Header Blocks (or by a Section Header Block and the end of the file), including the first Section Header Block.
-</p>
-<p>In case an application cannot read a Section because of different version number, it must skip everything until the next Section Header Block. Note that, in order to properly skip the blocks until the next section, all blocks must have the fields Type and Length at the beginning. This is a mandatory requirement that must be maintained in future versions of the block format.
-</p>
-<p><a href="#fssample-SHB">Figure 2</a> shows two valid files: the first has a typical configuration, with a single Section Header that covers the whole file. The second one contains three headers, and is normally the result of file concatenation. An application that understands only version 1.0 of the file format skips the intermediate section and restart processing the packets after the third Section Header.
-</p><br /><hr />
-<a name="fssample-SHB"></a>
-<pre>
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   | SHB v1.0  |                      Data                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   Typical configuration with a single Section Header Block 
-
-
-   |--   1st Section   --|--   2nd Section   --|--  3rd Section  --|
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   | SHB v1.0  |  Data   | SHB V1.1  |  Data   | SHB V1.0  |  Data |  
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   Configuration with three different Section Header Blocks
-</pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;File structure example: the Section Header Block.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>NOTE: TO BE COMPLETED with some examples of other blocks
-</p>
-<a name="rfc.section.2.4"></a><h4><a name="anchor5">2.4</a>&nbsp;Data format</h4>
-
-<p>Data contained in each section will always be saved according to the characteristics (little endian / big endian) of the dumping machine. This refers to all fields that are saved as numbers and that span over two or more bytes.
-</p>
-<p>The approach of having each section saved in the native format of the generating host is more efficient because it avoids translation of data when reading / writing on the host itself, which is the most common case when generating/processing capture dumps.
-</p>
-<p>TODO Probably we have to specify something more here. Is what we're saying enough to avoid any kind of ambiguity?.
-</p>
-<a name="anchor6"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<a name="rfc.section.3"></a><h3>3.&nbsp;Block Definition</h3>
-
-<p>This section details the format of the body of the blocks currently defined.
-</p>
-<a name="rfc.section.3.1"></a><h4><a name="sectionshb">3.1</a>&nbsp;Section Header Block (mandatory)</h4>
-
-<p>The Section Header Block is mandatory. It identifies the beginning of a section of the capture dump file. Its format is shown in <a href="#formatSHB">Figure 3</a>.
-</p><br /><hr />
-<a name="formatSHB"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                            Magic                              |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |              Major            |             Minor             |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-</pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Section Header Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The meaning of the fields is:
-</p>
-<ul class="text">
-<li>Magic: magic number, whose value is the hexadecimal number 0x1A2B3C4D. This number can be used to distinguish section that have been saved on little-endian machines from the one saved on big-endian machines.
-</li>
-<li>Major: number of the current mayor version of the format. Current value is 1.
-</li>
-<li>Minor: number of the current minor version of the format. Current value is 0.
-</li>
-<li>Options: optionally, a list of options (formatted according to the rules defined in <a href="#sectionopt">Section 4</a>) can be present.
-</li>
-</ul>
-<p>Aside form the options defined in <a href="#sectionopt">Section 4</a>, the following options are valid within this block:
-</p><a name="InterfaceOptions1"></a>
-<table class="data" align="center" border="1" cellpadding="2" cellspacing="2">
-<tr>
-<th align="left" width="25%">Name</th>
-<th align="left" width="25%">Code</th>
-<th align="left" width="25%">Length</th>
-<th align="left" width="25%">Description</th>
-</tr>
-<tr>
-<td align="left">Hardware</td>
-<td align="left">2</td>
-<td align="left">variable</td>
-<td align="left">An ascii string containing the description of the hardware used to create this section.</td>
-</tr>
-<tr>
-<td align="left">Operating System</td>
-<td align="left">3</td>
-<td align="left">variable</td>
-<td align="left">An ascii string containing the name of the operating system used to create this section.</td>
-</tr>
-<tr>
-<td align="left">User Application</td>
-<td align="left">3</td>
-<td align="left">variable</td>
-<td align="left">An ascii string containing the name of the application used to create this section.</td>
-</tr>
-</table>
-
-<p>The Section Header Block does not contain data but it rather identifies a list of blocks (interfaces, packets) that are logically correlated. This block does not contain any reference to the size of the section it is currently delimiting, therefore the reader cannot skip a whole section at once. In case a section must be skipped, the user has to repeatedly skip all the blocks contained within it; this makes the parsing of the file slower but it permits to append several capture dumps at the same file.
-</p>
-<a name="rfc.section.3.2"></a><h4><a name="sectionidb">3.2</a>&nbsp;Interface Description Block (mandatory)</h4>
-
-<p>The Interface Description Block is mandatory. This block is needed to specify the characteristics of the network interface on which the capture has been made. In order to properly associate the captured data to the corresponding interface, the Interface Description Block must be defined before any other block that uses it; therefore, this block is usually placed immediately after the Section Header Block.
-</p>
-<p>An Interface Description Block is valid only inside the section which it belongs to. The structure of a Interface Description Block is shown in <a href="#formatidb">Figure 4</a>.
-</p><br /><hr />
-<a name="formatidb"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |          Interface ID         |           LinkType            |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                            SnapLen                            |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Interface Description Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The meaning of the fields is:
-</p>
-<ul class="text">
-<li>Interface ID: a progressive number that identifies uniquely any interface inside current section. Two Interface Description Blocks can have the same Interface ID only if they are in different sections of the file. The Interface ID is referenced by the packet blocks.
-</li>
-<li>LinkType: a value that defines the link layer type of this interface.
-</li>
-<li>SnapLen: maximum number of bytes dumped from each packet. The portion of each packet that exceeds this value will not be stored in the file.
-</li>
-<li>Options: optionally, a list of options (formatted according to the rules defined in <a href="#sectionopt">Section 4</a>) can be present.
-</li>
-</ul>
-<p>In addition to the options defined in <a href="#sectionopt">Section 4</a>, the following options are valid within this block:
-</p><a name="InterfaceOptions2"></a>
-<table class="data" align="center" border="1" cellpadding="2" cellspacing="2">
-<tr>
-<th align="left" width="25%">Name</th>
-<th align="left" width="25%">Code</th>
-<th align="left" width="25%">Length</th>
-<th align="left" width="25%">Description</th>
-</tr>
-<tr>
-<td align="left">if_name</td>
-<td align="left">2</td>
-<td align="left">Variable</td>
-<td align="left">Name of the device used to capture data.</td>
-</tr>
-<tr>
-<td align="left">if_IPv4addr</td>
-<td align="left">3</td>
-<td align="left">8</td>
-<td align="left">Interface network address and netmask.</td>
-</tr>
-<tr>
-<td align="left">if_IPv6addr</td>
-<td align="left">4</td>
-<td align="left">17</td>
-<td align="left">Interface network address and prefix length (stored in the last byte).</td>
-</tr>
-<tr>
-<td align="left">if_MACaddr</td>
-<td align="left">5</td>
-<td align="left">6</td>
-<td align="left">Interface Hardware MAC address (48 bits).</td>
-</tr>
-<tr>
-<td align="left">if_EUIaddr</td>
-<td align="left">6</td>
-<td align="left">8</td>
-<td align="left">Interface Hardware EUI address (64 bits), if available.</td>
-</tr>
-<tr>
-<td align="left">if_speed</td>
-<td align="left">7</td>
-<td align="left">8</td>
-<td align="left">Interface speed (in bps).</td>
-</tr>
-<tr>
-<td align="left">if_tsaccur</td>
-<td align="left">8</td>
-<td align="left">1</td>
-<td align="left">Precision of timestamps. If the Most Significant Bit is equal to zero, the remaining bits indicates the accuracy as as a negative power of 10 (e.g. 6 means microsecond accuracy). If the Most Significant Bit is equal to zero, the remaining bits indicates the accuracy as as negative power of 2 (e.g. 10 means 1/1024 of second). If this option is not present, a precision of 10^-6 is assumed.</td>
-</tr>
-<tr>
-<td align="left">if_tzone</td>
-<td align="left">9</td>
-<td align="left">4</td>
-<td align="left">Time zone for GMT support (TODO: specify better).</td>
-</tr>
-<tr>
-<td align="left">if_flags</td>
-<td align="left">10</td>
-<td align="left">4</td>
-<td align="left">Interface flags. (TODO: specify better. Possible flags: promiscuous, inbound/outbound, traffic filtered during capture).</td>
-</tr>
-<tr>
-<td align="left">if_filter</td>
-<td align="left">11</td>
-<td align="left">variable</td>
-<td align="left">The filter (e.g. "capture only TCP traffic") used to capture traffic. The first byte of the Option Data keeps a code of the filter used (e.g. if this is a libpcap string, or BPF bytecode, and more). More details about this format will be presented in Appendix XXX (TODO).</td>
-</tr>
-<tr>
-<td align="left">if_opersystem</td>
-<td align="left">12</td>
-<td align="left">variable</td>
-<td align="left">An ascii string containing the name of the operating system of the machine that hosts this interface. This can be different from the same information that can be contained by the Section Header Block (<a href="#sectionshb">Section 3.1</a>) because the capture can have been done on a remote machine.</td>
-</tr>
-</table>
-
-<a name="rfc.section.3.3"></a><h4><a name="sectionpb">3.3</a>&nbsp;Packet Block (optional)</h4>
-
-<p>A Packet Block is the standard container for storing the packets coming from the network. The Packet Block is optional because packets can be stored either by means of this block or the Simple Packet Block, which can be used to speed up dump generation. The format of a packet block is shown in <a href="#formatpb">Figure 5</a>.
-</p><br /><hr />
-<a name="formatpb"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |         Interface ID          |          Drops Count          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                        Timestamp (High)                       |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                        Timestamp (Low)                        |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         Captured Len                          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                          Packet Len                           |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               |
-   |                          Packet Data                          |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-</pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Packet Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The Packet Block has the following fields:
-</p>
-<ul class="text">
-<li>Interface ID: Specifies the interface this packet comes from, and corresponds to the ID of one of the Interface Description Blocks present in this section of the file (see <a href="#formatidb">Figure 4</a>).
-</li>
-<li>Drops Count: a local drop counter. It specified the number of packets lost (by the interface and the operating system) between this packet and the preceding one. The value xFFFF (in hexadecimal) is reserved for those systems in which this information is not available.
-</li>
-<li>Timestamp (High): the most significative part of the timestamp. in standard Unix format, i.e. from 1/1/1970.
-</li>
-<li>Timestamp (Low): the less significative part of the timestamp. The way to interpret this field is specified by the 'ts_accur' option (see <a href="#formatidb">Figure 4</a>) of the Interface Description block referenced by this packet. If the Interface Description block does not contain a 'ts_accur' option, then this field is expressed in microseconds.
-</li>
-<li>Captured Len: number of bytes captured from the packet (i.e. the length of the Packet Data field). It will be the minimum value among the actual Packet Length and the snapshot length (defined in <a href="#formatidb">Figure 4</a>).
-</li>
-<li>Packet Len: actual length of the packet when it was transmitted on the network. Can be different from Captured Len if the user wants only a snapshot of the packet.
-</li>
-<li>Packet Data: the data coming from the network, including link-layer headers. The length of this field is Captured Len. The format of the link-layer headers depends on the LinkType field specified in the Interface Description Block (see <a href="#sectionidb">Section 3.2</a>) and it is specified in Appendix XXX (TODO).
-</li>
-<li>Options: optionally, a list of options (formatted according to the rules defined in <a href="#sectionopt">Section 4</a>) can be present.
-</li>
-</ul>
-<p>
-</p>
-<a name="rfc.section.3.4"></a><h4><a name="anchor7">3.4</a>&nbsp;Simple Packet Block (optional)</h4>
-
-<p>The Simple Packet Block is a lightweight container for storing the packets coming from the network. Its presence is optional.
-</p>
-<p>A Simple Packet Block is similar to a Packet Block (see <a href="#sectionpb">Section 3.3</a>), but it is smaller, simpler to process and contains only a minimal set of information. This block is preferred to the standard Packet Block when performance or space occupation are critical factors, such as in sustained traffic dump applications. A capture file can contain both Packet Blocks and Simple Packet Blocks: for example, a capture tool could switch from Packet Blocks to Simple Packet Blocks when the hardware resources become critical.
-</p>
-<p>The Simple Packet Block does not contain the Interface ID field. Therefore, it must be assumed that all the Simple Packet Blocks have been captured on the interface previously specified in the Interface Description Block.
-</p>
-<p><a href="#formatpbs">Figure 6</a> shows the format of the Simple Packet Block.
-</p><br /><hr />
-<a name="formatpbs"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                          Packet Len                           |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               |
-   |                          Packet Data                          |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Simple Packet Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The Packet Block has the following fields:
-</p>
-<ul class="text">
-<li>Packet Len: actual length of the packet when it was transmitted on the network. Can be different from captured len if the packet has been truncated.
-</li>
-<li>Packet data: the data coming from the network, including link-layers headers. The length of this field can be derived from the field Block Total Length, present in the Block Header.
-</li>
-</ul>
-<p>The Simple Packet Block does not contain the timestamp because this is one of the most costly operations on PCs. Additionally, there are applications that do not require it; e.g. an Intrusion Detection System is interested in packets, not in their timestamp.
-</p>
-<p>The Simple Packet Block is very efficient in term of disk space: a snapshot of length 100 bytes requires only 16 bytes of overhead, which corresponds to an efficiency of more than 86%.
-</p>
-<a name="rfc.section.3.5"></a><h4><a name="anchor8">3.5</a>&nbsp;Name Resolution Block (optional)</h4>
-
-<p>The Name Resolution Block is used to support the correlation of numeric addresses (present in the captured packets) and their corresponding canonical names and it is optional. Having the literal names saved in the file, this prevents the need of a name resolution in a delayed time, when the association between names and addresses can be different from the one in use at capture time. Moreover, The Name Resolution Block avoids the need of issuing a lot of DNS requests every time the trace capture is opened, and allows to have name resolution also when reading the capture with a machine not connected to the network.
-</p>
-<p>The format of the Name Resolution Block is shown in <a href="#formatnrb">Figure 7</a>.
-</p><br /><hr />
-<a name="formatnrb"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |      Record Type              |         Record Length         | 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                       Record Value                            |
-   |              /* variable length, byte-aligned */              |
-   |               + + + + + + + + + + + + + + + + + + + + + + + + +
-   |               |               |               |               |
-   +-+-+-+-+-+-+-+-+ + + + + + + + + + + + + + + + + + + + + + + + +
-             . . . other records . . .
-   |  Record Type == end_of_recs   |  Record Length == 00          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Name Resolution Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>A Name Resolution Block is a zero-terminated list of records (in the TLV format), each of which contains an association between a network address and a name. There are three possible types of records:
-</p><a name="nrrecords"></a>
-<table class="data" align="center" border="1" cellpadding="2" cellspacing="2">
-<tr>
-<th align="left" width="25%">Name</th>
-<th align="left" width="25%">Code</th>
-<th align="left" width="25%">Length</th>
-<th align="left" width="25%">Description</th>
-</tr>
-<tr>
-<td align="left">end_of_recs</td>
-<td align="left">0</td>
-<td align="left">0</td>
-<td align="left">End of records</td>
-</tr>
-<tr>
-<td align="left">ip4_rec</td>
-<td align="left">1</td>
-<td align="left">Variable</td>
-<td align="left">Specifies an IPv4 address (contained in the first 4 bytes), followed by one or more zero-terminated strings containing the DNS entries for that address.</td>
-</tr>
-<tr>
-<td align="left">ip6_rec</td>
-<td align="left">1</td>
-<td align="left">Variable</td>
-<td align="left">Specifies an IPv6 address (contained in the first 16 bytes), followed by one or more zero-terminated strings containing the DNS entries for that address.</td>
-</tr>
-</table>
-
-<p>After the list or Name Resolution Records, optionally, a list of options (formatted according to the rules defined in <a href="#sectionopt">Section 4</a>) can be present.
-</p>
-<p>A Name Resolution Block is normally placed at the beginning of the file, but no assumptions can be taken about its position. Name Resolution Blocks can be added in a second time by tools that process the file, like network analyzers.
-</p>
-<p>In addiction to the options defined in <a href="#sectionopt">Section 4</a>, the following options are valid within this block:
-</p><table class="data" align="center" border="1" cellpadding="2" cellspacing="2">
-<tr>
-<th align="left" width="25%">Name</th>
-<th align="left" width="25%">Code</th>
-<th align="left" width="25%">Length</th>
-<th align="left" width="25%">Description</th>
-</tr>
-<tr>
-<td align="left">ns_dnsname</td>
-<td align="left">2</td>
-<td align="left">Variable</td>
-<td align="left">An ascii string containing the name of the machine (DNS server) used to perform the name resolution.</td>
-</tr>
-</table>
-
-<a name="rfc.section.3.6"></a><h4><a name="anchor9">3.6</a>&nbsp;Interface Statistics Block (optional)</h4>
-
-<p>The Interface Statistics Block contains the capture statistics for a given interface and it is optional. The statistics are referred to the interface defined in the current Section identified by the Interface ID field.
-</p>
-<p>The format of the Interface Statistics Block is shown in <a href="#formatisb">Figure 8</a>.
-</p><br /><hr />
-<a name="formatisb"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         IfRecv                                |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         IfDrop                                |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         FilterAccept                          |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         OSDrop                                |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         UsrDelivered                          |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |          Interface ID         |           Reserved            |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Interface Statistics Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The fields have the following meaning:
-</p>
-<ul class="text">
-<li>IfRecv: number of packets received from the interface during the capture. This number is reported as a 64 bits value, in which the most significat bits are located in the first four bytes of the field.
-</li>
-<li>IfDrop: number of packets dropped by the interface during the capture due to lack of resources.
-</li>
-<li>FilterAccept: number of packets accepeted by filter during current capture.
-</li>
-<li>OSDrop: number of packets dropped by the operating system during the capture.
-</li>
-<li>UsrDelivered: number of packets delivered to the user. UsrDelivered can be different from the value 'FilterAccept - OSDropped' because some packets could still lay in the OS buffers when the capture ended.
-</li>
-<li>Interface ID: reference to an Interface Description Block.
-</li>
-<li>Reserved: Reserved to future use.
-</li>
-<li>Options: optionally, a list of options (formatted according to the rules defined in <a href="#sectionopt">Section 4</a>) can be present.
-</li>
-</ul>
-<p>In addiction to the options defined in <a href="#sectionopt">Section 4</a>, the following options are valid within this block:
-</p><table class="data" align="center" border="1" cellpadding="2" cellspacing="2">
-<tr>
-<th align="left" width="25%">Name</th>
-<th align="left" width="25%">Code</th>
-<th align="left" width="25%">Length</th>
-<th align="left" width="25%">Description</th>
-</tr>
-<tr>
-<td align="left">isb_starttime</td>
-<td align="left">2</td>
-<td align="left">8</td>
-<td align="left">Time in which the capture started; time will be stored in two blocks of four bytes each, containing the timestamp in seconds and nanoseconds.</td>
-</tr>
-<tr>
-<td align="left">isb_endtime</td>
-<td align="left">3</td>
-<td align="left">8</td>
-<td align="left">Time in which the capture started; time will be stored in two blocks of four bytes each, containing the timestamp in seconds and nanoseconds.</td>
-</tr>
-</table>
-
-<a name="sectionopt"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<a name="rfc.section.4"></a><h3>4.&nbsp;Options</h3>
-
-<p>Almost all blocks have the possibility to embed optional fields. Optional fields can be used to insert some information that may be useful when reading data, but that it is not really needed for packet processing. Therefore, each tool can be either read the content of the optional fields (if any), or skip them at once.
-</p>
-<p>Skipping all the optional fields at once is straightforward because most of the blocks have a fixed length, therefore the field Block Length (present in the General Block Structure, see  <a href="#sectionblock">Section 2.1</a>) can be used to skip everything till the next block.
-</p>
-<p>Options are a list of Type - Length - Value fields, each one containing a single value:
-</p>
-<ul class="text">
-<li>Option Type (2 bytes): it contains the code that specifies the type of the current TLV record. Option types whose Most Significant Bit is equal to one are reserved for local use; therefore, there is no guarantee that the code used is unique among all capture files (generated by other applications). In case of vendor-specific extensions that have to be identified uniquely, vendors must request an Option Code whose MSB is equal to zero.
-</li>
-<li>Option Length (2 bytes): it contains the length of the following 'Option Value' field.
-</li>
-<li>Option Value (variable length): it contains the value of the given option. The length of this field as been specified by the Option Length field.
-</li>
-</ul>
-<p>Options may be repeated several times (e.g. an interface that has several IP addresses associated to it). The option list is terminated by a special code which is the 'End of Option'.
-</p>
-<p>The format of the optional fields is shown in <a href="#formatopt">Figure 9</a>.
-</p><br /><hr />
-<a name="formatopt"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |      Option Code              |         Option Length         | 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                       Option Value                            |
-   |              /* variable length, byte-aligned */              |
-   |               + + + + + + + + + + + + + + + + + + + + + + + + +
-   |               /               /               /               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               /
-   /                 . . . other options . . .                     /
-   /                                                               /
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |   Option Code == opt_endofopt  |  Option Length == 0          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Options format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The following codes can always be present in any optional field:
-</p><table class="data" align="center" border="1" cellpadding="2" cellspacing="2">
-<tr>
-<th align="left" width="25%">Name</th>
-<th align="left" width="25%">Code</th>
-<th align="left" width="25%">Length</th>
-<th align="left" width="25%">Description</th>
-</tr>
-<tr>
-<td align="left">opt_endofopt</td>
-<td align="left">0</td>
-<td align="left">0</td>
-<td align="left">End of options: it is used to delimit the end of the optional fields. This block cannot be repeated within a given list of options.</td>
-</tr>
-<tr>
-<td align="left">opt_comment</td>
-<td align="left">1</td>
-<td align="left">variable</td>
-<td align="left">Comment: it is an ascii string containing a comment that is associated to the current block.</td>
-</tr>
-</table>
-
-<a name="anchor10"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<a name="rfc.section.5"></a><h3>5.&nbsp;Experimental Blocks (deserved to a further investigation)</h3>
-
-<a name="rfc.section.5.1"></a><h4><a name="anchor11">5.1</a>&nbsp;Other Packet Blocks (experimental)</h4>
-
-<p>Can some other packet blocks (besides the two described in the previous paragraphs) be useful?
-</p>
-<a name="rfc.section.5.2"></a><h4><a name="anchor12">5.2</a>&nbsp;Compression Block (experimental)</h4>
-
-<p>The Compression Block is optional. A file can contain an arbitrary number of these blocks. A Compression Block, as the name says, is used to store compressed data. Its format is shown in <a href="#formatcb">Figure 10</a>.
-</p><br /><hr />
-<a name="formatcb"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |  Compr. Type  |                                               |
-   +-+-+-+-+-+-+-+-+                                               |
-   |                                                               |
-   |                       Compressed Data                         |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Compression Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The fields have the following meaning:
-</p>
-<ul class="text">
-<li>Compression Type: specifies the compression algorithm. Possible values for this field are 0 (uncompressed), 1 (Lempel Ziv), 2 (Gzip), other?? Probably some kind of dumb and fast compression algorithm could be effective with some types of traffic (for example web), but which?
-</li>
-<li>Compressed Data: data of this block. Once decompressed, it is made of other blocks.
-</li>
-</ul>
-<a name="rfc.section.5.3"></a><h4><a name="anchor13">5.3</a>&nbsp;Encryption Block (experimental)</h4>
-
-<p>The Encryption Block is optional. A file can contain an arbitrary number of these blocks. An Encryption Block is used to sotre encrypted data. Its format is shown in <a href="#formateb">Figure 11</a>.
-</p><br /><hr />
-<a name="formateb"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |   Encr. Type  |                                               |
-   +-+-+-+-+-+-+-+-+                                               |
-   |                                                               |
-   |                       Compressed Data                         |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Encryption Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The fields have the following meaning:
-</p>
-<ul class="text">
-<li>Compression Type: specifies the encryption algorithm. Possible values for this field are ??? NOTE: this block should probably contain other fields, depending on the encryption algorithm. To be define precisely.
-</li>
-<li>Encrypted Data: data of this block. Once decripted, it consists of other blocks.
-</li>
-</ul>
-<a name="rfc.section.5.4"></a><h4><a name="anchor14">5.4</a>&nbsp;Fixed Length Block (experimental)</h4>
-
-<p>The Fixed Length Block is optional. A file can contain an arbitrary number of these blocks. A Fixed Length Block can be used to optimize the access to the file. Its format is shown in <a href="#formatflm">Figure 12</a>.
-A Fixed Length Block stores records with constant size. It contains a set of Blocks (normally Packet Blocks or Simple Packet Blocks), of wihich it specifies the size. Knowing this size a priori helps to scan the file and to load some portions of it without truncating a block, and is particularly useful with cell-based networks like ATM.
-</p><br /><hr />
-<a name="formatflm"></a>
-<pre>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |          Cell Size            |                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
-   |                                                               |
-   |                        Fixed Size Data                        |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </pre>
-<table border="0" cellpadding="0" cellspacing="2" align="center"><tr><td align="center"><font face="monaco, MS Sans Serif" size="1"><b>&nbsp;Fixed Length Block format.&nbsp;</b></font><br /></td></tr></table><hr size="1" shade="0">
-
-<p>The fields have the following meaning:
-</p>
-<ul class="text">
-<li>Cell size: the size of the blocks contained in the data field.
-</li>
-<li>Fixed Size Data: data of this block.
-</li>
-</ul>
-<a name="rfc.section.5.5"></a><h4><a name="anchor15">5.5</a>&nbsp;Directory Block (experimental)</h4>
-
-<p>If present, this block contains the following information:
-</p>
-<ul class="text">
-<li>number of indexed packets (N)
-</li>
-<li>table with position and length of any indexed packet (N entries)
-</li>
-</ul>
-<p>A directory block must be followed by at least N packets, otherwise it must be considered invalid. It can be used to efficiently load portions of the file to memory and to support operations on memory mapped files. This block can be added by tools like network analyzers as a consequence of file processing.
-</p>
-<a name="rfc.section.5.6"></a><h4><a name="anchor16">5.6</a>&nbsp;Traffic Statistics and Monitoring Blocks (experimental)</h4>
-
-<p>One or more blocks could be defined to contain network statistics or traffic monitoring information. They could be use to store data collected from RMON or Netflow probes, or from other network monitoring tools.
-</p>
-<a name="rfc.section.5.7"></a><h4><a name="anchor17">5.7</a>&nbsp;Event/Security Block (experimental)</h4>
-
-<p>This block could be used to store events. Events could contain generic information (for example network load over 50%, server down...) or security alerts. An event could be:
-</p>
-<ul class="text">
-<li>skipped, if the application doesn't know how to do with it
-</li>
-<li>processed independently by the packets. In other words, the applications skips the packets and processes only the alerts
-</li>
-<li>processed in relation to packets: for example, a security tool could load only the packets of the file that are near a security alert; a monitorg tool could skip the packets captured while the server was down.
-</li>
-</ul>
-<a name="anchor18"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<a name="rfc.section.6"></a><h3>6.&nbsp;Conclusions</h3>
-
-<p>The file format proposed in this document should be very versatile and satisfy a wide range of applications.
-In the simplest case, it can contain a raw dump of the network data, made of a series of Simple Packet Blocks.
-In the most complex case, it can be used as a repository for heterogeneous information.
-In every case, the file remains easy to parse and an application can always skip the data it is not interested in; at the same time, different applications can share the file, and each of them can benfit of the information produced by the others.
-Two or more files can be concatenated obtaining another valid file.
-</p>
-<a name="anchor19"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<a name="rfc.section.7"></a><h3>7.&nbsp;Most important open issues</h3>
-
-<ul class="text">
-<li>Data, in the file, must be byte or word aligned? Currently, the structure of this document is not consistent with respect to this point.
-</li>
-</ul><a name="rfc.copyright"></a><br /><hr />
-<table summary="layout" cellpadding="0" cellspacing="2" class="bug" align="right"><tr><td class="bug"><a href="#toc" class="link2">&nbsp;TOC&nbsp;</a></td></tr></table>
-<h3>Intellectual Property Statement</h3>
-<p class='copyright'>
-The IETF takes no position regarding the validity or scope of
-any intellectual property or other rights that might be claimed
-to  pertain to the implementation or use of the technology
-described in this document or the extent to which any license
-under such rights might or might not be available; neither does
-it represent that it has made any effort to identify any such
-rights. Information on the IETF's procedures with respect to
-rights in standards-track and standards-related documentation
-can be found in BCP-11. Copies of claims of rights made
-available for publication and any assurances of licenses to
-be made available, or the result of an attempt made
-to obtain a general license or permission for the use of such
-proprietary rights by implementors or users of this
-specification can be obtained from the IETF Secretariat.</p>
-<p class='copyright'>
-The IETF invites any interested party to bring to its
-attention any copyrights, patents or patent applications, or
-other proprietary rights which may cover technology that may be
-required to practice this standard. Please address the
-information to the IETF Executive Director.</p>
-<h3>Full Copyright Statement</h3>
-<p class='copyright'>
-Copyright (C) The Internet Society (2004). All Rights Reserved.</p>
-<p class='copyright'>
-This document and translations of it may be copied and furnished to
-others, and derivative works that comment on or otherwise explain it
-or assist in its implementation may be prepared, copied, published and
-distributed, in whole or in part, without restriction of any kind,
-provided that the above copyright notice and this paragraph are
-included on all such copies and derivative works. However, this
-document itself may not be modified in any way, such as by removing
-the copyright notice or references to the Internet Society or other
-Internet organizations, except as needed for the purpose of
-developing Internet standards in which case the procedures for
-copyrights defined in the Internet Standards process must be
-followed, or as required to translate it into languages other than
-English.</p>
-<p class='copyright'>
-The limited permissions granted above are perpetual and will not be
-revoked by the Internet Society or its successors or assignees.</p>
-<p class='copyright'>
-This document and the information contained herein is provided on an
-&quot;AS IS&quot; basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.</p>
-<h3>Acknowledgment</h3>
-<p class='copyright'>
-Funding for the RFC Editor function is currently provided by the
-Internet Society.</p>
-</body></html>
diff --git a/contrib/libpcap/doc/pcap.txt b/contrib/libpcap/doc/pcap.txt
deleted file mode 100644
index cfa6645..0000000
--- a/contrib/libpcap/doc/pcap.txt
+++ /dev/null
@@ -1,1680 +0,0 @@
-
-
-Network Working Group                                       L. Degioanni
-Internet-Draft                                                  F. Risso
-Expires: August 30, 2004                           Politecnico di Torino
-                                                              March 2004
-
-
-                  PCAP New Generation Dump File Format
-                                  pcap
-
-Status of this Memo
-
-   This document is an Internet-Draft and is in full conformance with
-   all provisions of Section 10 of RFC2026.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF), its areas, and its working groups. Note that other
-   groups may also distribute working documents as Internet-Drafts.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time. It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   The list of current Internet-Drafts can be accessed at http://
-   www.ietf.org/ietf/1id-abstracts.txt.
-
-   The list of Internet-Draft Shadow Directories can be accessed at
-   http://www.ietf.org/shadow.html.
-
-   This Internet-Draft will expire on August 30, 2004.
-
-Copyright Notice
-
-   Copyright (C) The Internet Society (2004). All Rights Reserved.
-
-Abstract
-
-   This document describes a format to dump captured packets on a file.
-   This format is extensible and it is currently proposed for
-   implementation in the libpcap/WinPcap packet capture library.
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 1]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-Table of Contents
-
-   1.  Objectives . . . . . . . . . . . . . . . . . . . . . . . . . .  3
-   2.  General File Structure . . . . . . . . . . . . . . . . . . . .  4
-   2.1 General Block Structure  . . . . . . . . . . . . . . . . . . .  4
-   2.2 Block Types  . . . . . . . . . . . . . . . . . . . . . . . . .  5
-   2.3 Block Hierarchy and Precedence . . . . . . . . . . . . . . . .  5
-   2.4 Data format  . . . . . . . . . . . . . . . . . . . . . . . . .  6
-   3.  Block Definition . . . . . . . . . . . . . . . . . . . . . . .  8
-   3.1 Section Header Block (mandatory) . . . . . . . . . . . . . . .  8
-   3.2 Interface Description Block (mandatory)  . . . . . . . . . . .  9
-   3.3 Packet Block (optional)  . . . . . . . . . . . . . . . . . . . 13
-   3.4 Simple Packet Block (optional) . . . . . . . . . . . . . . . . 15
-   3.5 Name Resolution Block (optional) . . . . . . . . . . . . . . . 16
-   3.6 Interface Statistics Block (optional)  . . . . . . . . . . . . 18
-   4.  Options  . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
-   5.  Experimental Blocks (deserved to a further investigation)  . . 23
-   5.1 Other Packet Blocks (experimental) . . . . . . . . . . . . . . 23
-   5.2 Compression Block (experimental) . . . . . . . . . . . . . . . 23
-   5.3 Encryption Block (experimental)  . . . . . . . . . . . . . . . 23
-   5.4 Fixed Length Block (experimental)  . . . . . . . . . . . . . . 24
-   5.5 Directory Block (experimental) . . . . . . . . . . . . . . . . 25
-   5.6 Traffic Statistics and Monitoring Blocks (experimental)  . . . 25
-   5.7 Event/Security Block (experimental)  . . . . . . . . . . . . . 25
-   6.  Conclusions  . . . . . . . . . . . . . . . . . . . . . . . . . 27
-   7.  Most important open issues . . . . . . . . . . . . . . . . . . 28
-       Intellectual Property and Copyright Statements . . . . . . . . 29
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 2]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-1. Objectives
-
-   The problem of exchanging packet traces becomes more and more
-   critical every day; unfortunately, no standard solutions exist for
-   this task right now. One of the most accepted packet interchange
-   formats is the one defined by libpcap, which is rather old and does
-   not fit for some of the nowadays applications especially in terms of
-   extensibility.
-
-   This document proposes a new format for dumping packet traces. The
-   following goals are being pursued:
-
-   o  Extensibility: aside of some common functionalities, third parties
-      should be able to enrich the information embedded in the file with
-      proprietary extensions, which will be ignored by tools that are
-      not able to understand them.
-
-   o  Portability: a capture trace must contain all the information
-      needed to read data independently from network, hardware and
-      operating system of the machine that made the capture.
-
-   o  Merge/Append data: it should be possible to add data at the end of
-      a given file, and the resulting file must still be readable.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 3]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-2. General File Structure
-
-2.1 General Block Structure
-
-   A capture file is organized in blocks, that are appended one to
-   another to form the file. All the blocks share a common format, which
-   is shown in Figure 1.
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                          Block Type                           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                      Block Total Length                       |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      /                          Block Body                           /
-      /          /* variable length, aligned to 32 bits */            /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                      Block Total Length                       |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                    Figure 1: Basic block structure.
-
-   The fields have the following meaning:
-
-   o  Block Type (32 bits): unique value that identifies the block.
-      Values whose Most Significant Bit (MSB) is equal to 1 are reserved
-      for local use. They allow to save private data to the file and to
-      extend the file format.
-
-   o  Block Total Length: total size of this block, in bytes. For
-      instance, a block that does not have a body has a length of 12
-      bytes.
-
-   o  Block Body: content of the block.
-
-   o  Block Total Length: total size of this block, in bytes. This field
-      is duplicated for permitting backward file navigation.
-
-   This structure, shared among all blocks, makes easy to process a file
-   and to skip unneeded or unknown blocks. Blocks can be nested one
-   inside the others (NOTE: needed?). Some of the blocks are mandatory,
-   i.e. a dump file is not valid if they are not present, other are
-   optional.
-
-   The structure of the blocks allows to define other blocks if needed.
-   A parser that does non understand them can simply ignore their
-   content.
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 4]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-2.2 Block Types
-
-   The currently defined blocks are the following:
-
-   1.  Section Header Block: it defines the most important
-       characteristics of the capture file.
-
-   2.  Interface Description Block: it defines the most important
-       characteristics of the interface(s) used for capturing traffic.
-
-   3.  Packet Block: it contains a single captured packet, or a portion
-       of it.
-
-   4.  Simple Packet Block: it contains a single captured packet, or a
-       portion of it, with only a minimal set of information about it.
-
-   5.  Name Resolution Block: it defines the mapping from numeric
-       addresses present in the packet dump and the canonical name
-       counterpart.
-
-   6.  Capture Statistics Block: it defines how to store some
-       statistical data (e.g. packet dropped, etc) which can be useful
-       to undestand the conditions in which the capture has been made.
-
-   7.  Compression Marker Block: TODO
-
-   8.  Encryption Marker Block: TODO
-
-   9.  Fixed Length Marker Block: TODO
-
-   The following blocks instead are considered interesting but the
-   authors believe that they deserve more in-depth discussion before
-   being defined:
-
-   1.  Further Packet Blocks
-
-   2.  Directory Block
-
-   3.  Traffic Statistics and Monitoring Blocks
-
-   4.  Alert and Security Blocks
-
-   TODO Currently standardized Block Type codes are specified in
-   Appendix 1.
-
-2.3 Block Hierarchy and Precedence
-
-   The file must begin with a Section Header Block. However, more than
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 5]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   one Section Header Block can be present on the dump, each one
-   covering the data following it till the next one (or the end of
-   file). A Section includes the data delimited by two Section Header
-   Blocks (or by a Section Header Block and the end of the file),
-   including the first Section Header Block.
-
-   In case an application cannot read a Section because of different
-   version number, it must skip everything until the next Section Header
-   Block. Note that, in order to properly skip the blocks until the next
-   section, all blocks must have the fields Type and Length at the
-   beginning. This is a mandatory requirement that must be maintained in
-   future versions of the block format.
-
-   Figure 2 shows two valid files: the first has a typical
-   configuration, with a single Section Header that covers the whole
-   file. The second one contains three headers, and is normally the
-   result of file concatenation. An application that understands only
-   version 1.0 of the file format skips the intermediate section and
-   restart processing the packets after the third Section Header.
-
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      | SHB v1.0  |                      Data                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      Typical configuration with a single Section Header Block
-
-
-      |--   1st Section   --|--   2nd Section   --|--  3rd Section  --|
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      | SHB v1.0  |  Data   | SHB V1.1  |  Data   | SHB V1.0  |  Data |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      Configuration with three different Section Header Blocks
-
-      Figure 2: File structure example: the Section Header Block.
-
-   NOTE: TO BE COMPLETED with some examples of other blocks
-
-2.4 Data format
-
-   Data contained in each section will always be saved according to the
-   characteristics (little endian / big endian) of the dumping machine.
-   This refers to all fields that are saved as numbers and that span
-   over two or more bytes.
-
-   The approach of having each section saved in the native format of the
-   generating host is more efficient because it avoids translation of
-   data when reading / writing on the host itself, which is the most
-   common case when generating/processing capture dumps.
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 6]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   TODO Probably we have to specify something more here. Is what we're
-   saying enough to avoid any kind of ambiguity?.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 7]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-3. Block Definition
-
-   This section details the format of the body of the blocks currently
-   defined.
-
-3.1 Section Header Block (mandatory)
-
-   The Section Header Block is mandatory. It identifies the beginning of
-   a section of the capture dump file. Its format is shown in Figure 3.
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                            Magic                              |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |              Major            |             Minor             |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      /                                                               /
-      /                      Options (variable)                       /
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                 Figure 3: Section Header Block format.
-
-   The meaning of the fields is:
-
-   o  Magic: magic number, whose value is the hexadecimal number
-      0x1A2B3C4D. This number can be used to distinguish section that
-      have been saved on little-endian machines from the one saved on
-      big-endian machines.
-
-   o  Major: number of the current mayor version of the format. Current
-      value is 1.
-
-   o  Minor: number of the current minor version of the format. Current
-      value is 0.
-
-   o  Options: optionally, a list of options (formatted according to the
-      rules defined in Section 4) can be present.
-
-   Aside form the options defined in Section 4, the following options
-   are valid within this block:
-
-   +----------------+----------------+----------------+----------------+
-   | Name           | Code           | Length         | Description    |
-   +----------------+----------------+----------------+----------------+
-   | Hardware       | 2              | variable       | An ascii       |
-   |                |                |                | string         |
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 8]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   |                |                |                | containing the |
-   |                |                |                | description of |
-   |                |                |                | the hardware   |
-   |                |                |                | used to create |
-   |                |                |                | this section.  |
-   |                |                |                |                |
-   | Operating      | 3              | variable       | An ascii       |
-   | System         |                |                | string         |
-   |                |                |                | containing the |
-   |                |                |                | name of the    |
-   |                |                |                | operating      |
-   |                |                |                | system used to |
-   |                |                |                | create this    |
-   |                |                |                | section.       |
-   |                |                |                |                |
-   | User           | 3              | variable       | An ascii       |
-   | Application    |                |                | string         |
-   |                |                |                | containing the |
-   |                |                |                | name of the    |
-   |                |                |                | application    |
-   |                |                |                | used to create |
-   |                |                |                | this section.  |
-   +----------------+----------------+----------------+----------------+
-
-                                Table 1
-
-   The Section Header Block does not contain data but it rather
-   identifies a list of blocks (interfaces, packets) that are logically
-   correlated. This block does not contain any reference to the size of
-   the section it is currently delimiting, therefore the reader cannot
-   skip a whole section at once. In case a section must be skipped, the
-   user has to repeatedly skip all the blocks contained within it; this
-   makes the parsing of the file slower but it permits to append several
-   capture dumps at the same file.
-
-3.2 Interface Description Block (mandatory)
-
-   The Interface Description Block is mandatory. This block is needed to
-   specify the characteristics of the network interface on which the
-   capture has been made. In order to properly associate the captured
-   data to the corresponding interface, the Interface Description Block
-   must be defined before any other block that uses it; therefore, this
-   block is usually placed immediately after the Section Header Block.
-
-   An Interface Description Block is valid only inside the section which
-   it belongs to. The structure of a Interface Description Block is
-   shown in Figure 4.
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                 [Page 9]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |          Interface ID         |           LinkType            |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                            SnapLen                            |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      /                                                               /
-      /                      Options (variable)                       /
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-             Figure 4: Interface Description Block format.
-
-   The meaning of the fields is:
-
-   o  Interface ID: a progressive number that identifies uniquely any
-      interface inside current section. Two Interface Description Blocks
-      can have the same Interface ID only if they are in different
-      sections of the file. The Interface ID is referenced by the packet
-      blocks.
-
-   o  LinkType: a value that defines the link layer type of this
-      interface.
-
-   o  SnapLen: maximum number of bytes dumped from each packet. The
-      portion of each packet that exceeds this value will not be stored
-      in the file.
-
-   o  Options: optionally, a list of options (formatted according to the
-      rules defined in Section 4) can be present.
-
-   In addition to the options defined in Section 4, the following
-   options are valid within this block:
-
-   +----------------+----------------+----------------+----------------+
-   | Name           | Code           | Length         | Description    |
-   +----------------+----------------+----------------+----------------+
-   | if_name        | 2              | Variable       | Name of the    |
-   |                |                |                | device used to |
-   |                |                |                | capture data.  |
-   |                |                |                |                |
-   | if_IPv4addr    | 3              | 8              | Interface      |
-   |                |                |                | network        |
-   |                |                |                | address and    |
-   |                |                |                | netmask.       |
-   |                |                |                |                |
-   | if_IPv6addr    | 4              | 17             | Interface      |
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 10]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   |                |                |                | network        |
-   |                |                |                | address and    |
-   |                |                |                | prefix length  |
-   |                |                |                | (stored in the |
-   |                |                |                | last byte).    |
-   |                |                |                |                |
-   | if_MACaddr     | 5              | 6              | Interface      |
-   |                |                |                | Hardware MAC   |
-   |                |                |                | address (48    |
-   |                |                |                | bits).         |
-   |                |                |                |                |
-   | if_EUIaddr     | 6              | 8              | Interface      |
-   |                |                |                | Hardware EUI   |
-   |                |                |                | address (64    |
-   |                |                |                | bits), if      |
-   |                |                |                | available.     |
-   |                |                |                |                |
-   | if_speed       | 7              | 8              | Interface      |
-   |                |                |                | speed (in      |
-   |                |                |                | bps).          |
-   |                |                |                |                |
-   | if_tsaccur     | 8              | 1              | Precision of   |
-   |                |                |                | timestamps. If |
-   |                |                |                | the Most       |
-   |                |                |                | Significant    |
-   |                |                |                | Bit is equal   |
-   |                |                |                | to zero, the   |
-   |                |                |                | remaining bits |
-   |                |                |                | indicates the  |
-   |                |                |                | accuracy as as |
-   |                |                |                | a negative     |
-   |                |                |                | power of 10    |
-   |                |                |                | (e.g. 6 means  |
-   |                |                |                | microsecond    |
-   |                |                |                | accuracy). If  |
-   |                |                |                | the Most       |
-   |                |                |                | Significant    |
-   |                |                |                | Bit is equal   |
-   |                |                |                | to zero, the   |
-   |                |                |                | remaining bits |
-   |                |                |                | indicates the  |
-   |                |                |                | accuracy as as |
-   |                |                |                | negative power |
-   |                |                |                | of 2 (e.g. 10  |
-   |                |                |                | means 1/1024   |
-   |                |                |                | of second). If |
-   |                |                |                | this option is |
-   |                |                |                | not present, a |
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 11]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   |                |                |                | precision of   |
-   |                |                |                | 10^-6 is       |
-   |                |                |                | assumed.       |
-   |                |                |                |                |
-   | if_tzone       | 9              | 4              | Time zone for  |
-   |                |                |                | GMT support    |
-   |                |                |                | (TODO: specify |
-   |                |                |                | better).       |
-   |                |                |                |                |
-   | if_flags       | 10             | 4              | Interface      |
-   |                |                |                | flags. (TODO:  |
-   |                |                |                | specify        |
-   |                |                |                | better.        |
-   |                |                |                | Possible       |
-   |                |                |                | flags:         |
-   |                |                |                | promiscuous,   |
-   |                |                |                | inbound/outbou |
-   |                |                |                | nd, traffic    |
-   |                |                |                | filtered       |
-   |                |                |                | during         |
-   |                |                |                | capture).      |
-   |                |                |                |                |
-   | if_filter      | 11             | variable       | The filter     |
-   |                |                |                | (e.g. "capture |
-   |                |                |                | only TCP       |
-   |                |                |                | traffic") used |
-   |                |                |                | to capture     |
-   |                |                |                | traffic. The   |
-   |                |                |                | first byte of  |
-   |                |                |                | the Option     |
-   |                |                |                | Data keeps a   |
-   |                |                |                | code of the    |
-   |                |                |                | filter used    |
-   |                |                |                | (e.g. if this  |
-   |                |                |                | is a libpcap   |
-   |                |                |                | string, or BPF |
-   |                |                |                | bytecode, and  |
-   |                |                |                | more). More    |
-   |                |                |                | details about  |
-   |                |                |                | this format    |
-   |                |                |                | will be        |
-   |                |                |                | presented in   |
-   |                |                |                | Appendix XXX   |
-   |                |                |                | (TODO).        |
-   |                |                |                |                |
-   | if_opersystem  | 12             | variable       | An ascii       |
-   |                |                |                | string         |
-   |                |                |                | containing the |
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 12]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   |                |                |                | name of the    |
-   |                |                |                | operating      |
-   |                |                |                | system of the  |
-   |                |                |                | machine that   |
-   |                |                |                | hosts this     |
-   |                |                |                | interface.     |
-   |                |                |                | This can be    |
-   |                |                |                | different from |
-   |                |                |                | the same       |
-   |                |                |                | information    |
-   |                |                |                | that can be    |
-   |                |                |                | contained by   |
-   |                |                |                | the Section    |
-   |                |                |                | Header Block   |
-   |                |                |                | (Section 3.1)  |
-   |                |                |                | because the    |
-   |                |                |                | capture can    |
-   |                |                |                | have been done |
-   |                |                |                | on a remote    |
-   |                |                |                | machine.       |
-   +----------------+----------------+----------------+----------------+
-
-                                Table 2
-
-
-3.3 Packet Block (optional)
-
-   A Packet Block is the standard container for storing the packets
-   coming from the network. The Packet Block is optional because packets
-   can be stored either by means of this block or the Simple Packet
-   Block, which can be used to speed up dump generation. The format of a
-   packet block is shown in Figure 5.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 13]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |         Interface ID          |          Drops Count          |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                        Timestamp (High)                       |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                        Timestamp (Low)                        |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                         Captured Len                          |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                          Packet Len                           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                                                               |
-      |                          Packet Data                          |
-      |                                                               |
-      |              /* variable length, byte-aligned */              |
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      /                                                               /
-      /                      Options (variable)                       /
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                     Figure 5: Packet Block format.
-
-   The Packet Block has the following fields:
-
-   o  Interface ID: Specifies the interface this packet comes from, and
-      corresponds to the ID of one of the Interface Description Blocks
-      present in this section of the file (see Figure 4).
-
-   o  Drops Count: a local drop counter. It specified the number of
-      packets lost (by the interface and the operating system) between
-      this packet and the preceding one. The value xFFFF (in
-      hexadecimal) is reserved for those systems in which this
-      information is not available.
-
-   o  Timestamp (High): the most significative part of the timestamp. in
-      standard Unix format, i.e. from 1/1/1970.
-
-   o  Timestamp (Low): the less significative part of the timestamp. The
-      way to interpret this field is specified by the 'ts_accur' option
-      (see Figure 4) of the Interface Description block referenced by
-      this packet. If the Interface Description block does not contain a
-      'ts_accur' option, then this field is expressed in microseconds.
-
-   o  Captured Len: number of bytes captured from the packet (i.e. the
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 14]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-      length of the Packet Data field). It will be the minimum value
-      among the actual Packet Length and the snapshot length (defined in
-      Figure 4).
-
-   o  Packet Len: actual length of the packet when it was transmitted on
-      the network. Can be different from Captured Len if the user wants
-      only a snapshot of the packet.
-
-   o  Packet Data: the data coming from the network, including
-      link-layer headers. The length of this field is Captured Len. The
-      format of the link-layer headers depends on the LinkType field
-      specified in the Interface Description Block (see Section 3.2) and
-      it is specified in Appendix XXX (TODO).
-
-   o  Options: optionally, a list of options (formatted according to the
-      rules defined in Section 4) can be present.
-
-
-3.4 Simple Packet Block (optional)
-
-   The Simple Packet Block is a lightweight container for storing the
-   packets coming from the network. Its presence is optional.
-
-   A Simple Packet Block is similar to a Packet Block (see Section 3.3),
-   but it is smaller, simpler to process and contains only a minimal set
-   of information. This block is preferred to the standard Packet Block
-   when performance or space occupation are critical factors, such as in
-   sustained traffic dump applications. A capture file can contain both
-   Packet Blocks and Simple Packet Blocks: for example, a capture tool
-   could switch from Packet Blocks to Simple Packet Blocks when the
-   hardware resources become critical.
-
-   The Simple Packet Block does not contain the Interface ID field.
-   Therefore, it must be assumed that all the Simple Packet Blocks have
-   been captured on the interface previously specified in the Interface
-   Description Block.
-
-   Figure 6 shows the format of the Simple Packet Block.
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 15]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                          Packet Len                           |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                                                               |
-      |                          Packet Data                          |
-      |                                                               |
-      |              /* variable length, byte-aligned */              |
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                 Figure 6: Simple Packet Block format.
-
-   The Packet Block has the following fields:
-
-   o  Packet Len: actual length of the packet when it was transmitted on
-      the network. Can be different from captured len if the packet has
-      been truncated.
-
-   o  Packet data: the data coming from the network, including
-      link-layers headers. The length of this field can be derived from
-      the field Block Total Length, present in the Block Header.
-
-   The Simple Packet Block does not contain the timestamp because this
-   is one of the most costly operations on PCs. Additionally, there are
-   applications that do not require it; e.g. an Intrusion Detection
-   System is interested in packets, not in their timestamp.
-
-   The Simple Packet Block is very efficient in term of disk space: a
-   snapshot of length 100 bytes requires only 16 bytes of overhead,
-   which corresponds to an efficiency of more than 86%.
-
-3.5 Name Resolution Block (optional)
-
-   The Name Resolution Block is used to support the correlation of
-   numeric addresses (present in the captured packets) and their
-   corresponding canonical names and it is optional. Having the literal
-   names saved in the file, this prevents the need of a name resolution
-   in a delayed time, when the association between names and addresses
-   can be different from the one in use at capture time. Moreover, The
-   Name Resolution Block avoids the need of issuing a lot of DNS
-   requests every time the trace capture is opened, and allows to have
-   name resolution also when reading the capture with a machine not
-   connected to the network.
-
-   The format of the Name Resolution Block is shown in Figure 7.
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 16]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |      Record Type              |         Record Length         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                       Record Value                            |
-      |              /* variable length, byte-aligned */              |
-      |               + + + + + + + + + + + + + + + + + + + + + + + + +
-      |               |               |               |               |
-      +-+-+-+-+-+-+-+-+ + + + + + + + + + + + + + + + + + + + + + + + +
-                . . . other records . . .
-      |  Record Type == end_of_recs   |  Record Length == 00          |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      /                                                               /
-      /                      Options (variable)                       /
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                Figure 7: Name Resolution Block format.
-
-   A Name Resolution Block is a zero-terminated list of records (in the
-   TLV format), each of which contains an association between a network
-   address and a name. There are three possible types of records:
-
-   +----------------+----------------+----------------+----------------+
-   | Name           | Code           | Length         | Description    |
-   +----------------+----------------+----------------+----------------+
-   | end_of_recs    | 0              | 0              | End of records |
-   |                |                |                |                |
-   | ip4_rec        | 1              | Variable       | Specifies an   |
-   |                |                |                | IPv4 address   |
-   |                |                |                | (contained in  |
-   |                |                |                | the first 4    |
-   |                |                |                | bytes),        |
-   |                |                |                | followed by    |
-   |                |                |                | one or more    |
-   |                |                |                | zero-terminate |
-   |                |                |                | d strings      |
-   |                |                |                | containing the |
-   |                |                |                | DNS entries    |
-   |                |                |                | for that       |
-   |                |                |                | address.       |
-   |                |                |                |                |
-   | ip6_rec        | 1              | Variable       | Specifies an   |
-   |                |                |                | IPv6 address   |
-   |                |                |                | (contained in  |
-   |                |                |                | the first 16   |
-   |                |                |                | bytes),        |
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 17]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   |                |                |                | followed by    |
-   |                |                |                | one or more    |
-   |                |                |                | zero-terminate |
-   |                |                |                | d strings      |
-   |                |                |                | containing the |
-   |                |                |                | DNS entries    |
-   |                |                |                | for that       |
-   |                |                |                | address.       |
-   +----------------+----------------+----------------+----------------+
-
-                                Table 3
-
-   After the list or Name Resolution Records, optionally, a list of
-   options (formatted according to the rules defined in Section 4) can
-   be present.
-
-   A Name Resolution Block is normally placed at the beginning of the
-   file, but no assumptions can be taken about its position. Name
-   Resolution Blocks can be added in a second time by tools that process
-   the file, like network analyzers.
-
-   In addiction to the options defined in Section 4, the following
-   options are valid within this block:
-
-   +----------------+----------------+----------------+----------------+
-   | Name           | Code           | Length         | Description    |
-   +----------------+----------------+----------------+----------------+
-   | ns_dnsname     | 2              | Variable       | An ascii       |
-   |                |                |                | string         |
-   |                |                |                | containing the |
-   |                |                |                | name of the    |
-   |                |                |                | machine (DNS   |
-   |                |                |                | server) used   |
-   |                |                |                | to perform the |
-   |                |                |                | name           |
-   |                |                |                | resolution.    |
-   +----------------+----------------+----------------+----------------+
-
-
-3.6 Interface Statistics Block (optional)
-
-   The Interface Statistics Block contains the capture statistics for a
-   given interface and it is optional. The statistics are referred to
-   the interface defined in the current Section identified by the
-   Interface ID field.
-
-   The format of the Interface Statistics Block is shown in Figure 8.
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 18]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                         IfRecv                                |
-      |                          (high + low)                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                         IfDrop                                |
-      |                          (high + low)                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                         FilterAccept                          |
-      |                          (high + low)                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                         OSDrop                                |
-      |                          (high + low)                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                         UsrDelivered                          |
-      |                          (high + low)                         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |          Interface ID         |           Reserved            |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      /                                                               /
-      /                      Options (variable)                       /
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-              Figure 8: Interface Statistics Block format.
-
-   The fields have the following meaning:
-
-   o  IfRecv: number of packets received from the interface during the
-      capture. This number is reported as a 64 bits value, in which the
-      most significat bits are located in the first four bytes of the
-      field.
-
-   o  IfDrop: number of packets dropped by the interface during the
-      capture due to lack of resources.
-
-   o  FilterAccept: number of packets accepeted by filter during current
-      capture.
-
-   o  OSDrop: number of packets dropped by the operating system during
-      the capture.
-
-   o  UsrDelivered: number of packets delivered to the user.
-      UsrDelivered can be different from the value 'FilterAccept -
-      OSDropped' because some packets could still lay in the OS buffers
-      when the capture ended.
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 19]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   o  Interface ID: reference to an Interface Description Block.
-
-   o  Reserved: Reserved to future use.
-
-   o  Options: optionally, a list of options (formatted according to the
-      rules defined in Section 4) can be present.
-
-   In addiction to the options defined in Section 4, the following
-   options are valid within this block:
-
-   +----------------+----------------+----------------+----------------+
-   | Name           | Code           | Length         | Description    |
-   +----------------+----------------+----------------+----------------+
-   | isb_starttime  | 2              | 8              | Time in which  |
-   |                |                |                | the capture    |
-   |                |                |                | started; time  |
-   |                |                |                | will be stored |
-   |                |                |                | in two blocks  |
-   |                |                |                | of four bytes  |
-   |                |                |                | each,          |
-   |                |                |                | containing the |
-   |                |                |                | timestamp in   |
-   |                |                |                | seconds and    |
-   |                |                |                | nanoseconds.   |
-   |                |                |                |                |
-   | isb_endtime    | 3              | 8              | Time in which  |
-   |                |                |                | the capture    |
-   |                |                |                | started; time  |
-   |                |                |                | will be stored |
-   |                |                |                | in two blocks  |
-   |                |                |                | of four bytes  |
-   |                |                |                | each,          |
-   |                |                |                | containing the |
-   |                |                |                | timestamp in   |
-   |                |                |                | seconds and    |
-   |                |                |                | nanoseconds.   |
-   +----------------+----------------+----------------+----------------+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 20]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-4. Options
-
-   Almost all blocks have the possibility to embed optional fields.
-   Optional fields can be used to insert some information that may be
-   useful when reading data, but that it is not really needed for packet
-   processing. Therefore, each tool can be either read the content of
-   the optional fields (if any), or skip them at once.
-
-   Skipping all the optional fields at once is straightforward because
-   most of the blocks have a fixed length, therefore the field Block
-   Length (present in the General Block Structure, see  Section 2.1) can
-   be used to skip everything till the next block.
-
-   Options are a list of Type - Length - Value fields, each one
-   containing a single value:
-
-   o  Option Type (2 bytes): it contains the code that specifies the
-      type of the current TLV record. Option types whose Most
-      Significant Bit is equal to one are reserved for local use;
-      therefore, there is no guarantee that the code used is unique
-      among all capture files (generated by other applications). In case
-      of vendor-specific extensions that have to be identified uniquely,
-      vendors must request an Option Code whose MSB is equal to zero.
-
-   o  Option Length (2 bytes): it contains the length of the following
-      'Option Value' field.
-
-   o  Option Value (variable length): it contains the value of the given
-      option. The length of this field as been specified by the Option
-      Length field.
-
-   Options may be repeated several times (e.g. an interface that has
-   several IP addresses associated to it). The option list is terminated
-   by a special code which is the 'End of Option'.
-
-   The format of the optional fields is shown in Figure 9.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 21]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |      Option Code              |         Option Length         |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |                       Option Value                            |
-      |              /* variable length, byte-aligned */              |
-      |               + + + + + + + + + + + + + + + + + + + + + + + + +
-      |               /               /               /               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      /                                                               /
-      /                 . . . other options . . .                     /
-      /                                                               /
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |   Option Code == opt_endofopt  |  Option Length == 0          |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                       Figure 9: Options format.
-
-   The following codes can always be present in any optional field:
-
-   +----------------+----------------+----------------+----------------+
-   | Name           | Code           | Length         | Description    |
-   +----------------+----------------+----------------+----------------+
-   | opt_endofopt   | 0              | 0              | End of         |
-   |                |                |                | options: it is |
-   |                |                |                | used to        |
-   |                |                |                | delimit the    |
-   |                |                |                | end of the     |
-   |                |                |                | optional       |
-   |                |                |                | fields. This   |
-   |                |                |                | block cannot   |
-   |                |                |                | be repeated    |
-   |                |                |                | within a given |
-   |                |                |                | list of        |
-   |                |                |                | options.       |
-   |                |                |                |                |
-   | opt_comment    | 1              | variable       | Comment: it is |
-   |                |                |                | an ascii       |
-   |                |                |                | string         |
-   |                |                |                | containing a   |
-   |                |                |                | comment that   |
-   |                |                |                | is associated  |
-   |                |                |                | to the current |
-   |                |                |                | block.         |
-   +----------------+----------------+----------------+----------------+
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 22]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-5. Experimental Blocks (deserved to a further investigation)
-
-5.1 Other Packet Blocks (experimental)
-
-   Can some other packet blocks (besides the two described in the
-   previous paragraphs) be useful?
-
-5.2 Compression Block (experimental)
-
-   The Compression Block is optional. A file can contain an arbitrary
-   number of these blocks. A Compression Block, as the name says, is
-   used to store compressed data. Its format is shown in Figure 10.
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |  Compr. Type  |                                               |
-      +-+-+-+-+-+-+-+-+                                               |
-      |                                                               |
-      |                       Compressed Data                         |
-      |                                                               |
-      |              /* variable length, byte-aligned */              |
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                  Figure 10: Compression Block format.
-
-   The fields have the following meaning:
-
-   o  Compression Type: specifies the compression algorithm. Possible
-      values for this field are 0 (uncompressed), 1 (Lempel Ziv), 2
-      (Gzip), other?? Probably some kind of dumb and fast compression
-      algorithm could be effective with some types of traffic (for
-      example web), but which?
-
-   o  Compressed Data: data of this block. Once decompressed, it is made
-      of other blocks.
-
-
-5.3 Encryption Block (experimental)
-
-   The Encryption Block is optional. A file can contain an arbitrary
-   number of these blocks. An Encryption Block is used to sotre
-   encrypted data. Its format is shown in Figure 11.
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 23]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |   Encr. Type  |                                               |
-      +-+-+-+-+-+-+-+-+                                               |
-      |                                                               |
-      |                       Compressed Data                         |
-      |                                                               |
-      |              /* variable length, byte-aligned */              |
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                  Figure 11: Encryption Block format.
-
-   The fields have the following meaning:
-
-   o  Compression Type: specifies the encryption algorithm. Possible
-      values for this field are ??? NOTE: this block should probably
-      contain other fields, depending on the encryption algorithm. To be
-      define precisely.
-
-   o  Encrypted Data: data of this block. Once decripted, it consists of
-      other blocks.
-
-
-5.4 Fixed Length Block (experimental)
-
-   The Fixed Length Block is optional. A file can contain an arbitrary
-   number of these blocks. A Fixed Length Block can be used to optimize
-   the access to the file. Its format is shown in Figure 12. A Fixed
-   Length Block stores records with constant size. It contains a set of
-   Blocks (normally Packet Blocks or Simple Packet Blocks), of wihich it
-   specifies the size. Knowing this size a priori helps to scan the file
-   and to load some portions of it without truncating a block, and is
-   particularly useful with cell-based networks like ATM.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 24]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-       0                   1                   2                   3
-       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-      |          Cell Size            |                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
-      |                                                               |
-      |                        Fixed Size Data                        |
-      |                                                               |
-      |              /* variable length, byte-aligned */              |
-      |                                                               |
-      |                                                               |
-      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-                 Figure 12: Fixed Length Block format.
-
-   The fields have the following meaning:
-
-   o  Cell size: the size of the blocks contained in the data field.
-
-   o  Fixed Size Data: data of this block.
-
-
-5.5 Directory Block (experimental)
-
-   If present, this block contains the following information:
-
-   o  number of indexed packets (N)
-
-   o  table with position and length of any indexed packet (N entries)
-
-   A directory block must be followed by at least N packets, otherwise
-   it must be considered invalid. It can be used to efficiently load
-   portions of the file to memory and to support operations on memory
-   mapped files. This block can be added by tools like network analyzers
-   as a consequence of file processing.
-
-5.6 Traffic Statistics and Monitoring Blocks (experimental)
-
-   One or more blocks could be defined to contain network statistics or
-   traffic monitoring information. They could be use to store data
-   collected from RMON or Netflow probes, or from other network
-   monitoring tools.
-
-5.7 Event/Security Block (experimental)
-
-   This block could be used to store events. Events could contain
-   generic information (for example network load over 50%, server
-   down...) or security alerts. An event could be:
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 25]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   o  skipped, if the application doesn't know how to do with it
-
-   o  processed independently by the packets. In other words, the
-      applications skips the packets and processes only the alerts
-
-   o  processed in relation to packets: for example, a security tool
-      could load only the packets of the file that are near a security
-      alert; a monitorg tool could skip the packets captured while the
-      server was down.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 26]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-6. Conclusions
-
-   The file format proposed in this document should be very versatile
-   and satisfy a wide range of applications. In the simplest case, it
-   can contain a raw dump of the network data, made of a series of
-   Simple Packet Blocks. In the most complex case, it can be used as a
-   repository for heterogeneous information. In every case, the file
-   remains easy to parse and an application can always skip the data it
-   is not interested in; at the same time, different applications can
-   share the file, and each of them can benfit of the information
-   produced by the others. Two or more files can be concatenated
-   obtaining another valid file.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 27]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-7. Most important open issues
-
-   o  Data, in the file, must be byte or word aligned? Currently, the
-      structure of this document is not consistent with respect to this
-      point.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 28]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-Intellectual Property Statement
-
-   The IETF takes no position regarding the validity or scope of any
-   intellectual property or other rights that might be claimed to
-   pertain to the implementation or use of the technology described in
-   this document or the extent to which any license under such rights
-   might or might not be available; neither does it represent that it
-   has made any effort to identify any such rights. Information on the
-   IETF's procedures with respect to rights in standards-track and
-   standards-related documentation can be found in BCP-11. Copies of
-   claims of rights made available for publication and any assurances of
-   licenses to be made available, or the result of an attempt made to
-   obtain a general license or permission for the use of such
-   proprietary rights by implementors or users of this specification can
-   be obtained from the IETF Secretariat.
-
-   The IETF invites any interested party to bring to its attention any
-   copyrights, patents or patent applications, or other proprietary
-   rights which may cover technology that may be required to practice
-   this standard. Please address the information to the IETF Executive
-   Director.
-
-
-Full Copyright Statement
-
-   Copyright (C) The Internet Society (2004). All Rights Reserved.
-
-   This document and translations of it may be copied and furnished to
-   others, and derivative works that comment on or otherwise explain it
-   or assist in its implementation may be prepared, copied, published
-   and distributed, in whole or in part, without restriction of any
-   kind, provided that the above copyright notice and this paragraph are
-   included on all such copies and derivative works. However, this
-   document itself may not be modified in any way, such as by removing
-   the copyright notice or references to the Internet Society or other
-   Internet organizations, except as needed for the purpose of
-   developing Internet standards in which case the procedures for
-   copyrights defined in the Internet Standards process must be
-   followed, or as required to translate it into languages other than
-   English.
-
-   The limited permissions granted above are perpetual and will not be
-   revoked by the Internet Society or its successors or assignees.
-
-   This document and the information contained herein is provided on an
-   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
-   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
-   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 29]
-
-Internet-Draft    PCAP New Generation Dump File Format        March 2004
-
-
-   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
-
-
-Acknowledgment
-
-   Funding for the RFC Editor function is currently provided by the
-   Internet Society.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Degioanni & Risso       Expires August 30, 2004                [Page 30]
-
diff --git a/contrib/libpcap/doc/pcap.xml b/contrib/libpcap/doc/pcap.xml
deleted file mode 100644
index ebbf321..0000000
--- a/contrib/libpcap/doc/pcap.xml
+++ /dev/null
@@ -1,746 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>
-
-<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
-<?rfc toc="yes"?>
-<rfc ipr="full2026" docname="draft-libpcap-dump-format-00.txt">
-   <front>
-       <title>PCAP New Generation Dump File Format</title>
-       <author initials="L." surname="Degioanni" fullname="Loris Degioanni">
-         <organization>Politecnico di Torino</organization>
-         <address>
-            <postal>
-               <street>Corso Duca degli Abruzzi, 24</street>
-               <city>Torino</city>
-               <code>10129</code>
-               <country>Italy</country>
-            </postal>
-            <phone>+39 011 564 7008</phone>
-            <email>loris.degioanni@polito.it</email>
-            <uri>http://netgroup.polito.it/loris/</uri>
-         </address>
-      </author>
-       <author initials="F." surname="Risso" fullname="Fulvio Risso">
-         <organization>Politecnico di Torino</organization>
-         <address>
-            <postal>
-               <street>Corso Duca degli Abruzzi, 24</street>
-               <city>Torino</city>
-               <code>10129</code>
-               <country>Italy</country>
-            </postal>
-            <phone>+39 011 564 7008</phone>
-            <email>fulvio.risso@polito.it</email>
-            <uri>http://netgroup.polito.it/fulvio.risso/</uri>
-         </address>
-      </author>
-
-   <!-- Other authors go here -->
-
-      <date month="March" year="2004"/>
-      <area>General</area>
-<!--
-       <workgroup>
--->
-      <keyword>Internet-Draft</keyword>
-      <keyword>Libpcap, dump file format</keyword>
-         <abstract>
-<t>This document describes a format to dump captured packets on a file. This format is extensible and it is currently proposed for implementation in the libpcap/WinPcap packet capture library.</t>
-         </abstract>
-<!--
-      <note ...>
--->
-   </front>
-   <middle>
-
-<section title="Objectives">
-<t>The problem of exchanging packet traces becomes more and more critical every day; unfortunately, no standard solutions exist for this task right now. One of the most accepted packet interchange formats is the one defined by libpcap, which is rather old and does not fit for some of the nowadays applications especially in terms of extensibility.</t>
-<t>This document proposes a new format for dumping packet traces. The following goals are being pursued:</t>
-<list style="symbols">
-<t>Extensibility: aside of some common functionalities, third parties should be able to enrich the information embedded in the file with proprietary extensions, which will be ignored by tools that are not able to understand them.</t>
-<t>Portability: a capture trace must contain all the information needed to read data independently from network, hardware and operating system of the machine that made the capture.</t>
-<t>Merge/Append data: it should be possible to add data at the end of a given file, and the resulting file must still be readable.</t>
-</list>
-
-</section>
-
-
-<section title="General File Structure">
-
-<section anchor="sectionblock" title="General Block Structure">
-<t>A capture file is organized in blocks, that are appended one to another to form the file. All the blocks share a common format, which is shown in <xref target="formatblock"/>.</t>
-
-<figure anchor="formatblock" title="Basic block structure.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                          Block Type                           |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                      Block Total Length                       |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                          Block Body                           /
-   /          /* variable length, aligned to 32 bits */            /
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                      Block Total Length                       |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-</artwork>
-</figure>
-
-<t>The fields have the following meaning:</t>
-
-<list style="symbols">
-<t>Block Type (32 bits): unique value that identifies the block. Values whose Most Significant Bit (MSB) is equal to 1 are reserved for local use. They allow to save private data to the file and to extend the file format.</t>
-<t>Block Total Length: total size of this block, in bytes. For instance, a block that does not have a body has a length of 12 bytes.</t>
-<t>Block Body: content of the block.</t>
-<t>Block Total Length: total size of this block, in bytes. This field is duplicated for permitting backward file navigation.</t>
-</list>
-
-<t>This structure, shared among all blocks, makes easy to process a file and to skip unneeded or unknown blocks. Blocks can be nested one inside the others (NOTE: needed?). Some of the blocks are mandatory, i.e. a dump file is not valid if they are not present, other are optional.</t>
-<t>The structure of the blocks allows to define other blocks if needed. A parser that does non understand them can simply ignore their content.</t>
-</section>
-
-<section title="Block Types">
-<t>The currently defined blocks are the following:</t>
-<list style="numbers">
-<t>Section Header Block: it defines the most important characteristics of the capture file.</t>
-<t>Interface Description Block: it defines the most important characteristics of the interface(s) used for capturing traffic.</t>
-<t>Packet Block: it contains a single captured packet, or a portion of it.</t>
-<t>Simple Packet Block: it contains a single captured packet, or a portion of it, with only a minimal set of information about it.</t>
-<t>Name Resolution Block: it defines the mapping from numeric addresses present in the packet dump and the canonical name counterpart.</t>
-<t>Capture Statistics Block: it defines how to store some statistical data (e.g. packet dropped, etc) which can be useful to undestand the conditions in which the capture has been made.</t>
-<t>Compression Marker Block: TODO</t>
-<t>Encryption Marker Block: TODO</t>
-<t>Fixed Length Marker Block: TODO</t>
-</list>
-
-<t>The following blocks instead are considered interesting but the authors believe that they deserve more in-depth discussion before being defined:</t>
-<list style="numbers">
-<t>Further Packet Blocks</t>
-<t>Directory Block</t>
-<t>Traffic Statistics and Monitoring Blocks</t>
-<t>Alert and Security Blocks</t>
-</list>
-
-<t>TODO Currently standardized Block Type codes are specified in Appendix 1.</t>
-
-</section>
-
-<section title="Block Hierarchy and Precedence">
-<t>The file must begin with a Section Header Block. However, more than one Section Header Block can be present on the dump, each one covering the data following it till the next one (or the end of file). A Section includes the data delimited by two Section Header Blocks (or by a Section Header Block and the end of the file), including the first Section Header Block.</t>
-<t>In case an application cannot read a Section because of different version number, it must skip everything until the next Section Header Block. Note that, in order to properly skip the blocks until the next section, all blocks must have the fields Type and Length at the beginning. This is a mandatory requirement that must be maintained in future versions of the block format.</t>
-<t><xref target="fssample-SHB"/> shows two valid files: the first has a typical configuration, with a single Section Header that covers the whole file. The second one contains three headers, and is normally the result of file concatenation. An application that understands only version 1.0 of the file format skips the intermediate section and restart processing the packets after the third Section Header.</t>
-
-<figure anchor="fssample-SHB" title="File structure example: the Section Header Block.">
-<artwork>
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   | SHB v1.0  |                      Data                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   Typical configuration with a single Section Header Block 
-
-
-   |--   1st Section   --|--   2nd Section   --|--  3rd Section  --|
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   | SHB v1.0  |  Data   | SHB V1.1  |  Data   | SHB V1.0  |  Data |  
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   Configuration with three different Section Header Blocks
-</artwork>
-</figure>
-
-<t>NOTE: TO BE COMPLETED with some examples of other blocks</t>
-
-</section>
-
-<section title="Data format">
-<t>Data contained in each section will always be saved according to the characteristics (little endian / big endian) of the dumping machine. This refers to all fields that are saved as numbers and that span over two or more bytes.</t>
-<t>The approach of having each section saved in the native format of the generating host is more efficient because it avoids translation of data when reading / writing on the host itself, which is the most common case when generating/processing capture dumps.</t>
-<t>TODO Probably we have to specify something more here. Is what we're saying enough to avoid any kind of ambiguity?.</t>
-</section>
-
-</section>
-
-
-
-
-<section title="Block Definition">
-<t>This section details the format of the body of the blocks currently defined.</t>
-
-<section anchor="sectionshb" title="Section Header Block (mandatory)">
-<t>The Section Header Block is mandatory. It identifies the beginning of a section of the capture dump file. Its format is shown in <xref target="formatSHB"/>.</t>
-<figure anchor="formatSHB" title="Section Header Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                            Magic                              |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |              Major            |             Minor             |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-</artwork>
-</figure>
-
-<t>The meaning of the fields is:</t>
-<list style="symbols">
-<t>Magic: magic number, whose value is the hexadecimal number 0x1A2B3C4D. This number can be used to distinguish section that have been saved on little-endian machines from the one saved on big-endian machines.</t>
-<t>Major: number of the current mayor version of the format. Current value is 1.</t>
-<t>Minor: number of the current minor version of the format. Current value is 0.</t>
-<t>Options: optionally, a list of options (formatted according to the rules defined in <xref target="sectionopt"/>) can be present.</t>
-</list>
-
-<t>Aside form the options defined in <xref target="sectionopt"/>, the following options are valid within this block:</t>
-
-<texttable anchor="InterfaceOptions1">
-  <ttcol>Name</ttcol>
-  <ttcol>Code</ttcol>
-  <ttcol>Length</ttcol>
-  <ttcol>Description</ttcol>
-
-  <c>Hardware</c>
-  <c>2</c>
-  <c>variable</c>
-  <c>An ascii string containing the description of the hardware used to create this section.</c>
-
-  <c>Operating System</c>
-  <c>3</c>
-  <c>variable</c>
-  <c>An ascii string containing the name of the operating system used to create this section.</c>
-
-  <c>User Application</c>
-  <c>3</c>
-  <c>variable</c>
-  <c>An ascii string containing the name of the application used to create this section.</c>
-</texttable>
-
-
-<t>The Section Header Block does not contain data but it rather identifies a list of blocks (interfaces, packets) that are logically correlated. This block does not contain any reference to the size of the section it is currently delimiting, therefore the reader cannot skip a whole section at once. In case a section must be skipped, the user has to repeatedly skip all the blocks contained within it; this makes the parsing of the file slower but it permits to append several capture dumps at the same file.</t>
-</section>
-
-<section anchor="sectionidb" title="Interface Description Block (mandatory)">
-<t>The Interface Description Block is mandatory. This block is needed to specify the characteristics of the network interface on which the capture has been made. In order to properly associate the captured data to the corresponding interface, the Interface Description Block must be defined before any other block that uses it; therefore, this block is usually placed immediately after the Section Header Block.</t>
-
-<t>An Interface Description Block is valid only inside the section which it belongs to. The structure of a Interface Description Block is shown in <xref target="formatidb"/>.</t>
-
-<figure anchor="formatidb" title="Interface Description Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |          Interface ID         |           LinkType            |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                            SnapLen                            |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>The meaning of the fields is:</t>
-<list style="symbols">
-<t>Interface ID: a progressive number that identifies uniquely any interface inside current section. Two Interface Description Blocks can have the same Interface ID only if they are in different sections of the file. The Interface ID is referenced by the packet blocks.</t>
-<t>LinkType: a value that defines the link layer type of this interface.</t>
-<t>SnapLen: maximum number of bytes dumped from each packet. The portion of each packet that exceeds this value will not be stored in the file.</t>
-<t>Options: optionally, a list of options (formatted according to the rules defined in <xref target="sectionopt"/>) can be present.</t>
-</list>
-
-<t>In addition to the options defined in <xref target="sectionopt"/>, the following options are valid within this block:</t>
-
-<texttable anchor="InterfaceOptions2">
-  <ttcol>Name</ttcol>
-  <ttcol>Code</ttcol>
-  <ttcol>Length</ttcol>
-  <ttcol>Description</ttcol>
-
-  <c>if_name</c>
-  <c>2</c>
-  <c>Variable</c>
-  <c>Name of the device used to capture data.</c>
-
-  <c>if_IPv4addr</c>
-  <c>3</c>
-  <c>8</c>
-  <c>Interface network address and netmask.</c>
-
-  <c>if_IPv6addr</c>
-  <c>4</c>
-  <c>17</c>
-  <c>Interface network address and prefix length (stored in the last byte).</c>
-
-  <c>if_MACaddr</c>
-  <c>5</c>
-  <c>6</c>
-  <c>Interface Hardware MAC address (48 bits).</c>
-
-  <c>if_EUIaddr</c>
-  <c>6</c>
-  <c>8</c>
-  <c>Interface Hardware EUI address (64 bits), if available.</c>
-
-  <c>if_speed</c>
-  <c>7</c>
-  <c>8</c>
-  <c>Interface speed (in bps).</c>
-
-  <c>if_tsaccur</c>
-  <c>8</c>
-  <c>1</c>
-  <c>Precision of timestamps. If the Most Significant Bit is equal to zero, the remaining bits indicates the accuracy as as a negative power of 10 (e.g. 6 means microsecond accuracy). If the Most Significant Bit is equal to zero, the remaining bits indicates the accuracy as as negative power of 2 (e.g. 10 means 1/1024 of second). If this option is not present, a precision of 10^-6 is assumed.</c>
-
-  <c>if_tzone</c>
-  <c>9</c>
-  <c>4</c>
-  <c>Time zone for GMT support (TODO: specify better).</c>
-  
-  <c>if_flags</c>
-  <c>10</c>
-  <c>4</c>
-  <c>Interface flags. (TODO: specify better. Possible flags: promiscuous, inbound/outbound, traffic filtered during capture).</c>
-
-  <c>if_filter</c>
-  <c>11</c>
-  <c>variable</c>
-  <c>The filter (e.g. "capture only TCP traffic") used to capture traffic. The first byte of the Option Data keeps a code of the filter used (e.g. if this is a libpcap string, or BPF bytecode, and more). More details about this format will be presented in Appendix XXX (TODO).</c>
-
-  <c>if_opersystem</c>
-  <c>12</c>
-  <c>variable</c>
-  <c>An ascii string containing the name of the operating system of the machine that hosts this interface. This can be different from the same information that can be contained by the Section Header Block (<xref target="sectionshb"/>) because the capture can have been done on a remote machine.</c>
-
-</texttable>
-
-</section>
-
-
-
-<section anchor="sectionpb" title="Packet Block (optional)">
-<t>A Packet Block is the standard container for storing the packets coming from the network. The Packet Block is optional because packets can be stored either by means of this block or the Simple Packet Block, which can be used to speed up dump generation. The format of a packet block is shown in <xref target="formatpb"/>.</t>
-
-<figure anchor="formatpb" title="Packet Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |         Interface ID          |          Drops Count          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                        Timestamp (High)                       |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                        Timestamp (Low)                        |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         Captured Len                          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                          Packet Len                           |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               |
-   |                          Packet Data                          |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-</artwork>
-</figure>
-
-<t>The Packet Block has the following fields:</t>
-
-<list style="symbols">
-<t>Interface ID: Specifies the interface this packet comes from, and corresponds to the ID of one of the Interface Description Blocks present in this section of the file (see <xref target="formatidb"/>).</t>
-<t>Drops Count: a local drop counter. It specified the number of packets lost (by the interface and the operating system) between this packet and the preceding one. The value xFFFF (in hexadecimal) is reserved for those systems in which this information is not available.</t>
-<t>Timestamp (High): the most significative part of the timestamp. in standard Unix format, i.e. from 1/1/1970.</t>
-<t>Timestamp (Low): the less significative part of the timestamp. The way to interpret this field is specified by the 'ts_accur' option (see <xref target="formatidb"/>) of the Interface Description block referenced by this packet. If the Interface Description block does not contain a 'ts_accur' option, then this field is expressed in microseconds.</t>
-<t>Captured Len: number of bytes captured from the packet (i.e. the length of the Packet Data field). It will be the minimum value among the actual Packet Length and the snapshot length (defined in <xref target="formatidb"/>).</t>
-<t>Packet Len: actual length of the packet when it was transmitted on the network. Can be different from Captured Len if the user wants only a snapshot of the packet.</t>
-<t>Packet Data: the data coming from the network, including link-layer headers. The length of this field is Captured Len. The format of the link-layer headers depends on the LinkType field specified in the Interface Description Block (see <xref target="sectionidb"/>) and it is specified in Appendix XXX (TODO).</t>
-<t>Options: optionally, a list of options (formatted according to the rules defined in <xref target="sectionopt"/>) can be present.</t>
-</list>
-
-<t></t>
-</section>
-
-
-<section title="Simple Packet Block (optional)">
-<t>The Simple Packet Block is a lightweight container for storing the packets coming from the network. Its presence is optional.</t>
-<t>A Simple Packet Block is similar to a Packet Block (see <xref target="sectionpb"/>), but it is smaller, simpler to process and contains only a minimal set of information. This block is preferred to the standard Packet Block when performance or space occupation are critical factors, such as in sustained traffic dump applications. A capture file can contain both Packet Blocks and Simple Packet Blocks: for example, a capture tool could switch from Packet Blocks to Simple Packet Blocks when the hardware resources become critical.</t>
-<t>The Simple Packet Block does not contain the Interface ID field. Therefore, it must be assumed that all the Simple Packet Blocks have been captured on the interface previously specified in the Interface Description Block.</t>
-<t><xref target="formatpbs"/> shows the format of the Simple Packet Block.</t>
-
-<figure anchor="formatpbs" title="Simple Packet Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                          Packet Len                           |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                                                               |
-   |                          Packet Data                          |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>The Packet Block has the following fields:</t>
-<list style="symbols">
-<t>Packet Len: actual length of the packet when it was transmitted on the network. Can be different from captured len if the packet has been truncated.</t>
-<t>Packet data: the data coming from the network, including link-layers headers. The length of this field can be derived from the field Block Total Length, present in the Block Header.</t>
-</list>
-
-<t>The Simple Packet Block does not contain the timestamp because this is one of the most costly operations on PCs. Additionally, there are applications that do not require it; e.g. an Intrusion Detection System is interested in packets, not in their timestamp.</t>
-
-<t>The Simple Packet Block is very efficient in term of disk space: a snapshot of length 100 bytes requires only 16 bytes of overhead, which corresponds to an efficiency of more than 86%.</t>
-
-</section>
-
-
-
-<section title="Name Resolution Block (optional)">
-<t>The Name Resolution Block is used to support the correlation of numeric addresses (present in the captured packets) and their corresponding canonical names and it is optional. Having the literal names saved in the file, this prevents the need of a name resolution in a delayed time, when the association between names and addresses can be different from the one in use at capture time. Moreover, The Name Resolution Block avoids the need of issuing a lot of DNS requests every time the trace capture is opened, and allows to have name resolution also when reading the capture with a machine not connected to the network.</t>
-<t>The format of the Name Resolution Block is shown in <xref target="formatnrb"/>.</t>
-
-<figure anchor="formatnrb" title="Name Resolution Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |      Record Type              |         Record Length         | 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                       Record Value                            |
-   |              /* variable length, byte-aligned */              |
-   |               + + + + + + + + + + + + + + + + + + + + + + + + +
-   |               |               |               |               |
-   +-+-+-+-+-+-+-+-+ + + + + + + + + + + + + + + + + + + + + + + + +
-             . . . other records . . .
-   |  Record Type == end_of_recs   |  Record Length == 00          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>A Name Resolution Block is a zero-terminated list of records (in the TLV format), each of which contains an association between a network address and a name. There are three possible types of records:</t>
-
-<texttable anchor="nrrecords">
-  <ttcol>Name</ttcol>
-  <ttcol>Code</ttcol>
-  <ttcol>Length</ttcol>
-  <ttcol>Description</ttcol>
-
-  <c>end_of_recs</c>
-  <c>0</c>
-  <c>0</c>
-  <c>End of records</c>
-
-  <c>ip4_rec</c>
-  <c>1</c>
-  <c>Variable</c>
-  <c>Specifies an IPv4 address (contained in the first 4 bytes), followed by one or more zero-terminated strings containing the DNS entries for that address.</c>
-
-  <c>ip6_rec</c>
-  <c>1</c>
-  <c>Variable</c>
-  <c>Specifies an IPv6 address (contained in the first 16 bytes), followed by one or more zero-terminated strings containing the DNS entries for that address.</c>
-</texttable>
-
-<t>After the list or Name Resolution Records, optionally, a list of options (formatted according to the rules defined in <xref target="sectionopt"/>) can be present.</t>
-
-<t>A Name Resolution Block is normally placed at the beginning of the file, but no assumptions can be taken about its position. Name Resolution Blocks can be added in a second time by tools that process the file, like network analyzers.</t>
-
-<t>In addiction to the options defined in <xref target="sectionopt"/>, the following options are valid within this block:</t>
-
-<texttable>
-  <ttcol>Name</ttcol>
-  <ttcol>Code</ttcol>
-  <ttcol>Length</ttcol>
-  <ttcol>Description</ttcol>
-
-  <c>ns_dnsname</c>
-  <c>2</c>
-  <c>Variable</c>
-  <c>An ascii string containing the name of the machine (DNS server) used to perform the name resolution.</c>
-</texttable>
-
-</section>
-
-
-<section title="Interface Statistics Block (optional)">
-<t>The Interface Statistics Block contains the capture statistics for a given interface and it is optional. The statistics are referred to the interface defined in the current Section identified by the Interface ID field.</t>
-<t>The format of the Interface Statistics Block is shown in <xref target="formatisb"/>.</t>
-
-<figure anchor="formatisb" title="Interface Statistics Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         IfRecv                                |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         IfDrop                                |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         FilterAccept                          |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         OSDrop                                |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                         UsrDelivered                          |
-   |                          (high + low)                         |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |          Interface ID         |           Reserved            |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               / 
-   /                      Options (variable)                       / 
-   /                                                               / 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>The fields have the following meaning:</t>
-
-<list style="symbols">
-<t>IfRecv: number of packets received from the interface during the capture. This number is reported as a 64 bits value, in which the most significat bits are located in the first four bytes of the field.</t>
-<t>IfDrop: number of packets dropped by the interface during the capture due to lack of resources.</t>
-<t>FilterAccept: number of packets accepeted by filter during current capture.</t>
-<t>OSDrop: number of packets dropped by the operating system during the capture.</t>
-<t>UsrDelivered: number of packets delivered to the user. UsrDelivered can be different from the value 'FilterAccept - OSDropped' because some packets could still lay in the OS buffers when the capture ended.</t>
-<t>Interface ID: reference to an Interface Description Block.</t>
-<t>Reserved: Reserved to future use.</t>
-<t>Options: optionally, a list of options (formatted according to the rules defined in <xref target="sectionopt"/>) can be present.</t>
-</list>
-
-<t>In addiction to the options defined in <xref target="sectionopt"/>, the following options are valid within this block:</t>
-
-<texttable>
-  <ttcol>Name</ttcol>
-  <ttcol>Code</ttcol>
-  <ttcol>Length</ttcol>
-  <ttcol>Description</ttcol>
-
-  <c>isb_starttime</c>
-  <c>2</c>
-  <c>8</c>
-  <c>Time in which the capture started; time will be stored in two blocks of four bytes each, containing the timestamp in seconds and nanoseconds.</c>
-
-  <c>isb_endtime</c>
-  <c>3</c>
-  <c>8</c>
-  <c>Time in which the capture started; time will be stored in two blocks of four bytes each, containing the timestamp in seconds and nanoseconds.</c>
-</texttable>
-
-</section>
-</section>
-
-
-
-<section anchor="sectionopt" title="Options">
-<t>Almost all blocks have the possibility to embed optional fields. Optional fields can be used to insert some information that may be useful when reading data, but that it is not really needed for packet processing. Therefore, each tool can be either read the content of the optional fields (if any), or skip them at once.</t>
-<t>Skipping all the optional fields at once is straightforward because most of the blocks have a fixed length, therefore the field Block Length (present in the General Block Structure, see  <xref target="sectionblock"/>) can be used to skip everything till the next block.</t>
-
-<t>Options are a list of Type - Length - Value fields, each one containing a single value:</t>
-
-<list style="symbols">
-<t>Option Type (2 bytes): it contains the code that specifies the type of the current TLV record. Option types whose Most Significant Bit is equal to one are reserved for local use; therefore, there is no guarantee that the code used is unique among all capture files (generated by other applications). In case of vendor-specific extensions that have to be identified uniquely, vendors must request an Option Code whose MSB is equal to zero.</t>
-<t>Option Length (2 bytes): it contains the length of the following 'Option Value' field.</t>
-<t>Option Value (variable length): it contains the value of the given option. The length of this field as been specified by the Option Length field.</t>
-</list>
-
-<t>Options may be repeated several times (e.g. an interface that has several IP addresses associated to it). The option list is terminated by a special code which is the 'End of Option'.</t>
-
-<t>The format of the optional fields is shown in <xref target="formatopt"/>.</t>
-
-<figure anchor="formatopt" title="Options format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |      Option Code              |         Option Length         | 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |                       Option Value                            |
-   |              /* variable length, byte-aligned */              |
-   |               + + + + + + + + + + + + + + + + + + + + + + + + +
-   |               /               /               /               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   /                                                               /
-   /                 . . . other options . . .                     /
-   /                                                               /
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |   Option Code == opt_endofopt  |  Option Length == 0          |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>The following codes can always be present in any optional field:</t>
-
-<texttable>
-  <ttcol>Name</ttcol>
-  <ttcol>Code</ttcol>
-  <ttcol>Length</ttcol>
-  <ttcol>Description</ttcol>
-
-  <c>opt_endofopt</c>
-  <c>0</c>
-  <c>0</c>
-  <c>End of options: it is used to delimit the end of the optional fields. This block cannot be repeated within a given list of options.</c>
-
-  <c>opt_comment</c>
-  <c>1</c>
-  <c>variable</c>
-  <c>Comment: it is an ascii string containing a comment that is associated to the current block.</c>
-</texttable>
-
-</section>
-
-
-
-
-<section title="Experimental Blocks (deserved to a further investigation)">
-
-<section title="Other Packet Blocks (experimental)">
-<t>Can some other packet blocks (besides the two described in the previous paragraphs) be useful?</t>
-</section>
-
-<section title="Compression Block (experimental)">
-<t>The Compression Block is optional. A file can contain an arbitrary number of these blocks. A Compression Block, as the name says, is used to store compressed data. Its format is shown in <xref target="formatcb"/>.</t>
-
-<figure anchor="formatcb" title="Compression Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |  Compr. Type  |                                               |
-   +-+-+-+-+-+-+-+-+                                               |
-   |                                                               |
-   |                       Compressed Data                         |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>The fields have the following meaning:</t>
-
-<list style="symbols">
-<t>Compression Type: specifies the compression algorithm. Possible values for this field are 0 (uncompressed), 1 (Lempel Ziv), 2 (Gzip), other?? Probably some kind of dumb and fast compression algorithm could be effective with some types of traffic (for example web), but which?</t>
-<t>Compressed Data: data of this block. Once decompressed, it is made of other blocks.</t>
-</list>
-
-</section>
-
-
-<section title="Encryption Block (experimental)">
-<t>The Encryption Block is optional. A file can contain an arbitrary number of these blocks. An Encryption Block is used to sotre encrypted data. Its format is shown in <xref target="formateb"/>.</t>
-
-<figure anchor="formateb" title="Encryption Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |   Encr. Type  |                                               |
-   +-+-+-+-+-+-+-+-+                                               |
-   |                                                               |
-   |                       Compressed Data                         |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>The fields have the following meaning:</t>
-<list style="symbols">
-<t>Compression Type: specifies the encryption algorithm. Possible values for this field are ??? NOTE: this block should probably contain other fields, depending on the encryption algorithm. To be define precisely.</t>
-<t>Encrypted Data: data of this block. Once decripted, it consists of other blocks.</t>
-</list>
-
-</section>
-
-
-<section title="Fixed Length Block (experimental)">
-<t>The Fixed Length Block is optional. A file can contain an arbitrary number of these blocks. A Fixed Length Block can be used to optimize the access to the file. Its format is shown in <xref target="formatflm"/>.
-A Fixed Length Block stores records with constant size. It contains a set of Blocks (normally Packet Blocks or Simple Packet Blocks), of wihich it specifies the size. Knowing this size a priori helps to scan the file and to load some portions of it without truncating a block, and is particularly useful with cell-based networks like ATM.</t>
-
-<figure anchor="formatflm" title="Fixed Length Block format.">
-<artwork>
-    0                   1                   2                   3   
-    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-   |          Cell Size            |                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
-   |                                                               |
-   |                        Fixed Size Data                        |
-   |                                                               |
-   |              /* variable length, byte-aligned */              |
-   |                                                               |
-   |                                                               |
-   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- </artwork>
-</figure>
-
-<t>The fields have the following meaning:</t>
-<list style="symbols">
-<t>Cell size: the size of the blocks contained in the data field.</t>
-<t>Fixed Size Data: data of this block.</t>
-</list>
-
-</section>
-
-<section title="Directory Block (experimental)">
-<t>If present, this block contains the following information:</t>
-<list style="symbols">
-<t>number of indexed packets (N)</t>
-<t>table with position and length of any indexed packet (N entries)</t>
-</list>
-
-<t>A directory block must be followed by at least N packets, otherwise it must be considered invalid. It can be used to efficiently load portions of the file to memory and to support operations on memory mapped files. This block can be added by tools like network analyzers as a consequence of file processing.</t>
-</section>
-
-<section title="Traffic Statistics and Monitoring Blocks (experimental)">
-<t>One or more blocks could be defined to contain network statistics or traffic monitoring information. They could be use to store data collected from RMON or Netflow probes, or from other network monitoring tools.</t>
-</section>
-
-<section title="Event/Security Block (experimental)">
-<t>This block could be used to store events. Events could contain generic information (for example network load over 50%, server down...) or security alerts. An event could be:</t>
-
-<list style="symbols">
-<t>skipped, if the application doesn't know how to do with it</t>
-<t>processed independently by the packets. In other words, the applications skips the packets and processes only the alerts</t>
-<t>processed in relation to packets: for example, a security tool could load only the packets of the file that are near a security alert; a monitorg tool could skip the packets captured while the server was down.</t>
-</list>
-
-</section>
-
-</section>
-
-
-
-
-<section title="Conclusions">
-<t>The file format proposed in this document should be very versatile and satisfy a wide range of applications.
-In the simplest case, it can contain a raw dump of the network data, made of a series of Simple Packet Blocks.
-In the most complex case, it can be used as a repository for heterogeneous information.
-In every case, the file remains easy to parse and an application can always skip the data it is not interested in; at the same time, different applications can share the file, and each of them can benfit of the information produced by the others.
-Two or more files can be concatenated obtaining another valid file.</t>
-</section>
-
-
-<section title="Most important open issues">
-<list style="symbols">
-<t>Data, in the file, must be byte or word aligned? Currently, the structure of this document is not consistent with respect to this point.</t>
-</list>
-</section>
-
-</middle>
-
-</rfc>
diff --git a/contrib/libpcap/etherent.c b/contrib/libpcap/etherent.c
index 9d29955..27e5502 100644
--- a/contrib/libpcap/etherent.c
+++ b/contrib/libpcap/etherent.c
@@ -21,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/etherent.c,v 1.22 2003/11/15 23:23:57 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/etherent.c,v 1.23 2006/10/04 18:09:22 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -37,7 +37,7 @@ static const char rcsid[] _U_ =
 
 #include "pcap-int.h"
 
-#include <pcap-namedb.h>
+#include <pcap/namedb.h>
 
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
diff --git a/contrib/libpcap/ethertype.h b/contrib/libpcap/ethertype.h
index 2d21c6d..867d33e 100644
--- a/contrib/libpcap/ethertype.h
+++ b/contrib/libpcap/ethertype.h
@@ -18,7 +18,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.13.2.1 2005/09/05 09:08:03 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/ethertype.h,v 1.14 2005/09/05 09:06:58 guy Exp $ (LBL)
  */
 
 /*
diff --git a/contrib/libpcap/fad-getad.c b/contrib/libpcap/fad-getad.c
index 8101165..2ce6d70 100644
--- a/contrib/libpcap/fad-getad.c
+++ b/contrib/libpcap/fad-getad.c
@@ -34,7 +34,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/fad-getad.c,v 1.10.2.2 2007/09/14 00:45:17 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/fad-getad.c,v 1.12 2007/09/14 00:44:55 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
diff --git a/contrib/libpcap/fad-gifc.c b/contrib/libpcap/fad-gifc.c
index 985d2c0..ef04bd9 100644
--- a/contrib/libpcap/fad-gifc.c
+++ b/contrib/libpcap/fad-gifc.c
@@ -34,7 +34,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/fad-gifc.c,v 1.8.2.2 2005/06/29 06:43:31 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/fad-gifc.c,v 1.11.2.1 2008-08-06 07:35:01 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -42,7 +42,6 @@ static const char rcsid[] _U_ =
 #endif
 
 #include <sys/param.h>
-#include <sys/file.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #ifdef HAVE_SYS_SOCKIO_H
diff --git a/contrib/libpcap/fad-glifc.c b/contrib/libpcap/fad-glifc.c
index 8a86a3d..9e92bc3 100644
--- a/contrib/libpcap/fad-glifc.c
+++ b/contrib/libpcap/fad-glifc.c
@@ -34,7 +34,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/fad-glifc.c,v 1.5.2.1 2005/04/19 00:54:16 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/fad-glifc.c,v 1.6.2.1 2008/01/30 09:36:09 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -75,9 +75,9 @@ struct rtentry;		/* declarations in <net/if.h> */
  * The list, as returned through "alldevsp", may be null if no interfaces
  * were up and could be opened.
  *
- * This is the implementation used on platforms that have SIOCLGIFCONF
+ * This is the implementation used on platforms that have SIOCGLIFCONF
  * but don't have "getifaddrs()".  (Solaris 8 and later; we use
- * SIOCLGIFCONF rather than SIOCGIFCONF in order to get IPv6 addresses.)
+ * SIOCGLIFCONF rather than SIOCGIFCONF in order to get IPv6 addresses.)
  */
 int
 pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)
diff --git a/contrib/libpcap/fad-sita.c b/contrib/libpcap/fad-sita.c
new file mode 100644
index 0000000..2619045
--- /dev/null
+++ b/contrib/libpcap/fad-sita.c
@@ -0,0 +1,61 @@
+/*
+ *  fad-sita.c: Packet capture interface additions for SITA ACN devices
+ *
+ *  Copyright (c) 2007 Fulko Hew, SITA INC Canada, Inc <fulko.hew@sita.aero>
+ *
+ *  License: BSD
+ *
+ *  Redistribution and use in source and binary forms, with or without
+ *  modification, are permitted provided that the following conditions
+ *  are met:
+ *
+ *  1. Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *  2. Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in
+ *     the documentation and/or other materials provided with the
+ *     distribution.
+ *  3. The names of the authors may not be used to endorse or promote
+ *     products derived from this software without specific prior
+ *     written permission.
+ *
+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ *  IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ *  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+ /* $Id: fad-sita.c */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include "pcap-int.h"
+
+#include "pcap-sita.h"
+
+extern pcap_if_t	*acn_if_list;								/* pcap's list of available interfaces */
+
+int pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf) {
+
+	//printf("pcap_findalldevs()\n");				// fulko
+
+	*alldevsp = 0;												/* initialize the returned variables before we do anything */
+	strcpy(errbuf, "");
+	if (acn_parse_hosts_file(errbuf))							/* scan the hosts file for potential IOPs */
+		{
+		//printf("pcap_findalldevs() returning BAD after parsehosts\n");				// fulko
+		return -1;
+		}
+	//printf("pcap_findalldevs() got hostlist now finding devs\n");				// fulko
+	if (acn_findalldevs(errbuf))								/* then ask the IOPs for their monitorable devices */
+		{
+		//printf("pcap_findalldevs() returning BAD after findalldevs\n");				// fulko
+		return -1;
+		}
+	*alldevsp = acn_if_list;
+	acn_if_list = 0;											/* then forget our list head, because someone will call pcap_freealldevs() to empty the malloc'ed stuff */
+	//printf("pcap_findalldevs() returning ZERO OK\n");				// fulko
+	return 0;
+}
diff --git a/contrib/libpcap/fad-win32.c b/contrib/libpcap/fad-win32.c
index 4d2c01e..19839c8 100644
--- a/contrib/libpcap/fad-win32.c
+++ b/contrib/libpcap/fad-win32.c
@@ -33,7 +33,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/fad-win32.c,v 1.11.2.3 2006/02/22 17:09:32 gianluca Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/fad-win32.c,v 1.15 2007/09/25 20:34:36 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -301,6 +301,15 @@ pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)
 		name += strlen(name) + 1;
 		desc += strlen(desc) + 1;
 	}
+
+	if (ret != -1) {
+		/*
+		 * We haven't had any errors yet; do any platform-specific
+		 * operations to add devices.
+		 */
+		if (pcap_platform_finddevs(&devlist, errbuf) < 0)
+			ret = -1;
+	}
 	
 	if (ret == -1) {
 		/*
diff --git a/contrib/libpcap/filtertest.c b/contrib/libpcap/filtertest.c
new file mode 100644
index 0000000..cfa69ea
--- /dev/null
+++ b/contrib/libpcap/filtertest.c
@@ -0,0 +1,254 @@
+/*
+ * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+#ifndef lint
+static const char copyright[] _U_ =
+    "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
+The Regents of the University of California.  All rights reserved.\n";
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/libpcap/filtertest.c,v 1.2 2005/08/08 17:50:13 guy Exp $ (LBL)";
+#endif
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <pcap.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#ifndef HAVE___ATTRIBUTE__
+#define __attribute__(x)
+#endif
+
+static char *program_name;
+
+/* Forwards */
+static void usage(void) __attribute__((noreturn));
+static void error(const char *, ...)
+    __attribute__((noreturn, format (printf, 1, 2)));
+
+extern int optind;
+extern int opterr;
+extern char *optarg;
+
+/*
+ * On Windows, we need to open the file in binary mode, so that
+ * we get all the bytes specified by the size we get from "fstat()".
+ * On UNIX, that's not necessary.  O_BINARY is defined on Windows;
+ * we define it as 0 if it's not defined, so it does nothing.
+ */
+#ifndef O_BINARY
+#define O_BINARY	0
+#endif
+
+static char *
+read_infile(char *fname)
+{
+	register int i, fd, cc;
+	register char *cp;
+	struct stat buf;
+
+	fd = open(fname, O_RDONLY|O_BINARY);
+	if (fd < 0)
+		error("can't open %s: %s", fname, pcap_strerror(errno));
+
+	if (fstat(fd, &buf) < 0)
+		error("can't stat %s: %s", fname, pcap_strerror(errno));
+
+	cp = malloc((u_int)buf.st_size + 1);
+	if (cp == NULL)
+		error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1,
+			fname, pcap_strerror(errno));
+	cc = read(fd, cp, (u_int)buf.st_size);
+	if (cc < 0)
+		error("read %s: %s", fname, pcap_strerror(errno));
+	if (cc != buf.st_size)
+		error("short read %s (%d != %d)", fname, cc, (int)buf.st_size);
+
+	close(fd);
+	/* replace "# comment" with spaces */
+	for (i = 0; i < cc; i++) {
+		if (cp[i] == '#')
+			while (i < cc && cp[i] != '\n')
+				cp[i++] = ' ';
+	}
+	cp[cc] = '\0';
+	return (cp);
+}
+
+/* VARARGS */
+static void
+error(const char *fmt, ...)
+{
+	va_list ap;
+
+	(void)fprintf(stderr, "%s: ", program_name);
+	va_start(ap, fmt);
+	(void)vfprintf(stderr, fmt, ap);
+	va_end(ap);
+	if (*fmt) {
+		fmt += strlen(fmt);
+		if (fmt[-1] != '\n')
+			(void)fputc('\n', stderr);
+	}
+	exit(1);
+	/* NOTREACHED */
+}
+
+/*
+ * Copy arg vector into a new buffer, concatenating arguments with spaces.
+ */
+static char *
+copy_argv(register char **argv)
+{
+	register char **p;
+	register u_int len = 0;
+	char *buf;
+	char *src, *dst;
+
+	p = argv;
+	if (*p == 0)
+		return 0;
+
+	while (*p)
+		len += strlen(*p++) + 1;
+
+	buf = (char *)malloc(len);
+	if (buf == NULL)
+		error("copy_argv: malloc");
+
+	p = argv;
+	dst = buf;
+	while ((src = *p++) != NULL) {
+		while ((*dst++ = *src++) != '\0')
+			;
+		dst[-1] = ' ';
+	}
+	dst[-1] = '\0';
+
+	return buf;
+}
+
+int
+main(int argc, char **argv)
+{
+	char *cp;
+	int op;
+	int dflag;
+	char *infile;
+	int Oflag;
+	long snaplen;
+	int dlt;
+	char *cmdbuf;
+	pcap_t *pd;
+	struct bpf_program fcode;
+
+#ifdef WIN32
+	if(wsockinit() != 0) return 1;
+#endif /* WIN32 */
+
+	dflag = 1;
+	infile = NULL;
+	Oflag = 1;
+	snaplen = 68;
+  
+	if ((cp = strrchr(argv[0], '/')) != NULL)
+		program_name = cp + 1;
+	else
+		program_name = argv[0];
+
+	opterr = 0;
+	while ((op = getopt(argc, argv, "dF:Os:")) != -1) {
+		switch (op) {
+
+		case 'd':
+			++dflag;
+			break;
+
+		case 'F':
+			infile = optarg;
+			break;
+
+		case 'O':
+			Oflag = 0;
+			break;
+
+		case 's': {
+			char *end;
+
+			snaplen = strtol(optarg, &end, 0);
+			if (optarg == end || *end != '\0'
+			    || snaplen < 0 || snaplen > 65535)
+				error("invalid snaplen %s", optarg);
+			else if (snaplen == 0)
+				snaplen = 65535;
+			break;
+		}
+
+		default:
+			usage();
+			/* NOTREACHED */
+		}
+	}
+
+	if (optind >= argc) {
+		usage();
+		/* NOTREACHED */
+	}
+
+	dlt = pcap_datalink_name_to_val(argv[optind]);
+	if (dlt < 0)
+		error("invalid data link type %s", argv[optind]);
+	
+	if (infile)
+		cmdbuf = read_infile(infile);
+	else
+		cmdbuf = copy_argv(&argv[optind+1]);
+
+	pd = pcap_open_dead(dlt, snaplen);
+	if (pd == NULL)
+		error("Can't open fake pcap_t");
+
+	if (pcap_compile(pd, &fcode, cmdbuf, Oflag, 0) < 0)
+		error("%s", pcap_geterr(pd));
+	bpf_dump(&fcode, dflag);
+	pcap_close(pd);
+	exit(0);
+}
+
+static void
+usage(void)
+{
+	(void)fprintf(stderr, "%s, with %s\n", program_name,
+	    pcap_lib_version());
+	(void)fprintf(stderr,
+	    "Usage: %s [-dO] [ -F file ] [ -s snaplen ] dlt [ expression ]\n",
+	    program_name);
+	exit(1);
+}
diff --git a/contrib/libpcap/findalldevstest.c b/contrib/libpcap/findalldevstest.c
new file mode 100644
index 0000000..ec7c950
--- /dev/null
+++ b/contrib/libpcap/findalldevstest.c
@@ -0,0 +1,131 @@
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+
+#include <pcap.h>
+
+static void ifprint(pcap_if_t *d);
+static char *iptos(bpf_u_int32 in);
+
+int main(int argc, char **argv)
+{
+  pcap_if_t *alldevs;
+  pcap_if_t *d;
+  char *s;
+  bpf_u_int32 net, mask;
+  
+  char errbuf[PCAP_ERRBUF_SIZE+1];
+  if (pcap_findalldevs(&alldevs, errbuf) == -1)
+  {
+    fprintf(stderr,"Error in pcap_findalldevs: %s\n",errbuf);
+    exit(1);
+  }
+  for(d=alldevs;d;d=d->next)
+  {
+    ifprint(d);
+  }
+
+  if ( (s = pcap_lookupdev(errbuf)) == NULL)
+  {
+    fprintf(stderr,"Error in pcap_lookupdev: %s\n",errbuf);
+  }
+  else
+  {
+    printf("Preferred device name: %s\n",s);
+  }
+
+  if (pcap_lookupnet(s, &net, &mask, errbuf) < 0)
+  {
+    fprintf(stderr,"Error in pcap_lookupnet: %s\n",errbuf);
+  }
+  else
+  {
+    printf("Preferred device is on network: %s/%s\n",iptos(net), iptos(mask));
+  }
+  
+  exit(0);
+}
+
+static void ifprint(pcap_if_t *d)
+{
+  pcap_addr_t *a;
+#ifdef INET6
+  char ntop_buf[INET6_ADDRSTRLEN];
+#endif
+
+  printf("%s\n",d->name);
+  if (d->description)
+    printf("\tDescription: %s\n",d->description);
+  printf("\tLoopback: %s\n",(d->flags & PCAP_IF_LOOPBACK)?"yes":"no");
+
+  for(a=d->addresses;a;a=a->next) {
+    switch(a->addr->sa_family)
+    {
+      case AF_INET:
+        printf("\tAddress Family: AF_INET\n");
+        if (a->addr)
+          printf("\t\tAddress: %s\n",
+            inet_ntoa(((struct sockaddr_in *)(a->addr))->sin_addr));
+        if (a->netmask)
+          printf("\t\tNetmask: %s\n",
+            inet_ntoa(((struct sockaddr_in *)(a->netmask))->sin_addr));
+        if (a->broadaddr)
+          printf("\t\tBroadcast Address: %s\n",
+            inet_ntoa(((struct sockaddr_in *)(a->broadaddr))->sin_addr));
+        if (a->dstaddr)
+          printf("\t\tDestination Address: %s\n",
+            inet_ntoa(((struct sockaddr_in *)(a->dstaddr))->sin_addr));
+        break;
+#ifdef INET6
+      case AF_INET6:
+        printf("\tAddress Family: AF_INET6\n");
+        if (a->addr)
+          printf("\t\tAddress: %s\n",
+            inet_ntop(AF_INET6,
+               ((struct sockaddr_in6 *)(a->addr))->sin6_addr.s6_addr,
+               ntop_buf, sizeof ntop_buf));
+        if (a->netmask)
+          printf("\t\tNetmask: %s\n",
+            inet_ntop(AF_INET6,
+              ((struct sockaddr_in6 *)(a->netmask))->sin6_addr.s6_addr,
+               ntop_buf, sizeof ntop_buf));
+        if (a->broadaddr)
+          printf("\t\tBroadcast Address: %s\n",
+            inet_ntop(AF_INET6,
+              ((struct sockaddr_in6 *)(a->broadaddr))->sin6_addr.s6_addr,
+               ntop_buf, sizeof ntop_buf));
+        if (a->dstaddr)
+          printf("\t\tDestination Address: %s\n",
+            inet_ntop(AF_INET6,
+              ((struct sockaddr_in6 *)(a->dstaddr))->sin6_addr.s6_addr,
+               ntop_buf, sizeof ntop_buf));
+        break;
+#endif
+      default:
+        printf("\tAddress Family: Unknown (%d)\n", a->addr->sa_family);
+        break;
+    }
+  }
+  printf("\n");
+}
+
+/* From tcptraceroute */
+#define IPTOSBUFFERS	12
+static char *iptos(bpf_u_int32 in)
+{
+	static char output[IPTOSBUFFERS][3*4+3+1];
+	static short which;
+	u_char *p;
+
+	p = (u_char *)&in;
+	which = (which + 1 == IPTOSBUFFERS ? 0 : which + 1);
+	sprintf(output[which], "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
+	return output[which];
+}
diff --git a/contrib/libpcap/gencode.c b/contrib/libpcap/gencode.c
index b2d8222..0fb9499 100644
--- a/contrib/libpcap/gencode.c
+++ b/contrib/libpcap/gencode.c
@@ -23,7 +23,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.221.2.53 2007/09/12 19:17:24 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.290.2.16 2008-09-22 20:16:01 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -70,10 +70,11 @@ static const char rcsid[] _U_ =
 #include "nlpid.h"
 #include "llc.h"
 #include "gencode.h"
+#include "ieee80211.h"
 #include "atmuni31.h"
 #include "sunatmpos.h"
 #include "ppp.h"
-#include "sll.h"
+#include "pcap/sll.h"
 #include "arcnet.h"
 #ifdef HAVE_NET_PFVAR_H
 #include <sys/socket.h>
@@ -89,7 +90,7 @@ static const char rcsid[] _U_ =
 #include <netdb.h>	/* for "struct addrinfo" */
 #endif /* WIN32 */
 #endif /*INET6*/
-#include <pcap-namedb.h>
+#include <pcap/namedb.h>
 
 #define ETHERMTU	1500
 
@@ -107,8 +108,8 @@ static const char rcsid[] _U_ =
 static jmp_buf top_ctx;
 static pcap_t *bpf_pcap;
 
-#ifdef WIN32
 /* Hack for updating VLAN, MPLS, and PPPoE offsets. */
+#ifdef WIN32
 static u_int	orig_linktype = (u_int)-1, orig_nl = (u_int)-1, label_stack_depth = (u_int)-1;
 #else
 static u_int	orig_linktype = -1U, orig_nl = -1U, label_stack_depth = -1U;
@@ -136,6 +137,7 @@ bpf_error(const char *fmt, ...)
 
 static void init_linktype(pcap_t *);
 
+static void init_regs(void);
 static int alloc_reg(void);
 static void free_reg(int);
 
@@ -147,7 +149,8 @@ static struct block *root;
  */
 enum e_offrel {
 	OR_PACKET,	/* relative to the beginning of the packet */
-	OR_LINK,	/* relative to the link-layer header */
+	OR_LINK,	/* relative to the beginning of the link-layer header */
+	OR_MACPL,	/* relative to the end of the MAC-layer header */
 	OR_NET,		/* relative to the network-layer header */
 	OR_NET_NOSNAP,	/* relative to the network-layer header, with no SNAP header at the link layer */
 	OR_TRAN_IPV4,	/* relative to the transport-layer header, with IPv4 network layer */
@@ -192,6 +195,7 @@ static struct block *gen_bcmp(enum e_offrel, u_int, u_int, const u_char *);
 static struct block *gen_ncmp(enum e_offrel, bpf_u_int32, bpf_u_int32,
     bpf_u_int32, bpf_u_int32, int, bpf_int32);
 static struct slist *gen_load_llrel(u_int, u_int);
+static struct slist *gen_load_macplrel(u_int, u_int);
 static struct slist *gen_load_a(enum e_offrel, u_int, u_int);
 static struct slist *gen_loadx_iphdrlen(void);
 static struct block *gen_uncond(int);
@@ -199,12 +203,16 @@ static inline struct block *gen_true(void);
 static inline struct block *gen_false(void);
 static struct block *gen_ether_linktype(int);
 static struct block *gen_linux_sll_linktype(int);
-static void insert_radiotap_load_llprefixlen(struct block *);
-static void insert_ppi_load_llprefixlen(struct block *);
-static void insert_load_llprefixlen(struct block *);
+static struct slist *gen_load_prism_llprefixlen(void);
+static struct slist *gen_load_avs_llprefixlen(void);
+static struct slist *gen_load_radiotap_llprefixlen(void);
+static struct slist *gen_load_ppi_llprefixlen(void);
+static void insert_compute_vloffsets(struct block *);
 static struct slist *gen_llprefixlen(void);
+static struct slist *gen_off_macpl(void);
+static int ethertype_to_ppptype(int);
 static struct block *gen_linktype(int);
-static struct block *gen_snap(bpf_u_int32, bpf_u_int32, u_int);
+static struct block *gen_snap(bpf_u_int32, bpf_u_int32);
 static struct block *gen_llc_linktype(int);
 static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int);
 #ifdef INET6
@@ -249,6 +257,7 @@ static struct slist *xfer_to_x(struct arth *);
 static struct slist *xfer_to_a(struct arth *);
 static struct block *gen_mac_multicast(int);
 static struct block *gen_len(int, int);
+static struct block *gen_check_802_11_data_frame(void);
 
 static struct block *gen_ppi_dlt_check(void);
 static struct block *gen_msg_abbrev(int type);
@@ -371,6 +380,7 @@ pcap_compile(pcap_t *p, struct bpf_program *program,
 	n_errors = 0;
 	root = NULL;
 	bpf_pcap = p;
+	init_regs();
 	if (setjmp(top_ctx)) {
 		lex_cleanup();
 		freechunks();
@@ -486,24 +496,11 @@ merge(b0, b1)
 	*p = b1;
 }
 
-
 void
 finish_parse(p)
 	struct block *p;
 {
 	struct block *ppi_dlt_check;
-	
-	ppi_dlt_check = gen_ppi_dlt_check();
-
-	if (ppi_dlt_check != NULL)
-	{
-		gen_and(ppi_dlt_check, p);
-	}
-
-	backpatch(p, gen_retblk(snaplen));
-	p->sense = !p->sense;
-	backpatch(p, gen_retblk(0));
-	root = p->head;
 
 	/*
 	 * Insert before the statements of the first (root) block any
@@ -514,14 +511,30 @@ finish_parse(p)
 	 * statements of all blocks that use those lengths and that
 	 * have no predecessors that use them, so that we only compute
 	 * the lengths if we need them.  There might be even better
-	 * approaches than that.  However, as we're currently only
-	 * handling variable-length radiotap headers, and as all
-	 * filtering expressions other than raw link[M:N] tests
-	 * require the length of that header, doing more for that
-	 * header length isn't really worth the effort.
+	 * approaches than that.
+	 *
+	 * However, those strategies would be more complicated, and
+	 * as we don't generate code to compute a length if the
+	 * program has no tests that use the length, and as most
+	 * tests will probably use those lengths, we would just
+	 * postpone computing the lengths so that it's not done
+	 * for tests that fail early, and it's not clear that's
+	 * worth the effort.
 	 */
+	insert_compute_vloffsets(p->head);
+	
+	/*
+	 * For DLT_PPI captures, generate a check of the per-packet
+	 * DLT value to make sure it's DLT_IEEE802_11.
+	 */
+	ppi_dlt_check = gen_ppi_dlt_check();
+	if (ppi_dlt_check != NULL)
+		gen_and(ppi_dlt_check, p);
 
-	insert_load_llprefixlen(root);
+	backpatch(p, gen_retblk(snaplen));
+	p->sense = !p->sense;
+	backpatch(p, gen_retblk(0));
+	root = p->head;
 }
 
 void
@@ -684,13 +697,7 @@ gen_ncmp(offrel, offset, size, mask, jtype, reverse, v)
  * Various code constructs need to know the layout of the data link
  * layer.  These variables give the necessary offsets from the beginning
  * of the packet data.
- *
- * If the link layer has variable_length headers, the offsets are offsets
- * from the end of the link-link-layer header, and "reg_ll_size" is
- * the register number for a register containing the length of the
- * link-layer header.  Otherwise, "reg_ll_size" is -1.
  */
-static int reg_ll_size;
 
 /*
  * This is the offset of the beginning of the link-layer header from
@@ -703,13 +710,49 @@ static int reg_ll_size;
 static u_int off_ll;
 
 /*
- * This is the offset of the beginning of the MAC-layer header.
+ * If there's a variable-length header preceding the link-layer header,
+ * "reg_off_ll" is the register number for a register containing the
+ * length of that header, and therefore the offset of the link-layer
+ * header from the beginning of the raw packet data.  Otherwise,
+ * "reg_off_ll" is -1.
+ */
+static int reg_off_ll;
+
+/*
+ * This is the offset of the beginning of the MAC-layer header from
+ * the beginning of the link-layer header.
  * It's usually 0, except for ATM LANE, where it's the offset, relative
  * to the beginning of the raw packet data, of the Ethernet header.
  */
 static u_int off_mac;
 
 /*
+ * This is the offset of the beginning of the MAC-layer payload,
+ * from the beginning of the raw packet data.
+ *
+ * I.e., it's the sum of the length of the link-layer header (without,
+ * for example, any 802.2 LLC header, so it's the MAC-layer
+ * portion of that header), plus any prefix preceding the
+ * link-layer header.
+ */
+static u_int off_macpl;
+
+/*
+ * This is 1 if the offset of the beginning of the MAC-layer payload
+ * from the beginning of the link-layer header is variable-length.
+ */
+static int off_macpl_is_variable;
+
+/*
+ * If the link layer has variable_length headers, "reg_off_macpl"
+ * is the register number for a register containing the length of the
+ * link-layer header plus the length of any variable-length header
+ * preceding the link-layer header.  Otherwise, "reg_off_macpl"
+ * is -1.
+ */
+static int reg_off_macpl;
+
+/*
  * "off_linktype" is the offset to information in the link-layer header
  * giving the packet type.  This offset is relative to the beginning
  * of the link-layer header (i.e., it doesn't include off_ll).
@@ -732,6 +775,13 @@ static u_int off_mac;
 static u_int off_linktype;
 
 /*
+ * TRUE if "pppoes" appeared in the filter; it causes link-layer type
+ * checks to check the PPP header, assumed to follow a LAN-style link-
+ * layer header and a PPPoE session header.
+ */
+static int is_pppoes = 0;
+
+/*
  * TRUE if the link layer includes an ATM pseudo-header.
  */
 static int is_atm = 0;
@@ -770,8 +820,8 @@ static u_int off_payload;
 
 /*
  * These are offsets to the beginning of the network-layer header.
- * They are relative to the beginning of the link-layer header (i.e.,
- * they don't include off_ll).
+ * They are relative to the beginning of the MAC-layer payload (i.e.,
+ * they don't include off_ll or off_macpl).
  *
  * If the link layer never uses 802.2 LLC:
  *
@@ -818,6 +868,11 @@ init_linktype(p)
 	off_payload = -1;
 
 	/*
+	 * And that we're not doing PPPoE.
+	 */
+	is_pppoes = 0;
+
+	/*
 	 * And assume we're not doing SS7.
 	 */
 	off_li = -1;
@@ -827,34 +882,40 @@ init_linktype(p)
 	off_sls = -1;
 
 	/*
-	 * Also assume it's not 802.11 with a fixed-length radio header.
+	 * Also assume it's not 802.11.
 	 */
 	off_ll = 0;
+	off_macpl = 0;
+	off_macpl_is_variable = 0;
 
 	orig_linktype = -1;
 	orig_nl = -1;
         label_stack_depth = 0;
 
-	reg_ll_size = -1;
+	reg_off_ll = -1;
+	reg_off_macpl = -1;
 
 	switch (linktype) {
 
 	case DLT_ARCNET:
 		off_linktype = 2;
-		off_nl = 6;		/* XXX in reality, variable! */
-		off_nl_nosnap = 6;	/* no 802.2 LLC */
+		off_macpl = 6;
+		off_nl = 0;		/* XXX in reality, variable! */
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_ARCNET_LINUX:
 		off_linktype = 4;
-		off_nl = 8;		/* XXX in reality, variable! */
-		off_nl_nosnap = 8;	/* no 802.2 LLC */
+		off_macpl = 8;
+		off_nl = 0;		/* XXX in reality, variable! */
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_EN10MB:
 		off_linktype = 12;
-		off_nl = 14;		/* Ethernet II */
-		off_nl_nosnap = 17;	/* 802.3+802.2 */
+		off_macpl = 14;		/* Ethernet header length */
+		off_nl = 0;		/* Ethernet II */
+		off_nl_nosnap = 3;	/* 802.3+802.2 */
 		return;
 
 	case DLT_SLIP:
@@ -863,29 +924,33 @@ init_linktype(p)
 		 * header is hacked into our SLIP driver.
 		 */
 		off_linktype = -1;
-		off_nl = 16;
-		off_nl_nosnap = 16;	/* no 802.2 LLC */
+		off_macpl = 16;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_SLIP_BSDOS:
 		/* XXX this may be the same as the DLT_PPP_BSDOS case */
 		off_linktype = -1;
 		/* XXX end */
-		off_nl = 24;
-		off_nl_nosnap = 24;	/* no 802.2 LLC */
+		off_macpl = 24;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_NULL:
 	case DLT_LOOP:
 		off_linktype = 0;
-		off_nl = 4;
-		off_nl_nosnap = 4;	/* no 802.2 LLC */
+		off_macpl = 4;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_ENC:
 		off_linktype = 0;
-		off_nl = 12;
-		off_nl_nosnap = 12;	/* no 802.2 LLC */
+		off_macpl = 12;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_PPP:
@@ -893,8 +958,9 @@ init_linktype(p)
 	case DLT_C_HDLC:		/* BSD/OS Cisco HDLC */
 	case DLT_PPP_SERIAL:		/* NetBSD sync/async serial PPP */
 		off_linktype = 2;
-		off_nl = 4;
-		off_nl_nosnap = 4;	/* no 802.2 LLC */
+		off_macpl = 4;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_PPP_ETHER:
@@ -903,14 +969,16 @@ init_linktype(p)
 		 * only covers session state.
 		 */
 		off_linktype = 6;
-		off_nl = 8;
-		off_nl_nosnap = 8;	/* no 802.2 LLC */
+		off_macpl = 8;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_PPP_BSDOS:
 		off_linktype = 5;
-		off_nl = 24;
-		off_nl_nosnap = 24;	/* no 802.2 LLC */
+		off_macpl = 24;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_FDDI:
@@ -926,12 +994,12 @@ init_linktype(p)
 #ifdef PCAP_FDDIPAD
 		off_linktype += pcap_fddipad;
 #endif
-		off_nl = 21;		/* FDDI+802.2+SNAP */
-		off_nl_nosnap = 16;	/* FDDI+802.2 */
+		off_macpl = 13;		/* FDDI MAC header length */
 #ifdef PCAP_FDDIPAD
-		off_nl += pcap_fddipad;
-		off_nl_nosnap += pcap_fddipad;
+		off_macpl += pcap_fddipad;
 #endif
+		off_nl = 8;		/* 802.2+SNAP */
+		off_nl_nosnap = 3;	/* 802.2 */
 		return;
 
 	case DLT_IEEE802:
@@ -959,11 +1027,15 @@ init_linktype(p)
 		 * 8 - figure out which byte that is).
 		 */
 		off_linktype = 14;
-		off_nl = 22;		/* Token Ring+802.2+SNAP */
-		off_nl_nosnap = 17;	/* Token Ring+802.2 */
+		off_macpl = 14;		/* Token Ring MAC header length */
+		off_nl = 8;		/* 802.2+SNAP */
+		off_nl_nosnap = 3;	/* 802.2 */
 		return;
 
 	case DLT_IEEE802_11:
+	case DLT_PRISM_HEADER:
+	case DLT_IEEE802_11_RADIO_AVS:
+	case DLT_IEEE802_11_RADIO:
 		/*
 		 * 802.11 doesn't really have a link-level type field.
 		 * We set "off_linktype" to the offset of the LLC header.
@@ -972,90 +1044,37 @@ init_linktype(p)
 		 * is being used and pick out the encapsulated Ethernet type.
 		 * XXX - should we generate code to check for SNAP?
 		 *
-		 * XXX - the header is actually variable-length.  We
-		 * assume a 24-byte link-layer header, as appears in
-		 * data frames in networks with no bridges.  If the
-		 * fromds and tods 802.11 header bits are both set,
-		 * it's actually supposed to be 30 bytes.
+		 * We also handle variable-length radio headers here.
+		 * The Prism header is in theory variable-length, but in
+		 * practice it's always 144 bytes long.  However, some
+		 * drivers on Linux use ARPHRD_IEEE80211_PRISM, but
+		 * sometimes or always supply an AVS header, so we
+		 * have to check whether the radio header is a Prism
+		 * header or an AVS header, so, in practice, it's
+		 * variable-length.
 		 */
 		off_linktype = 24;
-		off_nl = 32;		/* 802.11+802.2+SNAP */
-		off_nl_nosnap = 27;	/* 802.11+802.2 */
-		return;
-
-	case DLT_PRISM_HEADER:
-		/*
-		 * Same as 802.11, but with an additional header before
-		 * the 802.11 header, containing a bunch of additional
-		 * information including radio-level information.
-		 *
-		 * The header is 144 bytes long.
-		 *
-		 * XXX - same variable-length header problem; at least
-		 * the Prism header is fixed-length.
-		 */
-		off_ll = 144;
-		off_linktype = 24;
-		off_nl = 32;	/* Prism+802.11+802.2+SNAP */
-		off_nl_nosnap = 27;	/* Prism+802.11+802.2 */
-		return;
-
-	case DLT_IEEE802_11_RADIO_AVS:
-		/*
-		 * Same as 802.11, but with an additional header before
-		 * the 802.11 header, containing a bunch of additional
-		 * information including radio-level information.
-		 *
-		 * The header is 64 bytes long, at least in its
-		 * current incarnation.
-		 *
-		 * XXX - same variable-length header problem, only
-		 * more so; this header is also variable-length,
-		 * with the length being the 32-bit big-endian
-		 * number at an offset of 4 from the beginning
-		 * of the radio header.  We should handle that the
-		 * same way we handle the length at the beginning
-		 * of the radiotap header.
-		 *
-		 * XXX - in Linux, do any drivers that supply an AVS
-		 * header supply a link-layer type other than
-		 * ARPHRD_IEEE80211_PRISM?  If so, we should map that
-		 * to DLT_IEEE802_11_RADIO_AVS; if not, or if there are
-		 * any drivers that supply an AVS header but supply
-		 * an ARPHRD value of ARPHRD_IEEE80211_PRISM, we'll
-		 * have to check the header in the generated code to
-		 * determine whether it's Prism or AVS.
-		 */
-		off_ll = 64;
-		off_linktype = 24;
-		off_nl = 32;		/* Radio+802.11+802.2+SNAP */
-		off_nl_nosnap = 27;	/* Radio+802.11+802.2 */
+		off_macpl = 0;		/* link-layer header is variable-length */
+		off_macpl_is_variable = 1;
+		off_nl = 8;		/* 802.2+SNAP */
+		off_nl_nosnap = 3;	/* 802.2 */
 		return;
 
-		
-		/* 
-		 * At the moment we treat PPI as normal Radiotap encoded
-		 * packets. The difference is in the function that generates
-		 * the code at the beginning to compute the header length.
-		 * Since this code generator of PPI supports bare 802.11
-		 * encapsulation only (i.e. the encapsulated DLT should be
-		 * DLT_IEEE802_11) we generate code to check for this too.
-		 */
 	case DLT_PPI:
-	case DLT_IEEE802_11_RADIO:
-		/*
-		 * Same as 802.11, but with an additional header before
-		 * the 802.11 header, containing a bunch of additional
-		 * information including radio-level information.
-		 *
-		 * The radiotap header is variable length, and we
-		 * generate code to compute its length and store it
-		 * in a register.  These offsets are relative to the
-		 * beginning of the 802.11 header.
+		/* 
+		 * At the moment we treat PPI the same way that we treat
+		 * normal Radiotap encoded packets. The difference is in
+		 * the function that generates the code at the beginning
+		 * to compute the header length.  Since this code generator
+		 * of PPI supports bare 802.11 encapsulation only (i.e.
+		 * the encapsulated DLT should be DLT_IEEE802_11) we
+		 * generate code to check for this too.
 		 */
 		off_linktype = 24;
-		off_nl = 32;		/* 802.11+802.2+SNAP */
-		off_nl_nosnap = 27;	/* 802.11+802.2 */
+		off_macpl = 0;		/* link-layer header is variable-length */
+		off_macpl_is_variable = 1;
+		off_nl = 8;		/* 802.2+SNAP */
+		off_nl_nosnap = 3;	/* 802.2 */
 		return;
 
 	case DLT_ATM_RFC1483:
@@ -1072,6 +1091,7 @@ init_linktype(p)
 		 * PPPo{A,E} and a PPP protocol of IP and....
 		 */
 		off_linktype = 0;
+		off_macpl = 0;		/* packet begins with LLC header */
 		off_nl = 8;		/* 802.2+SNAP */
 		off_nl_nosnap = 3;	/* 802.2 */
 		return;
@@ -1085,23 +1105,26 @@ init_linktype(p)
 		off_vpi = SUNATM_VPI_POS;
 		off_vci = SUNATM_VCI_POS;
 		off_proto = PROTO_POS;
-		off_mac = -1;	/* LLC-encapsulated, so no MAC-layer header */
+		off_mac = -1;	/* assume LLC-encapsulated, so no MAC-layer header */
 		off_payload = SUNATM_PKT_BEGIN_POS;
 		off_linktype = off_payload;
-		off_nl = off_payload+8;		/* 802.2+SNAP */
-		off_nl_nosnap = off_payload+3;	/* 802.2 */
+		off_macpl = off_payload;	/* if LLC-encapsulated */
+		off_nl = 8;		/* 802.2+SNAP */
+		off_nl_nosnap = 3;	/* 802.2 */
 		return;
 
 	case DLT_RAW:
 		off_linktype = -1;
+		off_macpl = 0;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_LINUX_SLL:	/* fake header for Linux cooked socket */
 		off_linktype = 14;
-		off_nl = 16;
-		off_nl_nosnap = 16;	/* no 802.2 LLC */
+		off_macpl = 16;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_LTALK:
@@ -1111,6 +1134,7 @@ init_linktype(p)
 		 * "long" DDP packet following.
 		 */
 		off_linktype = -1;
+		off_macpl = 0;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
@@ -1127,8 +1151,9 @@ init_linktype(p)
 		 * 2625 says SNAP should be used.
 		 */
 		off_linktype = 16;
-		off_nl = 24;		/* IPFC+802.2+SNAP */
-		off_nl_nosnap = 19;	/* IPFC+802.2 */
+		off_macpl = 16;
+		off_nl = 8;		/* 802.2+SNAP */
+		off_nl_nosnap = 3;	/* 802.2 */
 		return;
 
 	case DLT_FRELAY:
@@ -1137,6 +1162,7 @@ init_linktype(p)
 		 * frames (NLPID of 0x80).
 		 */
 		off_linktype = -1;
+		off_macpl = 0;
 		off_nl = 0;
 		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
@@ -1148,14 +1174,16 @@ init_linktype(p)
                  */
 	case DLT_MFR:
 		off_linktype = -1;
+		off_macpl = 0;
 		off_nl = 4;
 		off_nl_nosnap = 0;	/* XXX - for now -> no 802.2 LLC */
 		return;
 
 	case DLT_APPLE_IP_OVER_IEEE1394:
 		off_linktype = 16;
-		off_nl = 18;
-		off_nl_nosnap = 18;	/* no 802.2 LLC */
+		off_macpl = 18;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 
 	case DLT_LINUX_IRDA:
@@ -1163,6 +1191,7 @@ init_linktype(p)
 		 * Currently, only raw "link[N:M]" filtering is supported.
 		 */
 		off_linktype = -1;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
@@ -1172,21 +1201,24 @@ init_linktype(p)
 		 * Currently, only raw "link[N:M]" filtering is supported.
 		 */
 		off_linktype = -1;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
 
 	case DLT_SYMANTEC_FIREWALL:
 		off_linktype = 6;
-		off_nl = 44;		/* Ethernet II */
-		off_nl_nosnap = 44;	/* XXX - what does it do with 802.3 packets? */
+		off_macpl = 44;
+		off_nl = 0;		/* Ethernet II */
+		off_nl_nosnap = 0;	/* XXX - what does it do with 802.3 packets? */
 		return;
 
 #ifdef HAVE_NET_PFVAR_H
 	case DLT_PFLOG:
 		off_linktype = 0;
-		off_nl = PFLOG_HDRLEN;
-		off_nl_nosnap = PFLOG_HDRLEN;	/* no 802.2 LLC */
+		off_macpl = PFLOG_HDRLEN;
+		off_nl = 0;
+		off_nl_nosnap = 0;	/* no 802.2 LLC */
 		return;
 #endif
 
@@ -1197,26 +1229,30 @@ init_linktype(p)
         case DLT_JUNIPER_CHDLC:
         case DLT_JUNIPER_FRELAY:
                 off_linktype = 4;
-		off_nl = 4;
+		off_macpl = 4;
+		off_nl = 0;
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
                 return;
 
 	case DLT_JUNIPER_ATM1:
-		off_linktype = 4; /* in reality variable between 4-8 */
-		off_nl = 4;
-		off_nl_nosnap = 14;
+		off_linktype = 4;	/* in reality variable between 4-8 */
+		off_macpl = 4;	/* in reality variable between 4-8 */
+		off_nl = 0;
+		off_nl_nosnap = 10;
 		return;
 
 	case DLT_JUNIPER_ATM2:
-		off_linktype = 8; /* in reality variable between 8-12 */
-		off_nl = 8;
-		off_nl_nosnap = 18;
+		off_linktype = 8;	/* in reality variable between 8-12 */
+		off_macpl = 8;	/* in reality variable between 8-12 */
+		off_nl = 0;
+		off_nl_nosnap = 10;
 		return;
 
 		/* frames captured on a Juniper PPPoE service PIC
 		 * contain raw ethernet frames */
 	case DLT_JUNIPER_PPPOE:
         case DLT_JUNIPER_ETHER:
+        	off_macpl = 14;
 		off_linktype = 16;
 		off_nl = 18;		/* Ethernet II */
 		off_nl_nosnap = 21;	/* 802.3+802.2 */
@@ -1224,36 +1260,56 @@ init_linktype(p)
 
 	case DLT_JUNIPER_PPPOE_ATM:
 		off_linktype = 4;
-		off_nl = 6;
-		off_nl_nosnap = -1;	 /* no 802.2 LLC */
+		off_macpl = 6;
+		off_nl = 0;
+		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		return;
 
 	case DLT_JUNIPER_GGSN:
 		off_linktype = 6;
-		off_nl = 12;
-		off_nl_nosnap = -1;	 /* no 802.2 LLC */
+		off_macpl = 12;
+		off_nl = 0;
+		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		return;
 
 	case DLT_JUNIPER_ES:
 		off_linktype = 6;
-		off_nl = -1;		/* not really a network layer but raw IP adresses */
+		off_macpl = -1;		/* not really a network layer but raw IP addresses */
+		off_nl = -1;		/* not really a network layer but raw IP addresses */
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		return;
 
 	case DLT_JUNIPER_MONITOR:
 		off_linktype = 12;
-		off_nl = 12;		/* raw IP/IP6 header */
+		off_macpl = 12;
+		off_nl = 0;		/* raw IP/IP6 header */
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		return;
 
 	case DLT_JUNIPER_SERVICES:
 		off_linktype = 12;
+		off_macpl = -1;		/* L3 proto location dep. on cookie type */
 		off_nl = -1;		/* L3 proto location dep. on cookie type */
 		off_nl_nosnap = -1;	/* no 802.2 LLC */
 		return;
 
 	case DLT_JUNIPER_VP:
 		off_linktype = 18;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_JUNIPER_ST:
+		off_linktype = 18;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_JUNIPER_ISM:
+		off_linktype = 8;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
@@ -1265,6 +1321,7 @@ init_linktype(p)
 		off_dpc = 4;
 		off_sls = 7;
 		off_linktype = -1;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
@@ -1276,6 +1333,19 @@ init_linktype(p)
 		off_dpc = 8;
 		off_sls = 11;
 		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_ERF:
+		off_li = 22;
+		off_sio = 23;
+		off_opc = 24;
+		off_dpc = 24;
+		off_sls = 27;
+		off_linktype = -1;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
@@ -1283,8 +1353,9 @@ init_linktype(p)
 #ifdef DLT_PFSYNC
 	case DLT_PFSYNC:
 		off_linktype = -1;
-		off_nl = 4;
-		off_nl_nosnap = 4;
+		off_macpl = 4;
+		off_nl = 0;
+		off_nl_nosnap = 0;
 		return;
 #endif
 
@@ -1293,6 +1364,7 @@ init_linktype(p)
 		 * Currently, only raw "link[N:M]" filtering is supported.
 		 */
 		off_linktype = -1;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
@@ -1302,6 +1374,7 @@ init_linktype(p)
 		 * Currently, only raw "link[N:M]" filtering is supported.
 		 */
 		off_linktype = -1;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
@@ -1311,6 +1384,118 @@ init_linktype(p)
 		 * Currently, only raw "link[N:M]" filtering is supported.
 		 */
 		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_USB_LINUX:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_CAN20B:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_IEEE802_15_4_LINUX:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_IEEE802_16_MAC_CPS_RADIO:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_IEEE802_15_4:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_SITA:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_RAIF1:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_IPMB:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_BLUETOOTH_HCI_H4_WITH_PHDR:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
+		off_nl = -1;
+		off_nl_nosnap = -1;
+		return;
+
+	case DLT_AX25_KISS:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;	/* variable, min 15, max 71 steps of 7 */
+		off_macpl = -1;
+		off_nl = -1;		/* variable, min 16, max 71 steps of 7 */
+		off_nl_nosnap = -1;	/* no 802.2 LLC */
+		off_mac = 1;		/* step over the kiss length byte */
+		return;
+
+	case DLT_IEEE802_15_4_NONASK_PHY:
+		/*
+		 * Currently, only raw "link[N:M]" filtering is supported.
+		 */
+		off_linktype = -1;
+		off_macpl = -1;
 		off_nl = -1;
 		off_nl_nosnap = -1;
 		return;
@@ -1364,6 +1549,45 @@ gen_load_llrel(offset, size)
 	return s;
 }
 
+/*
+ * Load a value relative to the beginning of the MAC-layer payload.
+ */
+static struct slist *
+gen_load_macplrel(offset, size)
+	u_int offset, size;
+{
+	struct slist *s, *s2;
+
+	s = gen_off_macpl();
+
+	/*
+	 * If s is non-null, the offset of the MAC-layer payload is
+	 * variable, and s points to a list of instructions that
+	 * arrange that the X register contains that offset.
+	 *
+	 * Otherwise, the offset of the MAC-layer payload is constant,
+	 * and is in off_macpl.
+	 */
+	if (s != NULL) {
+		/*
+		 * The offset of the MAC-layer payload is in the X
+		 * register.  Do an indirect load, to use the X register
+		 * as an offset.
+		 */
+		s2 = new_stmt(BPF_LD|BPF_IND|size);
+		s2->s.k = offset;
+		sappend(s, s2);
+	} else {
+		/*
+		 * The offset of the MAC-layer payload is constant,
+		 * and is in off_macpl; load the value at that offset
+		 * plus the specified offset.
+		 */
+		s = new_stmt(BPF_LD|BPF_ABS|size);
+		s->s.k = off_macpl + offset;
+	}
+	return s;
+}
 
 /*
  * Load a value relative to the beginning of the specified header.
@@ -1386,12 +1610,16 @@ gen_load_a(offrel, offset, size)
 		s = gen_load_llrel(offset, size);
 		break;
 
+	case OR_MACPL:
+		s = gen_load_macplrel(offset, size);
+		break;
+
 	case OR_NET:
-		s = gen_load_llrel(off_nl + offset, size);
+		s = gen_load_macplrel(off_nl + offset, size);
 		break;
 
 	case OR_NET_NOSNAP:
-		s = gen_load_llrel(off_nl_nosnap + offset, size);
+		s = gen_load_macplrel(off_nl_nosnap + offset, size);
 		break;
 
 	case OR_TRAN_IPV4:
@@ -1404,21 +1632,22 @@ gen_load_a(offrel, offset, size)
 		s = gen_loadx_iphdrlen();
 
 		/*
-		 * Load the item at {offset of the link-layer header} +
-		 * {offset, relative to the start of the link-layer
-		 * header, of the IPv4 header} + {length of the IPv4 header} +
+		 * Load the item at {offset of the MAC-layer payload} +
+		 * {offset, relative to the start of the MAC-layer
+		 * paylod, of the IPv4 header} + {length of the IPv4 header} +
 		 * {specified offset}.
 		 *
-		 * (If the link-layer is variable-length, it's included
-		 * in the value in the X register, and off_ll is 0.)
+		 * (If the offset of the MAC-layer payload is variable,
+		 * it's included in the value in the X register, and
+		 * off_macpl is 0.)
 		 */
 		s2 = new_stmt(BPF_LD|BPF_IND|size);
-		s2->s.k = off_ll + off_nl + offset;
+		s2->s.k = off_macpl + off_nl + offset;
 		sappend(s, s2);
 		break;
 
 	case OR_TRAN_IPV6:
-		s = gen_load_llrel(off_nl + 40 + offset, size);
+		s = gen_load_macplrel(off_nl + 40 + offset, size);
 		break;
 
 	default:
@@ -1438,12 +1667,15 @@ gen_loadx_iphdrlen()
 {
 	struct slist *s, *s2;
 
-	s = gen_llprefixlen();
+	s = gen_off_macpl();
 	if (s != NULL) {
 		/*
 		 * There's a variable-length prefix preceding the
-		 * link-layer header.  "s" points to a list of statements
-		 * that put the length of that prefix into the X register.
+		 * link-layer header, or the link-layer header is itself
+		 * variable-length.  "s" points to a list of statements
+		 * that put the offset of the MAC-layer payload into
+		 * the X register.
+		 *
 		 * The 4*([k]&0xf) addressing mode can't be used, as we
 		 * don't have a constant offset, so we have to load the
 		 * value in question into the A register and add to it
@@ -1461,22 +1693,24 @@ gen_loadx_iphdrlen()
 
 		/*
 		 * The A register now contains the length of the
-		 * IP header.  We need to add to it the length
-		 * of the prefix preceding the link-layer
-		 * header, which is still in the X register, and
-		 * move the result into the X register.
+		 * IP header.  We need to add to it the offset of
+		 * the MAC-layer payload, which is still in the X
+		 * register, and move the result into the X register.
 		 */
 		sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
 		sappend(s, new_stmt(BPF_MISC|BPF_TAX));
 	} else {
 		/*
 		 * There is no variable-length header preceding the
-		 * link-layer header; add in off_ll, which, if there's
-		 * a fixed-length header preceding the link-layer header,
-		 * is the length of that header.
+		 * link-layer header, and the link-layer header is
+		 * fixed-length; load the length of the IPv4 header,
+		 * which is at an offset of off_nl from the beginning
+		 * of the MAC-layer payload, and thus at an offset
+		 * of off_mac_pl + off_nl from the beginning of the
+		 * raw packet data.
 		 */
 		s = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
-		s->s.k = off_ll + off_nl;
+		s->s.k = off_macpl + off_nl;
 	}
 	return s;
 }
@@ -1550,7 +1784,7 @@ gen_ether_linktype(proto)
 		 */
 		b0 = gen_cmp_gt(OR_LINK, off_linktype, BPF_H, ETHERMTU);
 		gen_not(b0);
-		b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32)
+		b1 = gen_cmp(OR_MACPL, 0, BPF_H, (bpf_int32)
 			     ((proto << 8) | proto));
 		gen_and(b0, b1);
 		return b1;
@@ -1588,17 +1822,15 @@ gen_ether_linktype(proto)
 		 * This generates code to check both for the
 		 * IPX LSAP (Ethernet_802.2) and for Ethernet_802.3.
 		 */
-		b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B,
-		    (bpf_int32)LLCSAP_IPX);
-		b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H,
-		    (bpf_int32)0xFFFF);
+		b0 = gen_cmp(OR_MACPL, 0, BPF_B, (bpf_int32)LLCSAP_IPX);
+		b1 = gen_cmp(OR_MACPL, 0, BPF_H, (bpf_int32)0xFFFF);
 		gen_or(b0, b1);
 
 		/*
 		 * Now we add code to check for SNAP frames with
 		 * ETHERTYPE_IPX, i.e. Ethernet_SNAP.
 		 */
-		b0 = gen_snap(0x000000, ETHERTYPE_IPX, 14);
+		b0 = gen_snap(0x000000, ETHERTYPE_IPX);
 		gen_or(b0, b1);
 
 		/*
@@ -1653,9 +1885,9 @@ gen_ether_linktype(proto)
 		 * type of ETHERTYPE_AARP (Appletalk ARP).
 		 */
 		if (proto == ETHERTYPE_ATALK)
-			b1 = gen_snap(0x080007, ETHERTYPE_ATALK, 14);
+			b1 = gen_snap(0x080007, ETHERTYPE_ATALK);
 		else	/* proto == ETHERTYPE_AARP */
-			b1 = gen_snap(0x000000, ETHERTYPE_AARP, 14);
+			b1 = gen_snap(0x000000, ETHERTYPE_AARP);
 		gen_and(b0, b1);
 
 		/*
@@ -1732,7 +1964,7 @@ gen_linux_sll_linktype(proto)
 		 * (i.e., other SAP values)?
 		 */
 		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2);
-		b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_H, (bpf_int32)
+		b1 = gen_cmp(OR_MACPL, 0, BPF_H, (bpf_int32)
 			     ((proto << 8) | proto));
 		gen_and(b0, b1);
 		return b1;
@@ -1763,10 +1995,8 @@ gen_linux_sll_linktype(proto)
 		 * then put a check for LINUX_SLL_P_802_2 frames
 		 * before it.
 		 */
-		b0 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B,
-		    (bpf_int32)LLCSAP_IPX);
-		b1 = gen_snap(0x000000, ETHERTYPE_IPX,
-		    off_linktype + 2);
+		b0 = gen_cmp(OR_MACPL, 0, BPF_B, (bpf_int32)LLCSAP_IPX);
+		b1 = gen_snap(0x000000, ETHERTYPE_IPX);
 		gen_or(b0, b1);
 		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, LINUX_SLL_P_802_2);
 		gen_and(b0, b1);
@@ -1814,11 +2044,9 @@ gen_linux_sll_linktype(proto)
 		 * type of ETHERTYPE_AARP (Appletalk ARP).
 		 */
 		if (proto == ETHERTYPE_ATALK)
-			b1 = gen_snap(0x080007, ETHERTYPE_ATALK,
-			    off_linktype + 2);
+			b1 = gen_snap(0x080007, ETHERTYPE_ATALK);
 		else	/* proto == ETHERTYPE_AARP */
-			b1 = gen_snap(0x000000, ETHERTYPE_AARP,
-			    off_linktype + 2);
+			b1 = gen_snap(0x000000, ETHERTYPE_AARP);
 		gen_and(b0, b1);
 
 		/*
@@ -1842,7 +2070,7 @@ gen_linux_sll_linktype(proto)
 			 */
 			b0 = gen_cmp(OR_LINK, off_linktype, BPF_H,
 			    LINUX_SLL_P_802_2);
-			b1 = gen_cmp(OR_LINK, off_linktype + 2, BPF_B,
+			b1 = gen_cmp(OR_LINK, off_macpl, BPF_B,
 			     (bpf_int32)proto);
 			gen_and(b0, b1);
 			return b1;
@@ -1862,18 +2090,169 @@ gen_linux_sll_linktype(proto)
 	}
 }
 
-static void
-insert_radiotap_load_llprefixlen(b)
-	struct block *b;
+static struct slist *
+gen_load_prism_llprefixlen()
 {
 	struct slist *s1, *s2;
+	struct slist *sjeq_avs_cookie;
+	struct slist *sjcommon;
+
+	/*
+	 * This code is not compatible with the optimizer, as
+	 * we are generating jmp instructions within a normal
+	 * slist of instructions
+	 */
+	no_optimize = 1;
 
 	/*
-	 * Prepend to the statements in this block code to load the
-	 * length of the radiotap header into the register assigned
-	 * to hold that length, if one has been assigned.
+	 * Generate code to load the length of the radio header into
+	 * the register assigned to hold that length, if one has been
+	 * assigned.  (If one hasn't been assigned, no code we've
+	 * generated uses that prefix, so we don't need to generate any
+	 * code to load it.)
+	 *
+	 * Some Linux drivers use ARPHRD_IEEE80211_PRISM but sometimes
+	 * or always use the AVS header rather than the Prism header.
+	 * We load a 4-byte big-endian value at the beginning of the
+	 * raw packet data, and see whether, when masked with 0xFFFFF000,
+	 * it's equal to 0x80211000.  If so, that indicates that it's
+	 * an AVS header (the masked-out bits are the version number).
+	 * Otherwise, it's a Prism header.
+	 *
+	 * XXX - the Prism header is also, in theory, variable-length,
+	 * but no known software generates headers that aren't 144
+	 * bytes long.
 	 */
-	if (reg_ll_size != -1) {
+	if (reg_off_ll != -1) {
+		/*
+		 * Load the cookie.
+		 */
+		s1 = new_stmt(BPF_LD|BPF_W|BPF_ABS);
+		s1->s.k = 0;
+
+		/*
+		 * AND it with 0xFFFFF000.
+		 */
+		s2 = new_stmt(BPF_ALU|BPF_AND|BPF_K);
+		s2->s.k = 0xFFFFF000;
+		sappend(s1, s2);
+
+		/*
+		 * Compare with 0x80211000.
+		 */
+		sjeq_avs_cookie = new_stmt(JMP(BPF_JEQ));
+		sjeq_avs_cookie->s.k = 0x80211000;
+		sappend(s1, sjeq_avs_cookie);
+
+		/*
+		 * If it's AVS:
+		 *
+		 * The 4 bytes at an offset of 4 from the beginning of
+		 * the AVS header are the length of the AVS header.
+		 * That field is big-endian.
+		 */
+		s2 = new_stmt(BPF_LD|BPF_W|BPF_ABS);
+		s2->s.k = 4;
+		sappend(s1, s2);
+		sjeq_avs_cookie->s.jt = s2;
+
+		/*
+		 * Now jump to the code to allocate a register
+		 * into which to save the header length and
+		 * store the length there.  (The "jump always"
+		 * instruction needs to have the k field set;
+		 * it's added to the PC, so, as we're jumping
+		 * over a single instruction, it should be 1.)
+		 */
+		sjcommon = new_stmt(JMP(BPF_JA));
+		sjcommon->s.k = 1;
+		sappend(s1, sjcommon);
+
+		/*
+		 * Now for the code that handles the Prism header.
+		 * Just load the length of the Prism header (144)
+		 * into the A register.  Have the test for an AVS
+		 * header branch here if we don't have an AVS header.
+		 */
+		s2 = new_stmt(BPF_LD|BPF_W|BPF_IMM);
+		s2->s.k = 144;
+		sappend(s1, s2);
+		sjeq_avs_cookie->s.jf = s2;
+
+		/*
+		 * Now allocate a register to hold that value and store
+		 * it.  The code for the AVS header will jump here after
+		 * loading the length of the AVS header.
+		 */
+		s2 = new_stmt(BPF_ST);
+		s2->s.k = reg_off_ll;
+		sappend(s1, s2);
+		sjcommon->s.jf = s2;
+
+		/*
+		 * Now move it into the X register.
+		 */
+		s2 = new_stmt(BPF_MISC|BPF_TAX);
+		sappend(s1, s2);
+
+		return (s1);
+	} else
+		return (NULL);
+}
+
+static struct slist *
+gen_load_avs_llprefixlen()
+{
+	struct slist *s1, *s2;
+
+	/*
+	 * Generate code to load the length of the AVS header into
+	 * the register assigned to hold that length, if one has been
+	 * assigned.  (If one hasn't been assigned, no code we've
+	 * generated uses that prefix, so we don't need to generate any
+	 * code to load it.)
+	 */
+	if (reg_off_ll != -1) {
+		/*
+		 * The 4 bytes at an offset of 4 from the beginning of
+		 * the AVS header are the length of the AVS header.
+		 * That field is big-endian.
+		 */
+		s1 = new_stmt(BPF_LD|BPF_W|BPF_ABS);
+		s1->s.k = 4;
+
+		/*
+		 * Now allocate a register to hold that value and store
+		 * it.
+		 */
+		s2 = new_stmt(BPF_ST);
+		s2->s.k = reg_off_ll;
+		sappend(s1, s2);
+
+		/*
+		 * Now move it into the X register.
+		 */
+		s2 = new_stmt(BPF_MISC|BPF_TAX);
+		sappend(s1, s2);
+
+		return (s1);
+	} else
+		return (NULL);
+}
+
+static struct slist *
+gen_load_radiotap_llprefixlen()
+{
+	struct slist *s1, *s2;
+
+	/*
+	 * Generate code to load the length of the radiotap header into
+	 * the register assigned to hold that length, if one has been
+	 * assigned.  (If one hasn't been assigned, no code we've
+	 * generated uses that prefix, so we don't need to generate any
+	 * code to load it.)
+	 */
+	if (reg_off_ll != -1) {
 		/*
 		 * The 2 bytes at offsets of 2 and 3 from the beginning
 		 * of the radiotap header are the length of the radiotap
@@ -1908,7 +2287,7 @@ insert_radiotap_load_llprefixlen(b)
 		 * it.
 		 */
 		s2 = new_stmt(BPF_ST);
-		s2->s.k = reg_ll_size;
+		s2->s.k = reg_off_ll;
 		sappend(s1, s2);
 
 		/*
@@ -1917,13 +2296,9 @@ insert_radiotap_load_llprefixlen(b)
 		s2 = new_stmt(BPF_MISC|BPF_TAX);
 		sappend(s1, s2);
 
-		/*
-		 * Now append all the existing statements in this
-		 * block to these statements.
-		 */
-		sappend(s1, b->stmts);
-		b->stmts = s1;
-	}
+		return (s1);
+	} else
+		return (NULL);
 }
 
 /* 
@@ -1932,21 +2307,21 @@ insert_radiotap_load_llprefixlen(b)
  * the code at the beginning to compute the header length.
  * Since this code generator of PPI supports bare 802.11
  * encapsulation only (i.e. the encapsulated DLT should be
- * DLT_IEEE802_11) we generate code to check for this too.
+ * DLT_IEEE802_11) we generate code to check for this too;
+ * that's done in finish_parse().
  */
-static void
-insert_ppi_load_llprefixlen(b)
-	struct block *b;
+static struct slist *
+gen_load_ppi_llprefixlen()
 {
 	struct slist *s1, *s2;
 	
 	/*
-	 * Prepend to the statements in this block code to load the
-	 * length of the radiotap header into the register assigned
-	 * to hold that length, if one has been assigned.
+	 * Generate code to load the length of the radiotap header
+	 * into the register assigned to hold that length, if one has
+	 * been assigned.
 	 */
-	if (reg_ll_size != -1) {
-	    /*
+	if (reg_off_ll != -1) {
+		/*
 		 * The 2 bytes at offsets of 2 and 3 from the beginning
 		 * of the radiotap header are the length of the radiotap
 		 * header; unfortunately, it's little-endian, so we have
@@ -1980,7 +2355,7 @@ insert_ppi_load_llprefixlen(b)
 		 * it.
 		 */
 		s2 = new_stmt(BPF_ST);
-		s2->s.k = reg_ll_size;
+		s2->s.k = reg_off_ll;
 		sappend(s1, s2);
 
 		/*
@@ -1989,16 +2364,295 @@ insert_ppi_load_llprefixlen(b)
 		s2 = new_stmt(BPF_MISC|BPF_TAX);
 		sappend(s1, s2);
 
+		return (s1);
+	} else
+		return (NULL);
+}
+
+/*
+ * Load a value relative to the beginning of the link-layer header after the 802.11
+ * header, i.e. LLC_SNAP.
+ * The link-layer header doesn't necessarily begin at the beginning
+ * of the packet data; there might be a variable-length prefix containing
+ * radio information.
+ */
+static struct slist *
+gen_load_802_11_header_len(struct slist *s, struct slist *snext)
+{
+	struct slist *s2;
+	struct slist *sjset_data_frame_1;
+	struct slist *sjset_data_frame_2;
+	struct slist *sjset_qos;
+	struct slist *sjset_radiotap_flags;
+	struct slist *sjset_radiotap_tsft;
+	struct slist *sjset_tsft_datapad, *sjset_notsft_datapad;
+	struct slist *s_roundup;
+
+	if (reg_off_macpl == -1) {
 		/*
-		 * Now append all the existing statements in this
-		 * block to these statements.
+		 * No register has been assigned to the offset of
+		 * the MAC-layer payload, which means nobody needs
+		 * it; don't bother computing it - just return
+		 * what we already have.
 		 */
-		sappend(s1, b->stmts);
-		b->stmts = s1;
+		return (s);
+	}
 
+	/*
+	 * This code is not compatible with the optimizer, as
+	 * we are generating jmp instructions within a normal
+	 * slist of instructions
+	 */
+	no_optimize = 1;
+	
+	/*
+	 * If "s" is non-null, it has code to arrange that the X register
+	 * contains the length of the prefix preceding the link-layer
+	 * header.
+	 *
+	 * Otherwise, the length of the prefix preceding the link-layer
+	 * header is "off_ll".
+	 */
+	if (s == NULL) {
+		/*
+		 * There is no variable-length header preceding the
+		 * link-layer header.
+		 *
+		 * Load the length of the fixed-length prefix preceding
+		 * the link-layer header (if any) into the X register,
+		 * and store it in the reg_off_macpl register.
+		 * That length is off_ll.
+		 */
+		s = new_stmt(BPF_LDX|BPF_IMM);
+		s->s.k = off_ll;
 	}
+
+	/*
+	 * The X register contains the offset of the beginning of the
+	 * link-layer header; add 24, which is the minimum length
+	 * of the MAC header for a data frame, to that, and store it
+	 * in reg_off_macpl, and then load the Frame Control field,
+	 * which is at the offset in the X register, with an indexed load.
+	 */
+	s2 = new_stmt(BPF_MISC|BPF_TXA);
+	sappend(s, s2);
+	s2 = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
+	s2->s.k = 24;
+	sappend(s, s2);
+	s2 = new_stmt(BPF_ST);
+	s2->s.k = reg_off_macpl;
+	sappend(s, s2);
+
+	s2 = new_stmt(BPF_LD|BPF_IND|BPF_B);
+	s2->s.k = 0;
+	sappend(s, s2);
+
+	/*
+	 * Check the Frame Control field to see if this is a data frame;
+	 * a data frame has the 0x08 bit (b3) in that field set and the
+	 * 0x04 bit (b2) clear.
+	 */
+	sjset_data_frame_1 = new_stmt(JMP(BPF_JSET));
+	sjset_data_frame_1->s.k = 0x08;
+	sappend(s, sjset_data_frame_1);
+		
+	/*
+	 * If b3 is set, test b2, otherwise go to the first statement of
+	 * the rest of the program.
+	 */
+	sjset_data_frame_1->s.jt = sjset_data_frame_2 = new_stmt(JMP(BPF_JSET));
+	sjset_data_frame_2->s.k = 0x04;
+	sappend(s, sjset_data_frame_2);
+	sjset_data_frame_1->s.jf = snext;
+
+	/*
+	 * If b2 is not set, this is a data frame; test the QoS bit.
+	 * Otherwise, go to the first statement of the rest of the
+	 * program.
+	 */
+	sjset_data_frame_2->s.jt = snext;
+	sjset_data_frame_2->s.jf = sjset_qos = new_stmt(JMP(BPF_JSET));
+	sjset_qos->s.k = 0x80;	/* QoS bit */
+	sappend(s, sjset_qos);
+		
+	/*
+	 * If it's set, add 2 to reg_off_macpl, to skip the QoS
+	 * field.
+	 * Otherwise, go to the first statement of the rest of the
+	 * program.
+	 */
+	sjset_qos->s.jt = s2 = new_stmt(BPF_LD|BPF_MEM);
+	s2->s.k = reg_off_macpl;
+	sappend(s, s2);
+	s2 = new_stmt(BPF_ALU|BPF_ADD|BPF_IMM);
+	s2->s.k = 2;
+	sappend(s, s2);
+	s2 = new_stmt(BPF_ST);
+	s2->s.k = reg_off_macpl;
+	sappend(s, s2);
+
+	/*
+	 * If we have a radiotap header, look at it to see whether
+	 * there's Atheros padding between the MAC-layer header
+	 * and the payload.
+	 *
+	 * Note: all of the fields in the radiotap header are
+	 * little-endian, so we byte-swap all of the values
+	 * we test against, as they will be loaded as big-endian
+	 * values.
+	 */
+	if (linktype == DLT_IEEE802_11_RADIO) {
+		/*
+		 * Is the IEEE80211_RADIOTAP_FLAGS bit (0x0000002) set
+		 * in the presence flag?
+		 */
+		sjset_qos->s.jf = s2 = new_stmt(BPF_LD|BPF_ABS|BPF_W);
+		s2->s.k = 4;
+		sappend(s, s2);
+
+		sjset_radiotap_flags = new_stmt(JMP(BPF_JSET));
+		sjset_radiotap_flags->s.k = SWAPLONG(0x00000002);
+		sappend(s, sjset_radiotap_flags);
+
+		/*
+		 * If not, skip all of this.
+		 */
+		sjset_radiotap_flags->s.jf = snext;
+
+		/*
+		 * Otherwise, is the IEEE80211_RADIOTAP_TSFT bit set?
+		 */
+		sjset_radiotap_tsft = sjset_radiotap_flags->s.jt =
+		    new_stmt(JMP(BPF_JSET));
+		sjset_radiotap_tsft->s.k = SWAPLONG(0x00000001);
+		sappend(s, sjset_radiotap_tsft);
+
+		/*
+		 * If IEEE80211_RADIOTAP_TSFT is set, the flags field is
+		 * at an offset of 16 from the beginning of the raw packet
+		 * data (8 bytes for the radiotap header and 8 bytes for
+		 * the TSFT field).
+		 *
+		 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
+		 * is set.
+		 */
+		sjset_radiotap_tsft->s.jt = s2 = new_stmt(BPF_LD|BPF_ABS|BPF_B);
+		s2->s.k = 16;
+		sappend(s, s2);
+
+		sjset_tsft_datapad = new_stmt(JMP(BPF_JSET));
+		sjset_tsft_datapad->s.k = 0x20;
+		sappend(s, sjset_tsft_datapad);
+
+		/*
+		 * If IEEE80211_RADIOTAP_TSFT is not set, the flags field is
+		 * at an offset of 8 from the beginning of the raw packet
+		 * data (8 bytes for the radiotap header).
+		 *
+		 * Test whether the IEEE80211_RADIOTAP_F_DATAPAD bit (0x20)
+		 * is set.
+		 */
+		sjset_radiotap_tsft->s.jf = s2 = new_stmt(BPF_LD|BPF_ABS|BPF_B);
+		s2->s.k = 8;
+		sappend(s, s2);
+
+		sjset_notsft_datapad = new_stmt(JMP(BPF_JSET));
+		sjset_notsft_datapad->s.k = 0x20;
+		sappend(s, sjset_notsft_datapad);
+
+		/*
+		 * In either case, if IEEE80211_RADIOTAP_F_DATAPAD is
+		 * set, round the length of the 802.11 header to
+		 * a multiple of 4.  Do that by adding 3 and then
+		 * dividing by and multiplying by 4, which we do by
+		 * ANDing with ~3.
+		 */
+		s_roundup = new_stmt(BPF_LD|BPF_MEM);
+		s_roundup->s.k = reg_off_macpl;
+		sappend(s, s_roundup);
+		s2 = new_stmt(BPF_ALU|BPF_ADD|BPF_IMM);
+		s2->s.k = 3;
+		sappend(s, s2);
+		s2 = new_stmt(BPF_ALU|BPF_AND|BPF_IMM);
+		s2->s.k = ~3;
+		sappend(s, s2);
+		s2 = new_stmt(BPF_ST);
+		s2->s.k = reg_off_macpl;
+		sappend(s, s2);
+
+		sjset_tsft_datapad->s.jt = s_roundup;
+		sjset_tsft_datapad->s.jf = snext;
+		sjset_notsft_datapad->s.jt = s_roundup;
+		sjset_notsft_datapad->s.jf = snext;
+	} else
+		sjset_qos->s.jf = snext;
+
+	return s;
 }
-	
+
+static void
+insert_compute_vloffsets(b)
+	struct block *b;
+{
+	struct slist *s;
+
+	/*
+	 * For link-layer types that have a variable-length header
+	 * preceding the link-layer header, generate code to load
+	 * the offset of the link-layer header into the register
+	 * assigned to that offset, if any.
+	 */
+	switch (linktype) {
+
+	case DLT_PRISM_HEADER:
+		s = gen_load_prism_llprefixlen();
+		break;
+
+	case DLT_IEEE802_11_RADIO_AVS:
+		s = gen_load_avs_llprefixlen();
+		break;
+
+	case DLT_IEEE802_11_RADIO:
+		s = gen_load_radiotap_llprefixlen();
+		break;
+
+	case DLT_PPI:
+		s = gen_load_ppi_llprefixlen();
+		break;
+
+	default:
+		s = NULL;
+		break;
+	}
+
+	/*
+	 * For link-layer types that have a variable-length link-layer
+	 * header, generate code to load the offset of the MAC-layer
+	 * payload into the register assigned to that offset, if any.
+	 */
+	switch (linktype) {
+
+	case DLT_IEEE802_11:
+	case DLT_PRISM_HEADER:
+	case DLT_IEEE802_11_RADIO_AVS:
+	case DLT_IEEE802_11_RADIO:
+	case DLT_PPI:
+		s = gen_load_802_11_header_len(s, b->stmts);
+		break;
+	}
+
+	/*
+	 * If we have any offset-loading code, append all the
+	 * existing statements in the block to those statements,
+	 * and make the resulting list the list of statements
+	 * for the block.
+	 */
+	if (s != NULL) {
+		sappend(s, b->stmts);
+		b->stmts = s;
+	}
+}
+
 static struct block *
 gen_ppi_dlt_check(void)
 {
@@ -2025,42 +2679,61 @@ gen_ppi_dlt_check(void)
 	return b;
 }
 
-static void
-insert_load_llprefixlen(b)
-	struct block *b;
+static struct slist *
+gen_prism_llprefixlen(void)
 {
-	switch (linktype) {
+	struct slist *s;
+
+	if (reg_off_ll == -1) {
+		/*
+		 * We haven't yet assigned a register for the length
+		 * of the radio header; allocate one.
+		 */
+		reg_off_ll = alloc_reg();
+	}
 
-	/* 
-	 * At the moment we treat PPI as normal Radiotap encoded
-	 * packets. The difference is in the function that generates
-	 * the code at the beginning to compute the header length.
-	 * Since this code generator of PPI supports bare 802.11
-	 * encapsulation only (i.e. the encapsulated DLT should be
-	 * DLT_IEEE802_11) we generate code to check for this too.
+	/*
+	 * Load the register containing the radio length
+	 * into the X register.
 	 */
-	case DLT_PPI:
-		insert_ppi_load_llprefixlen(b);
-		break;
+	s = new_stmt(BPF_LDX|BPF_MEM);
+	s->s.k = reg_off_ll;
+	return s;
+}
 
-	case DLT_IEEE802_11_RADIO:
-		insert_radiotap_load_llprefixlen(b);
-		break;
+static struct slist *
+gen_avs_llprefixlen(void)
+{
+	struct slist *s;
+
+	if (reg_off_ll == -1) {
+		/*
+		 * We haven't yet assigned a register for the length
+		 * of the AVS header; allocate one.
+		 */
+		reg_off_ll = alloc_reg();
 	}
-}
 
+	/*
+	 * Load the register containing the AVS length
+	 * into the X register.
+	 */
+	s = new_stmt(BPF_LDX|BPF_MEM);
+	s->s.k = reg_off_ll;
+	return s;
+}
 
 static struct slist *
 gen_radiotap_llprefixlen(void)
 {
 	struct slist *s;
 
-	if (reg_ll_size == -1) {
+	if (reg_off_ll == -1) {
 		/*
 		 * We haven't yet assigned a register for the length
 		 * of the radiotap header; allocate one.
 		 */
-		reg_ll_size = alloc_reg();
+		reg_off_ll = alloc_reg();
 	}
 
 	/*
@@ -2068,7 +2741,7 @@ gen_radiotap_llprefixlen(void)
 	 * into the X register.
 	 */
 	s = new_stmt(BPF_LDX|BPF_MEM);
-	s->s.k = reg_ll_size;
+	s->s.k = reg_off_ll;
 	return s;
 }
 
@@ -2085,25 +2758,23 @@ gen_ppi_llprefixlen(void)
 {
 	struct slist *s;
 
-	if (reg_ll_size == -1) {
+	if (reg_off_ll == -1) {
 		/*
 		 * We haven't yet assigned a register for the length
 		 * of the radiotap header; allocate one.
 		 */
-		reg_ll_size = alloc_reg();
+		reg_off_ll = alloc_reg();
 	}
 
 	/*
-	 * Load the register containing the radiotap length
+	 * Load the register containing the PPI length
 	 * into the X register.
 	 */
 	s = new_stmt(BPF_LDX|BPF_MEM);
-	s->s.k = reg_ll_size;
+	s->s.k = reg_off_ll;
 	return s;
 }
 
-
-
 /*
  * Generate code to compute the link-layer header length, if necessary,
  * putting it into the X register, and to return either a pointer to a
@@ -2115,19 +2786,110 @@ gen_llprefixlen(void)
 {
 	switch (linktype) {
 
-	case DLT_PPI:
-		return gen_ppi_llprefixlen();
+	case DLT_PRISM_HEADER:
+		return gen_prism_llprefixlen();
+
+	case DLT_IEEE802_11_RADIO_AVS:
+		return gen_avs_llprefixlen();
 
-	
 	case DLT_IEEE802_11_RADIO:
 		return gen_radiotap_llprefixlen();
 
+	case DLT_PPI:
+		return gen_ppi_llprefixlen();
+
 	default:
 		return NULL;
 	}
 }
 
 /*
+ * Generate code to load the register containing the offset of the
+ * MAC-layer payload into the X register; if no register for that offset
+ * has been allocated, allocate it first.
+ */
+static struct slist *
+gen_off_macpl(void)
+{
+	struct slist *s;
+
+	if (off_macpl_is_variable) {
+		if (reg_off_macpl == -1) {
+			/*
+			 * We haven't yet assigned a register for the offset
+			 * of the MAC-layer payload; allocate one.
+			 */
+			reg_off_macpl = alloc_reg();
+		}
+
+		/*
+		 * Load the register containing the offset of the MAC-layer
+		 * payload into the X register.
+		 */
+		s = new_stmt(BPF_LDX|BPF_MEM);
+		s->s.k = reg_off_macpl;
+		return s;
+	} else {
+		/*
+		 * That offset isn't variable, so we don't need to
+		 * generate any code.
+		 */
+		return NULL;
+	}
+}
+
+/*
+ * Map an Ethernet type to the equivalent PPP type.
+ */
+static int
+ethertype_to_ppptype(proto)
+	int proto;
+{
+	switch (proto) {
+
+	case ETHERTYPE_IP:
+		proto = PPP_IP;
+		break;
+
+#ifdef INET6
+	case ETHERTYPE_IPV6:
+		proto = PPP_IPV6;
+		break;
+#endif
+
+	case ETHERTYPE_DN:
+		proto = PPP_DECNET;
+		break;
+
+	case ETHERTYPE_ATALK:
+		proto = PPP_APPLE;
+		break;
+
+	case ETHERTYPE_NS:
+		proto = PPP_NS;
+		break;
+
+	case LLCSAP_ISONS:
+		proto = PPP_OSI;
+		break;
+
+	case LLCSAP_8021D:
+		/*
+		 * I'm assuming the "Bridging PDU"s that go
+		 * over PPP are Spanning Tree Protocol
+		 * Bridging PDUs.
+		 */
+		proto = PPP_BRPDU;
+		break;
+
+	case LLCSAP_IPX:
+		proto = PPP_IPX;
+		break;
+	}
+	return (proto);
+}
+
+/*
  * Generate code to match a particular packet type by matching the
  * link-layer type field or fields in the 802.2 LLC header.
  *
@@ -2145,12 +2907,12 @@ gen_linktype(proto)
 		switch (proto) {
 		case ETHERTYPE_IP:
 		case PPP_IP:
-		/* FIXME add other L3 proto IDs */
+			/* FIXME add other L3 proto IDs */
 			return gen_mpls_linktype(Q_IP); 
 
 		case ETHERTYPE_IPV6:
 		case PPP_IPV6:
-		/* FIXME add other L3 proto IDs */
+			/* FIXME add other L3 proto IDs */
 			return gen_mpls_linktype(Q_IPV6); 
 
 		default:
@@ -2159,6 +2921,25 @@ gen_linktype(proto)
 		}
 	}
 
+	/*
+	 * Are we testing PPPoE packets?
+	 */
+	if (is_pppoes) {
+		/*
+		 * The PPPoE session header is part of the
+		 * MAC-layer payload, so all references
+		 * should be relative to the beginning of
+		 * that payload.
+		 */
+
+		/*
+		 * We use Ethernet protocol types inside libpcap;
+		 * map them to the corresponding PPP protocol types.
+		 */
+		proto = ethertype_to_ppptype(proto);
+		return gen_cmp(OR_MACPL, off_linktype, BPF_H, (bpf_int32)proto);
+	}
+
 	switch (linktype) {
 
 	case DLT_EN10MB:
@@ -2181,13 +2962,41 @@ gen_linktype(proto)
 		}
 		break;
 
-	case DLT_PPI:
-	case DLT_FDDI:
-	case DLT_IEEE802:
 	case DLT_IEEE802_11:
+	case DLT_PRISM_HEADER:
 	case DLT_IEEE802_11_RADIO_AVS:
 	case DLT_IEEE802_11_RADIO:
-	case DLT_PRISM_HEADER:
+	case DLT_PPI:
+		/*
+		 * Check that we have a data frame.
+		 */
+		b0 = gen_check_802_11_data_frame();
+
+		/*
+		 * Now check for the specified link-layer type.
+		 */
+		b1 = gen_llc_linktype(proto);
+		gen_and(b0, b1);
+		return b1;
+		/*NOTREACHED*/
+		break;
+
+	case DLT_FDDI:
+		/*
+		 * XXX - check for asynchronous frames, as per RFC 1103.
+		 */
+		return gen_llc_linktype(proto);
+		/*NOTREACHED*/
+		break;
+
+	case DLT_IEEE802:
+		/*
+		 * XXX - check for LLC PDUs, as per IEEE 802.5.
+		 */
+		return gen_llc_linktype(proto);
+		/*NOTREACHED*/
+		break;
+
 	case DLT_ATM_RFC1483:
 	case DLT_ATM_CLIP:
 	case DLT_IP_OVER_FC:
@@ -2272,47 +3081,9 @@ gen_linktype(proto)
 		 * We use Ethernet protocol types inside libpcap;
 		 * map them to the corresponding PPP protocol types.
 		 */
-		switch (proto) {
-
-		case ETHERTYPE_IP:
-			proto = PPP_IP;
-			break;
-
-#ifdef INET6
-		case ETHERTYPE_IPV6:
-			proto = PPP_IPV6;
-			break;
-#endif
-
-		case ETHERTYPE_DN:
-			proto = PPP_DECNET;
-			break;
-
-		case ETHERTYPE_ATALK:
-			proto = PPP_APPLE;
-			break;
-
-		case ETHERTYPE_NS:
-			proto = PPP_NS;
-			break;
-
-		case LLCSAP_ISONS:
-			proto = PPP_OSI;
-			break;
-
-		case LLCSAP_8021D:
-			/*
-			 * I'm assuming the "Bridging PDU"s that go
-			 * over PPP are Spanning Tree Protocol
-			 * Bridging PDUs.
-			 */
-			proto = PPP_BRPDU;
-			break;
-
-		case LLCSAP_IPX:
-			proto = PPP_IPX;
-			break;
-		}
+		proto = ethertype_to_ppptype(proto);
+		return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto);
+		/*NOTREACHED*/
 		break;
 
 	case DLT_PPP_BSDOS:
@@ -2323,6 +3094,10 @@ gen_linktype(proto)
 		switch (proto) {
 
 		case ETHERTYPE_IP:
+			/*
+			 * Also check for Van Jacobson-compressed IP.
+			 * XXX - do this for other forms of PPP?
+			 */
 			b0 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_IP);
 			b1 = gen_cmp(OR_LINK, off_linktype, BPF_H, PPP_VJC);
 			gen_or(b0, b1);
@@ -2330,42 +3105,12 @@ gen_linktype(proto)
 			gen_or(b1, b0);
 			return b0;
 
-#ifdef INET6
-		case ETHERTYPE_IPV6:
-			proto = PPP_IPV6;
-			/* more to go? */
-			break;
-#endif
-
-		case ETHERTYPE_DN:
-			proto = PPP_DECNET;
-			break;
-
-		case ETHERTYPE_ATALK:
-			proto = PPP_APPLE;
-			break;
-
-		case ETHERTYPE_NS:
-			proto = PPP_NS;
-			break;
-
-		case LLCSAP_ISONS:
-			proto = PPP_OSI;
-			break;
-
-		case LLCSAP_8021D:
-			/*
-			 * I'm assuming the "Bridging PDU"s that go
-			 * over PPP are Spanning Tree Protocol
-			 * Bridging PDUs.
-			 */
-			proto = PPP_BRPDU;
-			break;
-
-		case LLCSAP_IPX:
-			proto = PPP_IPX;
-			break;
+		default:
+			proto = ethertype_to_ppptype(proto);
+			return gen_cmp(OR_LINK, off_linktype, BPF_H,
+				(bpf_int32)proto);
 		}
+		/*NOTREACHED*/
 		break;
 
 	case DLT_NULL:
@@ -2554,6 +3299,9 @@ gen_linktype(proto)
 		/*NOTREACHED*/
 		break;
 
+	case DLT_MFR:
+		bpf_error("Multi-link Frame Relay link-layer type filtering not implemented");
+
         case DLT_JUNIPER_MFR:
         case DLT_JUNIPER_MLFR:
         case DLT_JUNIPER_MLPPP:
@@ -2570,6 +3318,8 @@ gen_linktype(proto)
         case DLT_JUNIPER_FRELAY:
         case DLT_JUNIPER_CHDLC:
         case DLT_JUNIPER_VP:
+        case DLT_JUNIPER_ST:
+        case DLT_JUNIPER_ISM:
 		/* just lets verify the magic number for now -
 		 * on ATM we may have up to 6 different encapsulations on the wire
 		 * and need a lot of heuristics to figure out that the payload
@@ -2585,8 +3335,51 @@ gen_linktype(proto)
 	case DLT_DOCSIS:
 		bpf_error("DOCSIS link-layer type filtering not implemented");
 
+	case DLT_MTP2:
+	case DLT_MTP2_WITH_PHDR:
+		bpf_error("MTP2 link-layer type filtering not implemented");
+
+	case DLT_ERF:
+		bpf_error("ERF link-layer type filtering not implemented");
+
+#ifdef DLT_PFSYNC
+	case DLT_PFSYNC:
+		bpf_error("PFSYNC link-layer type filtering not implemented");
+#endif
+
 	case DLT_LINUX_LAPD:
 		bpf_error("LAPD link-layer type filtering not implemented");
+
+	case DLT_USB:
+	case DLT_USB_LINUX:
+		bpf_error("USB link-layer type filtering not implemented");
+
+	case DLT_BLUETOOTH_HCI_H4:
+	case DLT_BLUETOOTH_HCI_H4_WITH_PHDR:
+		bpf_error("Bluetooth link-layer type filtering not implemented");
+
+	case DLT_CAN20B:
+		bpf_error("CAN20B link-layer type filtering not implemented");
+
+	case DLT_IEEE802_15_4:
+	case DLT_IEEE802_15_4_LINUX:
+	case DLT_IEEE802_15_4_NONASK_PHY:
+		bpf_error("IEEE 802.15.4 link-layer type filtering not implemented");
+
+	case DLT_IEEE802_16_MAC_CPS_RADIO:
+		bpf_error("IEEE 802.16 link-layer type filtering not implemented");
+
+	case DLT_SITA:
+		bpf_error("SITA link-layer type filtering not implemented");
+
+	case DLT_RAIF1:
+		bpf_error("RAIF1 link-layer type filtering not implemented");
+
+	case DLT_IPMB:
+		bpf_error("IPMB link-layer type filtering not implemented");
+
+	case DLT_AX25_KISS:
+		bpf_error("AX.25 link-layer type filtering not implemented");
 	}
 
 	/*
@@ -2604,12 +3397,7 @@ gen_linktype(proto)
 
 	/*
 	 * Any type not handled above should always have an Ethernet
-	 * type at an offset of "off_linktype".  (PPP is partially
-	 * handled above - the protocol type is mapped from the
-	 * Ethernet and LLC types we use internally to the corresponding
-	 * PPP type - but the PPP type is always specified by a value
-	 * at "off_linktype", so we don't have to do the code generation
-	 * above.)
+	 * type at an offset of "off_linktype".
 	 */
 	return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_int32)proto);
 }
@@ -2622,10 +3410,9 @@ gen_linktype(proto)
  * code and protocol type in the SNAP header.
  */
 static struct block *
-gen_snap(orgcode, ptype, offset)
+gen_snap(orgcode, ptype)
 	bpf_u_int32 orgcode;
 	bpf_u_int32 ptype;
-	u_int offset;
 {
 	u_char snapblock[8];
 
@@ -2637,7 +3424,7 @@ gen_snap(orgcode, ptype, offset)
 	snapblock[5] = (orgcode >> 0);	/* lower 8 bits of organization code */
 	snapblock[6] = (ptype >> 8);	/* upper 8 bits of protocol type */
 	snapblock[7] = (ptype >> 0);	/* lower 8 bits of protocol type */
-	return gen_bcmp(OR_LINK, offset, 8, snapblock);
+	return gen_bcmp(OR_MACPL, 0, 8, snapblock);
 }
 
 /*
@@ -2670,7 +3457,7 @@ gen_llc_linktype(proto)
 		 * DSAP, as we do for other types <= ETHERMTU
 		 * (i.e., other SAP values)?
 		 */
-		return gen_cmp(OR_LINK, off_linktype, BPF_H, (bpf_u_int32)
+		return gen_cmp(OR_MACPL, 0, BPF_H, (bpf_u_int32)
 			     ((proto << 8) | proto));
 
 	case LLCSAP_IPX:
@@ -2678,7 +3465,7 @@ gen_llc_linktype(proto)
 		 * XXX - are there ever SNAP frames for IPX on
 		 * non-Ethernet 802.x networks?
 		 */
-		return gen_cmp(OR_LINK, off_linktype, BPF_B,
+		return gen_cmp(OR_MACPL, 0, BPF_B,
 		    (bpf_int32)LLCSAP_IPX);
 
 	case ETHERTYPE_ATALK:
@@ -2691,7 +3478,7 @@ gen_llc_linktype(proto)
 		 * XXX - check for an organization code of
 		 * encapsulated Ethernet as well?
 		 */
-		return gen_snap(0x080007, ETHERTYPE_ATALK, off_linktype);
+		return gen_snap(0x080007, ETHERTYPE_ATALK);
 
 	default:
 		/*
@@ -2703,8 +3490,7 @@ gen_llc_linktype(proto)
 			 * This is an LLC SAP value, so check
 			 * the DSAP.
 			 */
-			return gen_cmp(OR_LINK, off_linktype, BPF_B,
-			    (bpf_int32)proto);
+			return gen_cmp(OR_MACPL, 0, BPF_B, (bpf_int32)proto);
 		} else {
 			/*
 			 * This is an Ethernet type; we assume that it's
@@ -2719,15 +3505,13 @@ gen_llc_linktype(proto)
 			 * organization code of 0x000000 (encapsulated
 			 * Ethernet), we'd do
 			 *
-			 *	return gen_snap(0x000000, proto,
-			 *	    off_linktype);
+			 *	return gen_snap(0x000000, proto);
 			 *
 			 * here; for now, we don't, as per the above.
 			 * I don't know whether it's worth the extra CPU
 			 * time to do the right check or not.
 			 */
-			return gen_cmp(OR_LINK, off_linktype+6, BPF_H,
-			    (bpf_int32)proto);
+			return gen_cmp(OR_MACPL, 6, BPF_H, (bpf_int32)proto);
 		}
 	}
 }
@@ -2936,7 +3720,8 @@ gen_thostop(eaddr, dir)
 }
 
 /*
- * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN)
+ * Like gen_ehostop, but for DLT_IEEE802_11 (802.11 wireless LAN) and
+ * various 802.11 + radio headers.
  */
 static struct block *
 gen_wlanhostop(eaddr, dir)
@@ -2946,6 +3731,16 @@ gen_wlanhostop(eaddr, dir)
 	register struct block *b0, *b1, *b2;
 	register struct slist *s;
 
+#ifdef ENABLE_WLAN_FILTERING_PATCH
+	/*
+	 * TODO GV 20070613
+	 * We need to disable the optimizer because the optimizer is buggy
+	 * and wipes out some LD instructions generated by the below
+	 * code to validate the Frame Control bits
+	 */
+	no_optimize = 1;
+#endif /* ENABLE_WLAN_FILTERING_PATCH */
+
 	switch (dir) {
 	case Q_SRC:
 		/*
@@ -3043,7 +3838,7 @@ gen_wlanhostop(eaddr, dir)
 		 * Now check for a data frame.
 		 * I.e, check "link[0] & 0x08".
 		 */
-		gen_load_a(OR_LINK, 0, BPF_B);
+		s = gen_load_a(OR_LINK, 0, BPF_B);
 		b1 = new_block(JMP(BPF_JSET));
 		b1->s.k = 0x08;
 		b1->stmts = s;
@@ -3212,6 +4007,55 @@ gen_wlanhostop(eaddr, dir)
 		gen_and(b1, b0);
 		return b0;
 
+	/*
+	 * XXX - add RA, TA, and BSSID keywords?
+	 */
+	case Q_ADDR1:
+		return (gen_bcmp(OR_LINK, 4, 6, eaddr));
+
+	case Q_ADDR2:
+		/*
+		 * Not present in CTS or ACK control frames.
+		 */
+		b0 = gen_mcmp(OR_LINK, 0, BPF_B, IEEE80211_FC0_TYPE_CTL,
+			IEEE80211_FC0_TYPE_MASK);
+		gen_not(b0);
+		b1 = gen_mcmp(OR_LINK, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS,
+			IEEE80211_FC0_SUBTYPE_MASK);
+		gen_not(b1);
+		b2 = gen_mcmp(OR_LINK, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK,
+			IEEE80211_FC0_SUBTYPE_MASK);
+		gen_not(b2);
+		gen_and(b1, b2);
+		gen_or(b0, b2);
+		b1 = gen_bcmp(OR_LINK, 10, 6, eaddr);
+		gen_and(b2, b1);
+		return b1;
+
+	case Q_ADDR3:
+		/*
+		 * Not present in control frames.
+		 */
+		b0 = gen_mcmp(OR_LINK, 0, BPF_B, IEEE80211_FC0_TYPE_CTL,
+			IEEE80211_FC0_TYPE_MASK);
+		gen_not(b0);
+		b1 = gen_bcmp(OR_LINK, 16, 6, eaddr);
+		gen_and(b0, b1);
+		return b1;
+
+	case Q_ADDR4:
+		/*
+		 * Present only if the direction mask has both "From DS"
+		 * and "To DS" set.  Neither control frames nor management
+		 * frames should have both of those set, so we don't
+		 * check the frame type.
+		 */
+		b0 = gen_mcmp(OR_LINK, 1, BPF_B,
+			IEEE80211_FC1_DIR_DSTODS, IEEE80211_FC1_DIR_MASK);
+		b1 = gen_bcmp(OR_LINK, 24, 6, eaddr);
+		gen_and(b0, b1);
+		return b1;
+
 	case Q_AND:
 		b0 = gen_wlanhostop(eaddr, Q_SRC);
 		b1 = gen_wlanhostop(eaddr, Q_DST);
@@ -3654,48 +4498,48 @@ gen_gateway(eaddr, alist, proto, dir)
 	case Q_IP:
 	case Q_ARP:
 	case Q_RARP:
-                switch (linktype) {
-                case DLT_EN10MB:
-                    b0 = gen_ehostop(eaddr, Q_OR);
-                    break;
-                case DLT_FDDI:
-                    b0 = gen_fhostop(eaddr, Q_OR);
-                    break;
+		switch (linktype) {
+		case DLT_EN10MB:
+			b0 = gen_ehostop(eaddr, Q_OR);
+			break;
+		case DLT_FDDI:
+			b0 = gen_fhostop(eaddr, Q_OR);
+			break;
 		case DLT_IEEE802:
-                    b0 = gen_thostop(eaddr, Q_OR);
-                    break;
+			b0 = gen_thostop(eaddr, Q_OR);
+			break;
 		case DLT_IEEE802_11:
+		case DLT_PRISM_HEADER:
 		case DLT_IEEE802_11_RADIO_AVS:
-		case DLT_PPI:
 		case DLT_IEEE802_11_RADIO:
-		case DLT_PRISM_HEADER:
-                    b0 = gen_wlanhostop(eaddr, Q_OR);
-                    break;
-                case DLT_SUNATM:
-                    if (is_lane) {
-			/*
-			 * Check that the packet doesn't begin with an
-			 * LE Control marker.  (We've already generated
-			 * a test for LANE.)
-			 */
-			b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
-			    0xFF00);
-			gen_not(b1);
+		case DLT_PPI:
+			b0 = gen_wlanhostop(eaddr, Q_OR);
+			break;
+		case DLT_SUNATM:
+			if (is_lane) {
+				/*
+				 * Check that the packet doesn't begin with an
+				 * LE Control marker.  (We've already generated
+				 * a test for LANE.)
+				 */
+				b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS,
+				    BPF_H, 0xFF00);
+				gen_not(b1);
 
-			/*
-			 * Now check the MAC address.
-			 */
-			b0 = gen_ehostop(eaddr, Q_OR);
-			gen_and(b1, b0);
-                    }
-                    break;
+				/*
+				 * Now check the MAC address.
+				 */
+				b0 = gen_ehostop(eaddr, Q_OR);
+				gen_and(b1, b0);
+			}
+			break;
 		case DLT_IP_OVER_FC:
-                    b0 = gen_ipfchostop(eaddr, Q_OR);
-                    break;
-                default:
-                    bpf_error(
+			b0 = gen_ipfchostop(eaddr, Q_OR);
+			break;
+		default:
+			bpf_error(
 			    "'gateway' supported only on ethernet/FDDI/token ring/802.11/Fibre Channel");
-                }
+		}
 		b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR, Q_HOST);
 		while (*alist) {
 			tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR,
@@ -4460,7 +5304,8 @@ gen_protochain(v, proto, dir)
 	}
 
 	/*
-	 * We don't handle variable-length radiotap here headers yet.
+	 * We don't handle variable-length prefixes before the link-layer
+	 * header, or variable-length link-layer headers, here yet.
 	 * We might want to add BPF instructions to do the protochain
 	 * work, to simplify that and, on platforms that have a BPF
 	 * interpreter with the new instructions, let the filtering
@@ -4469,11 +5314,15 @@ gen_protochain(v, proto, dir)
 	 * branches, and backward branch support is unlikely to appear
 	 * in kernel BPF engines.)
 	 */
-	if (linktype == DLT_IEEE802_11_RADIO)
-		bpf_error("'protochain' not supported with radiotap headers");
+	switch (linktype) {
 
-	if (linktype == DLT_PPI)
-		bpf_error("'protochain' not supported with PPI headers");
+	case DLT_IEEE802_11:
+	case DLT_PRISM_HEADER:
+	case DLT_IEEE802_11_RADIO_AVS:
+	case DLT_IEEE802_11_RADIO:
+	case DLT_PPI:
+		bpf_error("'protochain' not supported with 802.11");
+	}
 
 	no_optimize = 1; /*this code is not compatible with optimzer yet */
 
@@ -4492,11 +5341,11 @@ gen_protochain(v, proto, dir)
 
 		/* A = ip->ip_p */
 		s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
-		s[i]->s.k = off_ll + off_nl + 9;
+		s[i]->s.k = off_macpl + off_nl + 9;
 		i++;
 		/* X = ip->ip_hl << 2 */
 		s[i] = new_stmt(BPF_LDX|BPF_MSH|BPF_B);
-		s[i]->s.k = off_ll + off_nl;
+		s[i]->s.k = off_macpl + off_nl;
 		i++;
 		break;
 #ifdef INET6
@@ -4505,7 +5354,7 @@ gen_protochain(v, proto, dir)
 
 		/* A = ip6->ip_nxt */
 		s[i] = new_stmt(BPF_LD|BPF_ABS|BPF_B);
-		s[i]->s.k = off_ll + off_nl + 6;
+		s[i]->s.k = off_macpl + off_nl + 6;
 		i++;
 		/* X = sizeof(struct ip6_hdr) */
 		s[i] = new_stmt(BPF_LDX|BPF_IMM);
@@ -4585,7 +5434,7 @@ gen_protochain(v, proto, dir)
 		i++;
 		/* A = P[X + packet head] */
 		s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
-		s[i]->s.k = off_ll + off_nl;
+		s[i]->s.k = off_macpl + off_nl;
 		i++;
 		/* MEM[reg2] = A */
 		s[i] = new_stmt(BPF_ST);
@@ -4603,7 +5452,7 @@ gen_protochain(v, proto, dir)
 		i++;
 		/* A = P[X + packet head]; */
 		s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
-		s[i]->s.k = off_ll + off_nl;
+		s[i]->s.k = off_macpl + off_nl;
 		i++;
 		/* A += 1 */
 		s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
@@ -4662,7 +5511,7 @@ gen_protochain(v, proto, dir)
 	i++;
 	/* A = P[X + packet head]; */
 	s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
-	s[i]->s.k = off_ll + off_nl;
+	s[i]->s.k = off_macpl + off_nl;
 	i++;
 	/* MEM[reg2] = A */
 	s[i] = new_stmt(BPF_ST);
@@ -4680,7 +5529,7 @@ gen_protochain(v, proto, dir)
 	i++;
 	/* A = P[X + packet head] */
 	s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
-	s[i]->s.k = off_ll + off_nl;
+	s[i]->s.k = off_macpl + off_nl;
 	i++;
 	/* A += 2 */
 	s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
@@ -4734,6 +5583,31 @@ gen_protochain(v, proto, dir)
 #endif
 }
 
+static struct block *
+gen_check_802_11_data_frame()
+{
+	struct slist *s;
+	struct block *b0, *b1;
+
+	/*
+	 * A data frame has the 0x08 bit (b3) in the frame control field set
+	 * and the 0x04 bit (b2) clear.
+	 */
+	s = gen_load_a(OR_LINK, 0, BPF_B);
+	b0 = new_block(JMP(BPF_JSET));
+	b0->s.k = 0x08;
+	b0->stmts = s;
+	
+	s = gen_load_a(OR_LINK, 0, BPF_B);
+	b1 = new_block(JMP(BPF_JSET));
+	b1->s.k = 0x04;
+	b1->stmts = s;
+	gen_not(b1);
+
+	gen_and(b1, b0);
+
+	return b0;
+}
 
 /*
  * Generate code that checks whether the packet is a packet for protocol
@@ -5021,9 +5895,9 @@ gen_scode(name, q)
 				return b;
 
 			case DLT_IEEE802_11:
+			case DLT_PRISM_HEADER:
 			case DLT_IEEE802_11_RADIO_AVS:
 			case DLT_IEEE802_11_RADIO:
-			case DLT_PRISM_HEADER:
 			case DLT_PPI:
 				eaddr = pcap_ether_hostton(name);
 				if (eaddr == NULL)
@@ -5252,7 +6126,6 @@ gen_scode(name, q)
 		else
 			bpf_error("unknown protocol: %s", name);
 
-
 	case Q_UNDEF:
 		syntax();
 		/* NOTREACHED */
@@ -5489,44 +6362,44 @@ gen_ecode(eaddr, q)
 	struct block *b, *tmp;
 
 	if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
-            switch (linktype) {
-            case DLT_EN10MB:
-                return gen_ehostop(eaddr, (int)q.dir);
-            case DLT_FDDI:
-                return gen_fhostop(eaddr, (int)q.dir);
-            case DLT_IEEE802:
-                return gen_thostop(eaddr, (int)q.dir);
-			case DLT_IEEE802_11:
-			case DLT_IEEE802_11_RADIO_AVS:
-			case DLT_IEEE802_11_RADIO:
-			case DLT_PRISM_HEADER:
-			case DLT_PPI:
-				return gen_wlanhostop(eaddr, (int)q.dir);
-			case DLT_SUNATM:
-				if (is_lane) {
-					/*
-					 * Check that the packet doesn't begin with an
-					 * LE Control marker.  (We've already generated
-					 * a test for LANE.)
-					 */
-					tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
-						0xFF00);
-					gen_not(tmp);
-
-					/*
-					 * Now check the MAC address.
-					 */
-					b = gen_ehostop(eaddr, (int)q.dir);
-					gen_and(tmp, b);
-					return b;
-				}
-				break;
-			case DLT_IP_OVER_FC:
-                return gen_ipfchostop(eaddr, (int)q.dir);
-            default:
-				bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
-                break;
-            }
+		switch (linktype) {
+		case DLT_EN10MB:
+			return gen_ehostop(eaddr, (int)q.dir);
+		case DLT_FDDI:
+			return gen_fhostop(eaddr, (int)q.dir);
+		case DLT_IEEE802:
+			return gen_thostop(eaddr, (int)q.dir);
+		case DLT_IEEE802_11:
+		case DLT_PRISM_HEADER:
+		case DLT_IEEE802_11_RADIO_AVS:
+		case DLT_IEEE802_11_RADIO:
+		case DLT_PPI:
+			return gen_wlanhostop(eaddr, (int)q.dir);
+		case DLT_SUNATM:
+			if (is_lane) {
+				/*
+				 * Check that the packet doesn't begin with an
+				 * LE Control marker.  (We've already generated
+				 * a test for LANE.)
+				 */
+				tmp = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
+					0xFF00);
+				gen_not(tmp);
+
+				/*
+				 * Now check the MAC address.
+				 */
+				b = gen_ehostop(eaddr, (int)q.dir);
+				gen_and(tmp, b);
+				return b;
+			}
+			break;
+		case DLT_IP_OVER_FC:
+			return gen_ipfchostop(eaddr, (int)q.dir);
+		default:
+			bpf_error("ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel");
+			break;
+		}
 	}
 	bpf_error("ethernet address used in non-ether expression");
 	/* NOTREACHED */
@@ -5693,14 +6566,14 @@ gen_load(proto, inst, size)
 		 * XXX - are there any cases where we want
 		 * off_nl_nosnap?
 		 */
-		s = gen_llprefixlen();
+		s = gen_off_macpl();
 
 		/*
 		 * If "s" is non-null, it has code to arrange that the
-		 * X register contains the length of the prefix preceding
-		 * the link-layer header.  Add to it the offset computed
-		 * into the register specified by "index", and move that
-		 * into the X register.  Otherwise, just load into the X
+		 * X register contains the offset of the MAC-layer
+		 * payload.  Add to it the offset computed into the
+		 * register specified by "index", and move that into
+		 * the X register.  Otherwise, just load into the X
 		 * register the offset computed into the register specifed
 		 * by "index".
 		 */
@@ -5714,13 +6587,17 @@ gen_load(proto, inst, size)
 		/*
 		 * Load the item at the sum of the offset we've put in the
 		 * X register, the offset of the start of the network
-		 * layer header, and the offset of the start of the link
-		 * layer header (which is 0 if the radio header is
-		 * variable-length; that header length is what we put
-		 * into the X register and then added to the index).
+		 * layer header from the beginning of the MAC-layer
+		 * payload, and the purported offset of the start of the
+		 * MAC-layer payload (which might be 0 if there's a
+		 * variable-length prefix before the link-layer header
+		 * or the link-layer header itself is variable-length;
+		 * the variable-length offset of the start of the
+		 * MAC-layer payload is what we put into the X register
+		 * and then added to the index).
 		 */
 		tmp = new_stmt(BPF_LD|BPF_IND|size);
-		tmp->s.k = off_ll + off_nl;
+		tmp->s.k = off_macpl + off_nl;
 		sappend(s, tmp);
 		sappend(inst->s, s);
 
@@ -5761,22 +6638,24 @@ gen_load(proto, inst, size)
 		/*
 		 * The X register now contains the sum of the length
 		 * of any variable-length header preceding the link-layer
-		 * header and the length of the network-layer header.
+		 * header, any variable-length link-layer header, and the
+		 * length of the network-layer header.
+		 *
 		 * Load into the A register the offset relative to
 		 * the beginning of the transport layer header,
 		 * add the X register to that, move that to the
 		 * X register, and load with an offset from the
 		 * X register equal to the offset of the network
 		 * layer header relative to the beginning of
-		 * the link-layer header plus the length of any
-		 * fixed-length header preceding the link-layer
-		 * header.
+		 * the MAC-layer payload plus the fixed-length
+		 * portion of the offset of the MAC-layer payload
+		 * from the beginning of the raw packet data.
 		 */
 		sappend(s, xfer_to_a(inst));
 		sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X));
 		sappend(s, new_stmt(BPF_MISC|BPF_TAX));
 		sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size));
-		tmp->s.k = off_ll + off_nl;
+		tmp->s.k = off_macpl + off_nl;
 		sappend(inst->s, s);
 
 		/*
@@ -5943,6 +6822,16 @@ static int regused[BPF_MEMWORDS];
 static int curreg;
 
 /*
+ * Initialize the table of used registers and the current register.
+ */
+static void
+init_regs()
+{
+	curreg = 0;
+	memset(regused, 0, sizeof regused);
+}
+
+/*
  * Return the next free register.
  */
 static int
@@ -6073,46 +6962,46 @@ gen_broadcast(proto)
 
 	case Q_DEFAULT:
 	case Q_LINK:
-                switch (linktype) {
-                case DLT_ARCNET:
-                case DLT_ARCNET_LINUX:
-                    return gen_ahostop(abroadcast, Q_DST);
-                case DLT_EN10MB:    
-                    return gen_ehostop(ebroadcast, Q_DST);
-                case DLT_FDDI:
-                    return gen_fhostop(ebroadcast, Q_DST);
-                case DLT_IEEE802:
-                    return gen_thostop(ebroadcast, Q_DST);
-                case DLT_IEEE802_11:
-                case DLT_IEEE802_11_RADIO_AVS:
-                case DLT_IEEE802_11_RADIO:
-				case DLT_PPI:
-                case DLT_PRISM_HEADER:
-                    return gen_wlanhostop(ebroadcast, Q_DST);
-                case DLT_IP_OVER_FC:
-                    return gen_ipfchostop(ebroadcast, Q_DST);
-                case DLT_SUNATM:
-                    if (is_lane) {
-			/*
-			 * Check that the packet doesn't begin with an
-			 * LE Control marker.  (We've already generated
-			 * a test for LANE.)
-			 */
-			b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
-			    0xFF00);
-			gen_not(b1);
+		switch (linktype) {
+		case DLT_ARCNET:
+		case DLT_ARCNET_LINUX:
+			return gen_ahostop(abroadcast, Q_DST);
+		case DLT_EN10MB:
+			return gen_ehostop(ebroadcast, Q_DST);
+		case DLT_FDDI:
+			return gen_fhostop(ebroadcast, Q_DST);
+		case DLT_IEEE802:
+			return gen_thostop(ebroadcast, Q_DST);
+		case DLT_IEEE802_11:
+		case DLT_PRISM_HEADER:
+		case DLT_IEEE802_11_RADIO_AVS:
+		case DLT_IEEE802_11_RADIO:
+		case DLT_PPI:
+			return gen_wlanhostop(ebroadcast, Q_DST);
+		case DLT_IP_OVER_FC:
+			return gen_ipfchostop(ebroadcast, Q_DST);
+		case DLT_SUNATM:
+			if (is_lane) {
+				/*
+				 * Check that the packet doesn't begin with an
+				 * LE Control marker.  (We've already generated
+				 * a test for LANE.)
+				 */
+				b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS,
+				    BPF_H, 0xFF00);
+				gen_not(b1);
 
-			/*
-			 * Now check the MAC address.
-			 */
-			b0 = gen_ehostop(ebroadcast, Q_DST);
-			gen_and(b1, b0);
-			return b0;
-                    }
-                    break;
-                default:
-                    bpf_error("not a broadcast link");
-                }
+				/*
+				 * Now check the MAC address.
+				 */
+				b0 = gen_ehostop(ebroadcast, Q_DST);
+				gen_and(b1, b0);
+				return b0;
+			}
+			break;
+		default:
+			bpf_error("not a broadcast link");
+		}
 		break;
 
 	case Q_IP:
@@ -6160,167 +7049,167 @@ gen_multicast(proto)
 
 	case Q_DEFAULT:
 	case Q_LINK:
-                switch (linktype) {
-                case DLT_ARCNET:
-                case DLT_ARCNET_LINUX:
-                    /* all ARCnet multicasts use the same address */
-                    return gen_ahostop(abroadcast, Q_DST);
-                case  DLT_EN10MB:
-                    /* ether[0] & 1 != 0 */
-                    return gen_mac_multicast(0);
-                case DLT_FDDI:
-                    /*
-                     * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX
-                     *
-                     * XXX - was that referring to bit-order issues?
-                     */
-                    /* fddi[1] & 1 != 0 */
-                    return gen_mac_multicast(1);
-                case DLT_IEEE802:
-                    /* tr[2] & 1 != 0 */
-                    return gen_mac_multicast(2);
-                case DLT_IEEE802_11:
-                case DLT_IEEE802_11_RADIO_AVS:
-				case DLT_PPI:
-                case DLT_IEEE802_11_RADIO:
-                case DLT_PRISM_HEADER:
-                    /*
-                     * Oh, yuk.
-                     *
-                     *	For control frames, there is no DA.
-                     *
-                     *	For management frames, DA is at an
-                     *	offset of 4 from the beginning of
-                     *	the packet.
-                     *
-                     *	For data frames, DA is at an offset
-                     *	of 4 from the beginning of the packet
-                     *	if To DS is clear and at an offset of
-                     *	16 from the beginning of the packet
-                     *	if To DS is set.
-                     */
-                    
-                    /*
-                     * Generate the tests to be done for data frames.
-                     *
-                     * First, check for To DS set, i.e. "link[1] & 0x01".
-                     */
-                    s = gen_load_a(OR_LINK, 1, BPF_B);
-                    b1 = new_block(JMP(BPF_JSET));
-                    b1->s.k = 0x01;	/* To DS */
-                    b1->stmts = s;
-                    
-                    /*
-                     * If To DS is set, the DA is at 16.
-                     */
-                    b0 = gen_mac_multicast(16);
-                    gen_and(b1, b0);
-                    
-                    /*
-                     * Now, check for To DS not set, i.e. check
-                     * "!(link[1] & 0x01)".
-                     */
-                    s = gen_load_a(OR_LINK, 1, BPF_B);
-                    b2 = new_block(JMP(BPF_JSET));
-                    b2->s.k = 0x01;	/* To DS */
-                    b2->stmts = s;
-                    gen_not(b2);
-                    
-                    /*
-                     * If To DS is not set, the DA is at 4.
-                     */
-                    b1 = gen_mac_multicast(4);
-                    gen_and(b2, b1);
-                    
-                    /*
-                     * Now OR together the last two checks.  That gives
-                     * the complete set of checks for data frames.
-                     */
-                    gen_or(b1, b0);
-                    
-                    /*
-                     * Now check for a data frame.
-                     * I.e, check "link[0] & 0x08".
-                     */
-                    s = gen_load_a(OR_LINK, 0, BPF_B);
-                    b1 = new_block(JMP(BPF_JSET));
-                    b1->s.k = 0x08;
-                    b1->stmts = s;
-                    
-                    /*
-                     * AND that with the checks done for data frames.
-                     */
-                    gen_and(b1, b0);
-                    
-                    /*
-                     * If the high-order bit of the type value is 0, this
-                     * is a management frame.
-                     * I.e, check "!(link[0] & 0x08)".
-                     */
-                    s = gen_load_a(OR_LINK, 0, BPF_B);
-                    b2 = new_block(JMP(BPF_JSET));
-                    b2->s.k = 0x08;
-                    b2->stmts = s;
-                    gen_not(b2);
-                    
-                    /*
-                     * For management frames, the DA is at 4.
-                     */
-                    b1 = gen_mac_multicast(4);
-                    gen_and(b2, b1);
-                    
-                    /*
-                     * OR that with the checks done for data frames.
-                     * That gives the checks done for management and
-                     * data frames.
-                     */
-                    gen_or(b1, b0);
-                    
-                    /*
-                     * If the low-order bit of the type value is 1,
-                     * this is either a control frame or a frame
-                     * with a reserved type, and thus not a
-                     * frame with an SA.
-                     *
-                     * I.e., check "!(link[0] & 0x04)".
-                     */
-                    s = gen_load_a(OR_LINK, 0, BPF_B);
-                    b1 = new_block(JMP(BPF_JSET));
-                    b1->s.k = 0x04;
-                    b1->stmts = s;
-                    gen_not(b1);
-                    
-                    /*
-                     * AND that with the checks for data and management
-                     * frames.
-                     */
-                    gen_and(b1, b0);
-                    return b0;
-                case DLT_IP_OVER_FC:
-                    b0 = gen_mac_multicast(2);
-                    return b0;
-                case DLT_SUNATM:
-                    if (is_lane) {
+		switch (linktype) {
+		case DLT_ARCNET:
+		case DLT_ARCNET_LINUX:
+			/* all ARCnet multicasts use the same address */
+			return gen_ahostop(abroadcast, Q_DST);
+		case DLT_EN10MB:
+			/* ether[0] & 1 != 0 */
+			return gen_mac_multicast(0);
+		case DLT_FDDI:
 			/*
-			 * Check that the packet doesn't begin with an
-			 * LE Control marker.  (We've already generated
-			 * a test for LANE.)
+			 * XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX
+			 *
+			 * XXX - was that referring to bit-order issues?
 			 */
-			b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS, BPF_H,
-			    0xFF00);
+			/* fddi[1] & 1 != 0 */
+			return gen_mac_multicast(1);
+		case DLT_IEEE802:
+			/* tr[2] & 1 != 0 */
+			return gen_mac_multicast(2);
+		case DLT_IEEE802_11:
+		case DLT_PRISM_HEADER:
+		case DLT_IEEE802_11_RADIO_AVS:
+		case DLT_IEEE802_11_RADIO:
+		case DLT_PPI:
+			/*
+			 * Oh, yuk.
+			 *
+			 *	For control frames, there is no DA.
+			 *
+			 *	For management frames, DA is at an
+			 *	offset of 4 from the beginning of
+			 *	the packet.
+			 *
+			 *	For data frames, DA is at an offset
+			 *	of 4 from the beginning of the packet
+			 *	if To DS is clear and at an offset of
+			 *	16 from the beginning of the packet
+			 *	if To DS is set.
+			 */
+
+			/*
+			 * Generate the tests to be done for data frames.
+			 *
+			 * First, check for To DS set, i.e. "link[1] & 0x01".
+			 */
+			s = gen_load_a(OR_LINK, 1, BPF_B);
+			b1 = new_block(JMP(BPF_JSET));
+			b1->s.k = 0x01;	/* To DS */
+			b1->stmts = s;
+
+			/*
+			 * If To DS is set, the DA is at 16.
+			 */
+			b0 = gen_mac_multicast(16);
+			gen_and(b1, b0);
+
+			/*
+			 * Now, check for To DS not set, i.e. check
+			 * "!(link[1] & 0x01)".
+			 */
+			s = gen_load_a(OR_LINK, 1, BPF_B);
+			b2 = new_block(JMP(BPF_JSET));
+			b2->s.k = 0x01;	/* To DS */
+			b2->stmts = s;
+			gen_not(b2);
+
+			/*
+			 * If To DS is not set, the DA is at 4.
+			 */
+			b1 = gen_mac_multicast(4);
+			gen_and(b2, b1);
+
+			/*
+			 * Now OR together the last two checks.  That gives
+			 * the complete set of checks for data frames.
+			 */
+			gen_or(b1, b0);
+
+			/*
+			 * Now check for a data frame.
+			 * I.e, check "link[0] & 0x08".
+			 */
+			s = gen_load_a(OR_LINK, 0, BPF_B);
+			b1 = new_block(JMP(BPF_JSET));
+			b1->s.k = 0x08;
+			b1->stmts = s;
+
+			/*
+			 * AND that with the checks done for data frames.
+			 */
+			gen_and(b1, b0);
+
+			/*
+			 * If the high-order bit of the type value is 0, this
+			 * is a management frame.
+			 * I.e, check "!(link[0] & 0x08)".
+			 */
+			s = gen_load_a(OR_LINK, 0, BPF_B);
+			b2 = new_block(JMP(BPF_JSET));
+			b2->s.k = 0x08;
+			b2->stmts = s;
+			gen_not(b2);
+
+			/*
+			 * For management frames, the DA is at 4.
+			 */
+			b1 = gen_mac_multicast(4);
+			gen_and(b2, b1);
+
+			/*
+			 * OR that with the checks done for data frames.
+			 * That gives the checks done for management and
+			 * data frames.
+			 */
+			gen_or(b1, b0);
+
+			/*
+			 * If the low-order bit of the type value is 1,
+			 * this is either a control frame or a frame
+			 * with a reserved type, and thus not a
+			 * frame with an SA.
+			 *
+			 * I.e., check "!(link[0] & 0x04)".
+			 */
+			s = gen_load_a(OR_LINK, 0, BPF_B);
+			b1 = new_block(JMP(BPF_JSET));
+			b1->s.k = 0x04;
+			b1->stmts = s;
 			gen_not(b1);
 
-			/* ether[off_mac] & 1 != 0 */
-			b0 = gen_mac_multicast(off_mac);
+			/*
+			 * AND that with the checks for data and management
+			 * frames.
+			 */
 			gen_and(b1, b0);
 			return b0;
-                    }
-                    break;
-                default:
-                    break;
-                }
-                /* Link not known to support multicasts */
-                break;
+		case DLT_IP_OVER_FC:
+			b0 = gen_mac_multicast(2);
+			return b0;
+		case DLT_SUNATM:
+			if (is_lane) {
+				/*
+				 * Check that the packet doesn't begin with an
+				 * LE Control marker.  (We've already generated
+				 * a test for LANE.)
+				 */
+				b1 = gen_cmp(OR_LINK, SUNATM_PKT_BEGIN_POS,
+				    BPF_H, 0xFF00);
+				gen_not(b1);
+
+				/* ether[off_mac] & 1 != 0 */
+				b0 = gen_mac_multicast(off_mac);
+				gen_and(b1, b0);
+				return b0;
+			}
+			break;
+		default:
+			break;
+		}
+		/* Link not known to support multicasts */
+		break;
 
 	case Q_IP:
 		b0 = gen_linktype(ETHERTYPE_IP);
@@ -6417,6 +7306,8 @@ gen_inbound(dir)
         case DLT_JUNIPER_FRELAY:
         case DLT_JUNIPER_CHDLC:
         case DLT_JUNIPER_VP:
+        case DLT_JUNIPER_ST:
+        case DLT_JUNIPER_ISM:
 		/* juniper flags (including direction) are stored
 		 * the byte after the 3-byte magic number */
 		if (dir) {
@@ -6426,7 +7317,7 @@ gen_inbound(dir)
 			/* match incoming packets */
 			b0 = gen_mcmp(OR_LINK, 3, BPF_B, 1, 0x01);
 		}
-	    break;
+		break;
 
 	default:
 		bpf_error("inbound/outbound not supported on linktype %d",
@@ -6445,13 +7336,12 @@ gen_pf_ifname(const char *ifname)
 	struct block *b0;
 	u_int len, off;
 
-	if (linktype == DLT_PFLOG) {
-		len = sizeof(((struct pfloghdr *)0)->ifname);
-		off = offsetof(struct pfloghdr, ifname);
-	} else {
-		bpf_error("ifname not supported on linktype 0x%x", linktype);
+	if (linktype != DLT_PFLOG) {
+		bpf_error("ifname supported only on PF linktype");
 		/* NOTREACHED */
 	}
+	len = sizeof(((struct pfloghdr *)0)->ifname);
+	off = offsetof(struct pfloghdr, ifname);
 	if (strlen(ifname) >= len) {
 		bpf_error("ifname interface names can only be %d characters",
 		    len-1);
@@ -6468,14 +7358,16 @@ gen_pf_ruleset(char *ruleset)
 	struct block *b0;
 
 	if (linktype != DLT_PFLOG) {
-		bpf_error("ruleset not supported on linktype 0x%x", linktype);
+		bpf_error("ruleset supported only on PF linktype");
 		/* NOTREACHED */
 	}
+
 	if (strlen(ruleset) >= sizeof(((struct pfloghdr *)0)->ruleset)) {
 		bpf_error("ruleset names can only be %ld characters",
 		    (long)(sizeof(((struct pfloghdr *)0)->ruleset) - 1));
 		/* NOTREACHED */
 	}
+
 	b0 = gen_bcmp(OR_LINK, offsetof(struct pfloghdr, ruleset),
 	    strlen(ruleset), (const u_char *)ruleset);
 	return (b0);
@@ -6487,14 +7379,13 @@ gen_pf_rnr(int rnr)
 {
 	struct block *b0;
 
-	if (linktype == DLT_PFLOG) {
-		b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, rulenr), BPF_W,
-			 (bpf_int32)rnr);
-	} else {
-		bpf_error("rnr not supported on linktype 0x%x", linktype);
+	if (linktype != DLT_PFLOG) {
+		bpf_error("rnr supported only on PF linktype");
 		/* NOTREACHED */
 	}
 
+	b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, rulenr), BPF_W,
+		 (bpf_int32)rnr);
 	return (b0);
 }
 
@@ -6505,7 +7396,7 @@ gen_pf_srnr(int srnr)
 	struct block *b0;
 
 	if (linktype != DLT_PFLOG) {
-		bpf_error("srnr not supported on linktype 0x%x", linktype);
+		bpf_error("srnr supported only on PF linktype");
 		/* NOTREACHED */
 	}
 
@@ -6520,14 +7411,13 @@ gen_pf_reason(int reason)
 {
 	struct block *b0;
 
-	if (linktype == DLT_PFLOG) {
-		b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, reason), BPF_B,
-		    (bpf_int32)reason);
-	} else {
-		bpf_error("reason not supported on linktype 0x%x", linktype);
+	if (linktype != DLT_PFLOG) {
+		bpf_error("reason supported only on PF linktype");
 		/* NOTREACHED */
 	}
 
+	b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, reason), BPF_B,
+	    (bpf_int32)reason);
 	return (b0);
 }
 
@@ -6537,14 +7427,13 @@ gen_pf_action(int action)
 {
 	struct block *b0;
 
-	if (linktype == DLT_PFLOG) {
-		b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, action), BPF_B,
-		    (bpf_int32)action);
-	} else {
-		bpf_error("action not supported on linktype 0x%x", linktype);
+	if (linktype != DLT_PFLOG) {
+		bpf_error("action supported only on PF linktype");
 		/* NOTREACHED */
 	}
 
+	b0 = gen_cmp(OR_LINK, offsetof(struct pfloghdr, action), BPF_B,
+	    (bpf_int32)action);
 	return (b0);
 }
 #else /* !HAVE_NET_PFVAR_H */
@@ -6597,14 +7486,75 @@ gen_pf_action(int action)
 }
 #endif /* HAVE_NET_PFVAR_H */
 
+/* IEEE 802.11 wireless header */
+struct block *
+gen_p80211_type(int type, int mask)
+{
+	struct block *b0;
+
+	switch (linktype) {
+
+	case DLT_IEEE802_11:
+	case DLT_PRISM_HEADER:
+	case DLT_IEEE802_11_RADIO_AVS:
+	case DLT_IEEE802_11_RADIO:
+		b0 = gen_mcmp(OR_LINK, 0, BPF_B, (bpf_int32)type,
+		    (bpf_int32)mask);
+		break;
+
+	default:
+		bpf_error("802.11 link-layer types supported only on 802.11");
+		/* NOTREACHED */
+	}
+
+	return (b0);
+}
+
+struct block *
+gen_p80211_fcdir(int fcdir)
+{
+	struct block *b0;
+
+	switch (linktype) {
+
+	case DLT_IEEE802_11:
+	case DLT_PRISM_HEADER:
+	case DLT_IEEE802_11_RADIO_AVS:
+	case DLT_IEEE802_11_RADIO:
+		break;
+
+	default:
+		bpf_error("frame direction supported only with 802.11 headers");
+		/* NOTREACHED */
+	}
+
+	b0 = gen_mcmp(OR_LINK, 1, BPF_B, (bpf_int32)fcdir,
+		(bpf_u_int32)IEEE80211_FC1_DIR_MASK);
+
+	return (b0);
+}
+
 struct block *
 gen_acode(eaddr, q)
 	register const u_char *eaddr;
 	struct qual q;
 {
-	if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
-		if (linktype == DLT_ARCNET || linktype == DLT_ARCNET_LINUX)
-			return gen_ahostop(eaddr, (int)q.dir);
+	switch (linktype) {
+
+	case DLT_ARCNET:
+	case DLT_ARCNET_LINUX:
+		if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) &&
+		    q.proto == Q_LINK)
+			return (gen_ahostop(eaddr, (int)q.dir));
+		else {
+			bpf_error("ARCnet address used in non-arc expression");
+			/* NOTREACHED */
+		}
+		break;
+
+	default:
+		bpf_error("aid supported only on ARCnet");
+		/* NOTREACHED */
 	}
 	bpf_error("ARCnet address used in non-arc expression");
 	/* NOTREACHED */
@@ -6657,10 +7607,11 @@ gen_vlan(vlan_num)
 		bpf_error("no VLAN match after MPLS");
 
 	/*
-	 * Change the offsets to point to the type and data fields within
-	 * the VLAN packet.  Just increment the offsets, so that we
-	 * can support a hierarchy, e.g. "vlan 300 && vlan 200" to
-	 * capture VLAN 200 encapsulated within VLAN 100.
+	 * Check for a VLAN packet, and then change the offsets to point
+	 * to the type and data fields within the VLAN packet.  Just
+	 * increment the offsets, so that we can support a hierarchy, e.g.
+	 * "vlan 300 && vlan 200" to capture VLAN 200 encapsulated within
+	 * VLAN 100.
 	 *
 	 * XXX - this is a bit of a kludge.  If we were to split the
 	 * compiler into a parser that parses an expression and
@@ -6686,15 +7637,29 @@ gen_vlan(vlan_num)
 	 * be done assuming a VLAN, even though the "or" could be viewed
 	 * as meaning "or, if this isn't a VLAN packet...".
 	 */
-	orig_linktype = off_linktype;	/* save original values */
 	orig_nl = off_nl;
 
 	switch (linktype) {
 
 	case DLT_EN10MB:
+		/* check for VLAN */
+		b0 = gen_cmp(OR_LINK, off_linktype, BPF_H,
+		    (bpf_int32)ETHERTYPE_8021Q);
+
+		/* If a specific VLAN is requested, check VLAN id */
+		if (vlan_num >= 0) {
+			b1 = gen_mcmp(OR_MACPL, 0, BPF_H,
+			    (bpf_int32)vlan_num, 0x0fff);
+			gen_and(b0, b1);
+			b0 = b1;
+		}
+
+		off_macpl += 4;
 		off_linktype += 4;
+#if 0
 		off_nl_nosnap += 4;
 		off_nl += 4;
+#endif
 		break;
 
 	default:
@@ -6703,17 +7668,6 @@ gen_vlan(vlan_num)
 		/*NOTREACHED*/
 	}
 
-	/* check for VLAN */
-	b0 = gen_cmp(OR_LINK, orig_linktype, BPF_H, (bpf_int32)ETHERTYPE_8021Q);
-
-	/* If a specific VLAN is requested, check VLAN id */
-	if (vlan_num >= 0) {
-		b1 = gen_mcmp(OR_LINK, orig_nl, BPF_H, (bpf_int32)vlan_num,
-		    0x0fff);
-		gen_and(b0, b1);
-		b0 = b1;
-	}
-
 	return (b0);
 }
 
@@ -6739,7 +7693,7 @@ gen_mpls(label_num)
 
         if (label_stack_depth > 0) {
             /* just match the bottom-of-stack bit clear */
-            b0 = gen_mcmp(OR_LINK, orig_nl-2, BPF_B, 0, 0x01);
+            b0 = gen_mcmp(OR_MACPL, orig_nl-2, BPF_B, 0, 0x01);
         } else {
             /*
              * Indicate that we're checking MPLS-encapsulated headers,
@@ -6774,7 +7728,7 @@ gen_mpls(label_num)
 	/* If a specific MPLS label is requested, check it */
 	if (label_num >= 0) {
 		label_num = label_num << 12; /* label is shifted 12 bits on the wire */
-		b1 = gen_mcmp(OR_LINK, orig_nl, BPF_W, (bpf_int32)label_num,
+		b1 = gen_mcmp(OR_MACPL, orig_nl, BPF_W, (bpf_int32)label_num,
 		    0xfffff000); /* only compare the first 20 bits */
 		gen_and(b0, b1);
 		b0 = b1;
@@ -6808,7 +7762,8 @@ gen_pppoes()
 
 	/*
 	 * Change the offsets to point to the type and data fields within
-	 * the PPP packet.
+	 * the PPP packet, and note that this is PPPoE rather than
+	 * raw PPP.
 	 *
 	 * XXX - this is a bit of a kludge.  If we were to split the
 	 * compiler into a parser that parses an expression and
@@ -6836,24 +7791,28 @@ gen_pppoes()
 	 */
 	orig_linktype = off_linktype;	/* save original values */
 	orig_nl = off_nl;
+	is_pppoes = 1;
 
 	/*
 	 * The "network-layer" protocol is PPPoE, which has a 6-byte
-	 * PPPoE header, followed by PPP payload, so we set the
-	 * offsets to the network layer offset plus 6 bytes for
-	 * the PPPoE header plus the values appropriate for PPP when
-	 * encapsulated in Ethernet (which means there's no HDLC
-	 * encapsulation).
+	 * PPPoE header, followed by a PPP packet.
+	 *
+	 * There is no HDLC encapsulation for the PPP packet (it's
+	 * encapsulated in PPPoES instead), so the link-layer type
+	 * starts at the first byte of the PPP packet.  For PPPoE,
+	 * that offset is relative to the beginning of the total
+	 * link-layer payload, including any 802.2 LLC header, so
+	 * it's 6 bytes past off_nl.
 	 */
-	off_linktype = orig_nl + 6;
-	off_nl = orig_nl + 6 + 2;
-	off_nl_nosnap = orig_nl + 6 + 2;
+	off_linktype = off_nl + 6;
 
 	/*
-	 * Set the link-layer type to PPP, as all subsequent tests will
-	 * be on the encapsulated PPP header.
+	 * The network-layer offsets are relative to the beginning
+	 * of the MAC-layer payload; that's past the 6-byte
+	 * PPPoE header and the 2-byte PPP header.
 	 */
-	linktype = DLT_PPP;
+	off_nl = 6+2;
+	off_nl_nosnap = 6+2;
 
 	return b0;
 }
@@ -6999,8 +7958,9 @@ gen_atmtype_abbrev(type)
 		is_lane = 1;
 		off_mac = off_payload + 2;	/* MAC header */
 		off_linktype = off_mac + 12;
-		off_nl = off_mac + 14;		/* Ethernet II */
-		off_nl_nosnap = off_mac + 17;	/* 802.3+802.2 */
+		off_macpl = off_mac + 14;	/* Ethernet */
+		off_nl = 0;			/* Ethernet II */
+		off_nl_nosnap = 3;		/* 802.3+802.2 */
 		break;
 
 	case A_LLC:
@@ -7033,6 +7993,7 @@ gen_mtp2type_abbrev(type)
 
 	case M_FISU:
 		if ( (linktype != DLT_MTP2) &&
+		     (linktype != DLT_ERF) &&
 		     (linktype != DLT_MTP2_WITH_PHDR) )
 			bpf_error("'fisu' supported only on MTP2");
 		/* gen_ncmp(offrel, offset, size, mask, jtype, reverse, value) */
@@ -7041,6 +8002,7 @@ gen_mtp2type_abbrev(type)
 
 	case M_LSSU:
 		if ( (linktype != DLT_MTP2) &&
+		     (linktype != DLT_ERF) &&
 		     (linktype != DLT_MTP2_WITH_PHDR) )
 			bpf_error("'lssu' supported only on MTP2");
 		b0 = gen_ncmp(OR_PACKET, off_li, BPF_B, 0x3f, BPF_JGT, 1, 2);
@@ -7050,6 +8012,7 @@ gen_mtp2type_abbrev(type)
 
 	case M_MSU:
 		if ( (linktype != DLT_MTP2) &&
+		     (linktype != DLT_ERF) &&
 		     (linktype != DLT_MTP2_WITH_PHDR) )
 			bpf_error("'msu' supported only on MTP2");
 		b0 = gen_ncmp(OR_PACKET, off_li, BPF_B, 0x3f, BPF_JGT, 0, 2);
diff --git a/contrib/libpcap/gencode.h b/contrib/libpcap/gencode.h
index 9363a42..5fdec28 100644
--- a/contrib/libpcap/gencode.h
+++ b/contrib/libpcap/gencode.h
@@ -19,7 +19,7 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
  * $FreeBSD$
- * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.60.2.11 2007/06/11 09:52:04 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/gencode.h,v 1.70.2.1 2007/11/18 02:04:55 guy Exp $ (LBL)
  */
 
 /*
@@ -133,6 +133,10 @@
 #define Q_DST		2
 #define Q_OR		3
 #define Q_AND		4
+#define Q_ADDR1		5
+#define Q_ADDR2		6
+#define Q_ADDR3		7
+#define Q_ADDR4		8
 
 #define Q_DEFAULT	0
 #define Q_UNDEF		255
@@ -313,6 +317,9 @@ struct block *gen_pf_reason(int);
 struct block *gen_pf_action(int);
 struct block *gen_pf_dir(int);
 
+struct block *gen_p80211_type(int, int);
+struct block *gen_p80211_fcdir(int);
+
 void bpf_optimize(struct block **);
 void bpf_error(const char *, ...)
     __attribute__((noreturn, format (printf, 1, 2)));
diff --git a/contrib/libpcap/grammar.y b/contrib/libpcap/grammar.y
index 9d9b202..cc81984 100644
--- a/contrib/libpcap/grammar.y
+++ b/contrib/libpcap/grammar.y
@@ -23,7 +23,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.86.2.9 2007/09/12 19:17:25 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.99.2.2 2007/11/18 02:04:55 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -58,7 +58,8 @@ struct rtentry;
 #include <net/pfvar.h>
 #include <net/if_pflog.h>
 #endif
-#include <pcap-namedb.h>
+#include "ieee80211.h"
+#include <pcap/namedb.h>
 
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
@@ -68,6 +69,92 @@ struct rtentry;
 			 (q).dir = (d),\
 			 (q).addr = (a)
 
+struct tok {
+	int v;			/* value */
+	const char *s;		/* string */
+};
+
+static const struct tok ieee80211_types[] = {
+	{ IEEE80211_FC0_TYPE_DATA, "data" },
+	{ IEEE80211_FC0_TYPE_MGT, "mgt" },
+	{ IEEE80211_FC0_TYPE_MGT, "management" },
+	{ IEEE80211_FC0_TYPE_CTL, "ctl" },
+	{ IEEE80211_FC0_TYPE_CTL, "control" },
+	{ 0, NULL }
+};
+static const struct tok ieee80211_mgt_subtypes[] = {
+	{ IEEE80211_FC0_SUBTYPE_ASSOC_REQ, "assocreq" },
+	{ IEEE80211_FC0_SUBTYPE_ASSOC_REQ, "assoc-req" },
+	{ IEEE80211_FC0_SUBTYPE_ASSOC_RESP, "assocresp" },
+	{ IEEE80211_FC0_SUBTYPE_ASSOC_RESP, "assoc-resp" },
+	{ IEEE80211_FC0_SUBTYPE_REASSOC_REQ, "reassocreq" },
+	{ IEEE80211_FC0_SUBTYPE_REASSOC_REQ, "reassoc-req" },
+	{ IEEE80211_FC0_SUBTYPE_REASSOC_RESP, "reassocresp" },
+	{ IEEE80211_FC0_SUBTYPE_REASSOC_RESP, "reassoc-resp" },
+	{ IEEE80211_FC0_SUBTYPE_PROBE_REQ, "probereq" },
+	{ IEEE80211_FC0_SUBTYPE_PROBE_REQ, "probe-req" },
+	{ IEEE80211_FC0_SUBTYPE_PROBE_RESP, "proberesp" },
+	{ IEEE80211_FC0_SUBTYPE_PROBE_RESP, "probe-resp" },
+	{ IEEE80211_FC0_SUBTYPE_BEACON, "beacon" },
+	{ IEEE80211_FC0_SUBTYPE_ATIM, "atim" },
+	{ IEEE80211_FC0_SUBTYPE_DISASSOC, "disassoc" },
+	{ IEEE80211_FC0_SUBTYPE_DISASSOC, "disassociation" },
+	{ IEEE80211_FC0_SUBTYPE_AUTH, "auth" },
+	{ IEEE80211_FC0_SUBTYPE_AUTH, "authentication" },
+	{ IEEE80211_FC0_SUBTYPE_DEAUTH, "deauth" },
+	{ IEEE80211_FC0_SUBTYPE_DEAUTH, "deauthentication" },
+	{ 0, NULL }
+};
+static const struct tok ieee80211_ctl_subtypes[] = {
+	{ IEEE80211_FC0_SUBTYPE_PS_POLL, "ps-poll" },
+	{ IEEE80211_FC0_SUBTYPE_RTS, "rts" },
+	{ IEEE80211_FC0_SUBTYPE_CTS, "cts" },
+	{ IEEE80211_FC0_SUBTYPE_ACK, "ack" },
+	{ IEEE80211_FC0_SUBTYPE_CF_END, "cf-end" },
+	{ IEEE80211_FC0_SUBTYPE_CF_END_ACK, "cf-end-ack" },
+	{ 0, NULL }
+};
+static const struct tok ieee80211_data_subtypes[] = {
+	{ IEEE80211_FC0_SUBTYPE_DATA, "data" },
+	{ IEEE80211_FC0_SUBTYPE_CF_ACK, "data-cf-ack" },
+	{ IEEE80211_FC0_SUBTYPE_CF_POLL, "data-cf-poll" },
+	{ IEEE80211_FC0_SUBTYPE_CF_ACPL, "data-cf-ack-poll" },
+	{ IEEE80211_FC0_SUBTYPE_NODATA, "null" },
+	{ IEEE80211_FC0_SUBTYPE_NODATA_CF_ACK, "cf-ack" },
+	{ IEEE80211_FC0_SUBTYPE_NODATA_CF_POLL, "cf-poll"  },
+	{ IEEE80211_FC0_SUBTYPE_NODATA_CF_ACPL, "cf-ack-poll" },
+	{ IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_SUBTYPE_DATA, "qos-data" },
+	{ IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_SUBTYPE_CF_ACK, "qos-data-cf-ack" },
+	{ IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_SUBTYPE_CF_POLL, "qos-data-cf-poll" },
+	{ IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_SUBTYPE_CF_ACPL, "qos-data-cf-ack-poll" },
+	{ IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_SUBTYPE_NODATA, "qos" },
+	{ IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_SUBTYPE_NODATA_CF_POLL, "qos-cf-poll" },
+	{ IEEE80211_FC0_SUBTYPE_QOS|IEEE80211_FC0_SUBTYPE_NODATA_CF_ACPL, "qos-cf-ack-poll" },
+	{ 0, NULL }
+};
+struct type2tok {
+	int type;
+	const struct tok *tok;
+};
+static const struct type2tok ieee80211_type_subtypes[] = {
+	{ IEEE80211_FC0_TYPE_MGT, ieee80211_mgt_subtypes },
+	{ IEEE80211_FC0_TYPE_CTL, ieee80211_ctl_subtypes },
+	{ IEEE80211_FC0_TYPE_DATA, ieee80211_data_subtypes },
+	{ 0, NULL }
+};
+
+static int
+str2tok(const char *str, const struct tok *toks)
+{
+	int i;
+
+	for (i = 0; toks[i].s != NULL; i++) {
+		if (pcap_strcasecmp(toks[i].s, str) == 0)
+			return (toks[i].v);
+	}
+	return (-1);
+}
+
 int n_errors = 0;
 
 static struct qual qerr = { Q_UNDEF, Q_UNDEF, Q_UNDEF, Q_UNDEF };
@@ -114,6 +201,16 @@ pfaction_to_num(const char *action)
 	else if (pcap_strcasecmp(action, "drop") == 0 ||
 		pcap_strcasecmp(action, "block") == 0)
 		return (PF_DROP);
+#if HAVE_PF_NAT_THROUGH_PF_NORDR
+	else if (pcap_strcasecmp(action, "rdr") == 0)
+		return (PF_RDR);
+	else if (pcap_strcasecmp(action, "nat") == 0)
+		return (PF_NAT);
+	else if (pcap_strcasecmp(action, "binat") == 0)
+		return (PF_BINAT);
+	else if (pcap_strcasecmp(action, "nordr") == 0)
+		return (PF_NORDR);
+#endif
 	else {
 		bpf_error("unknown PF action");
 		/*NOTREACHED*/
@@ -125,6 +222,9 @@ pfreason_to_num(const char *reason)
 {
 	bpf_error("libpcap was compiled on a machine without pf support");
 	/*NOTREACHED*/
+
+	/* this is to make the VC compiler happy */
+	return -1;
 }
 
 static int
@@ -132,6 +232,9 @@ pfaction_to_num(const char *action)
 {
 	bpf_error("libpcap was compiled on a machine without pf support");
 	/*NOTREACHED*/
+
+	/* this is to make the VC compiler happy */
+	return -1;
 }
 #endif /* HAVE_NET_PFVAR_H */
 %}
@@ -158,7 +261,7 @@ pfaction_to_num(const char *action)
 %type	<a>	arth narth
 %type	<i>	byteop pname pnum relop irelop
 %type	<blk>	and or paren not null prog
-%type	<rblk>	other pfvar
+%type	<rblk>	other pfvar p80211
 %type	<i>	atmtype atmmultitype
 %type	<blk>	atmfield
 %type	<blk>	atmfieldvalue atmvalue atmlistvalue
@@ -174,6 +277,7 @@ pfaction_to_num(const char *action)
 %token  TK_BROADCAST TK_MULTICAST
 %token  NUM INBOUND OUTBOUND
 %token  PF_IFNAME PF_RSET PF_RNR PF_SRNR PF_REASON PF_ACTION
+%token	TYPE SUBTYPE DIR ADDR1 ADDR2 ADDR3 ADDR4
 %token  LINK
 %token	GEQ LEQ NEQ
 %token	ID EID HID HID6 AID
@@ -197,7 +301,7 @@ pfaction_to_num(const char *action)
 %type	<e> EID
 %type	<e> AID
 %type	<s> HID HID6
-%type	<i> NUM action reason
+%type	<i> NUM action reason type subtype type_subtype dir
 
 %left OR AND
 %nonassoc  '!'
@@ -239,6 +343,14 @@ nid:	  ID			{ $$.b = gen_scode($1, $$.q = $<blk>0.q); }
 	| HID			{
 				  /* Decide how to parse HID based on proto */
 				  $$.q = $<blk>0.q;
+				  if ($$.q.addr == Q_PORT)
+				  	bpf_error("'port' modifier applied to ip host");
+				  else if ($$.q.addr == Q_PORTRANGE)
+				  	bpf_error("'portrange' modifier applied to ip host");
+				  else if ($$.q.addr == Q_PROTO)
+				  	bpf_error("'proto' modifier applied to ip host");
+				  else if ($$.q.addr == Q_PROTOCHAIN)
+				  	bpf_error("'protochain' modifier applied to ip host");
 				  $$.b = gen_ncode($1, 0, $$.q);
 				}
 	| HID6 '/' NUM		{
@@ -326,6 +438,10 @@ dqual:	  SRC			{ $$ = Q_SRC; }
 	| DST OR SRC		{ $$ = Q_OR; }
 	| SRC AND DST		{ $$ = Q_AND; }
 	| DST AND SRC		{ $$ = Q_AND; }
+	| ADDR1			{ $$ = Q_ADDR1; }
+	| ADDR2			{ $$ = Q_ADDR2; }
+	| ADDR3			{ $$ = Q_ADDR3; }
+	| ADDR4			{ $$ = Q_ADDR4; }
 	;
 /* address type qualifiers */
 aqual:	  HOST			{ $$ = Q_HOST; }
@@ -389,6 +505,7 @@ other:	  pqual TK_BROADCAST	{ $$ = gen_broadcast($1); }
 	| PPPOED		{ $$ = gen_pppoed(); }
 	| PPPOES		{ $$ = gen_pppoes(); }
 	| pfvar			{ $$ = $1; }
+	| pqual p80211		{ $$ = $2; }
 	;
 
 pfvar:	  PF_IFNAME ID		{ $$ = gen_pf_ifname($2); }
@@ -399,6 +516,79 @@ pfvar:	  PF_IFNAME ID		{ $$ = gen_pf_ifname($2); }
 	| PF_ACTION action	{ $$ = gen_pf_action($2); }
 	;
 
+p80211:   TYPE type SUBTYPE subtype
+				{ $$ = gen_p80211_type($2 | $4,
+					IEEE80211_FC0_TYPE_MASK |
+					IEEE80211_FC0_SUBTYPE_MASK);
+				}
+	| TYPE type		{ $$ = gen_p80211_type($2,
+					IEEE80211_FC0_TYPE_MASK);
+				}
+	| SUBTYPE type_subtype	{ $$ = gen_p80211_type($2,
+					IEEE80211_FC0_TYPE_MASK |
+					IEEE80211_FC0_SUBTYPE_MASK);
+				}
+	| DIR dir		{ $$ = gen_p80211_fcdir($2); }
+	;
+
+type:	  NUM
+	| ID			{ $$ = str2tok($1, ieee80211_types);
+				  if ($$ == -1)
+				  	bpf_error("unknown 802.11 type name");
+				}
+	;
+
+subtype:  NUM
+	| ID			{ const struct tok *types = NULL;
+				  int i;
+				  for (i = 0;; i++) {
+				  	if (ieee80211_type_subtypes[i].tok == NULL) {
+				  		/* Ran out of types */
+						bpf_error("unknown 802.11 type");
+						break;
+					}
+					if ($<i>-1 == ieee80211_type_subtypes[i].type) {
+						types = ieee80211_type_subtypes[i].tok;
+						break;
+					}
+				  }
+
+				  $$ = str2tok($1, types);
+				  if ($$ == -1)
+					bpf_error("unknown 802.11 subtype name");
+				}
+	;
+
+type_subtype:	ID		{ int i;
+				  for (i = 0;; i++) {
+				  	if (ieee80211_type_subtypes[i].tok == NULL) {
+				  		/* Ran out of types */
+						bpf_error("unknown 802.11 type name");
+						break;
+					}
+					$$ = str2tok($1, ieee80211_type_subtypes[i].tok);
+					if ($$ != -1) {
+						$$ |= ieee80211_type_subtypes[i].type;
+						break;
+					}
+				  }
+				}
+		;
+
+dir:	  NUM
+	| ID			{ if (pcap_strcasecmp($1, "nods") == 0)
+					$$ = IEEE80211_FC1_DIR_NODS;
+				  else if (pcap_strcasecmp($1, "tods") == 0)
+					$$ = IEEE80211_FC1_DIR_TODS;
+				  else if (pcap_strcasecmp($1, "fromds") == 0)
+					$$ = IEEE80211_FC1_DIR_FROMDS;
+				  else if (pcap_strcasecmp($1, "dstods") == 0)
+					$$ = IEEE80211_FC1_DIR_DSTODS;
+				  else
+					bpf_error("unknown 802.11 direction");
+				}
+	;
+
 reason:	  NUM			{ $$ = $1; }
 	| ID			{ $$ = pfreason_to_num($1); }
 	;
diff --git a/contrib/libpcap/ieee80211.h b/contrib/libpcap/ieee80211.h
new file mode 100644
index 0000000..d79f0f8
--- /dev/null
+++ b/contrib/libpcap/ieee80211.h
@@ -0,0 +1,146 @@
+/*-
+ * Copyright (c) 2001 Atsushi Onoe
+ * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+#ifndef _NET80211_IEEE80211_H_
+#define _NET80211_IEEE80211_H_
+
+/*
+ * 802.11 protocol definitions.
+ */
+
+#define	IEEE80211_FC0_VERSION_MASK		0x03
+#define	IEEE80211_FC0_VERSION_SHIFT		0
+#define	IEEE80211_FC0_VERSION_0			0x00
+#define	IEEE80211_FC0_TYPE_MASK			0x0c
+#define	IEEE80211_FC0_TYPE_SHIFT		2
+#define	IEEE80211_FC0_TYPE_MGT			0x00
+#define	IEEE80211_FC0_TYPE_CTL			0x04
+#define	IEEE80211_FC0_TYPE_DATA			0x08
+
+#define	IEEE80211_FC0_SUBTYPE_MASK		0xf0
+#define	IEEE80211_FC0_SUBTYPE_SHIFT		4
+/* for TYPE_MGT */
+#define	IEEE80211_FC0_SUBTYPE_ASSOC_REQ		0x00
+#define	IEEE80211_FC0_SUBTYPE_ASSOC_RESP	0x10
+#define	IEEE80211_FC0_SUBTYPE_REASSOC_REQ	0x20
+#define	IEEE80211_FC0_SUBTYPE_REASSOC_RESP	0x30
+#define	IEEE80211_FC0_SUBTYPE_PROBE_REQ		0x40
+#define	IEEE80211_FC0_SUBTYPE_PROBE_RESP	0x50
+#define	IEEE80211_FC0_SUBTYPE_BEACON		0x80
+#define	IEEE80211_FC0_SUBTYPE_ATIM		0x90
+#define	IEEE80211_FC0_SUBTYPE_DISASSOC		0xa0
+#define	IEEE80211_FC0_SUBTYPE_AUTH		0xb0
+#define	IEEE80211_FC0_SUBTYPE_DEAUTH		0xc0
+/* for TYPE_CTL */
+#define	IEEE80211_FC0_SUBTYPE_PS_POLL		0xa0
+#define	IEEE80211_FC0_SUBTYPE_RTS		0xb0
+#define	IEEE80211_FC0_SUBTYPE_CTS		0xc0
+#define	IEEE80211_FC0_SUBTYPE_ACK		0xd0
+#define	IEEE80211_FC0_SUBTYPE_CF_END		0xe0
+#define	IEEE80211_FC0_SUBTYPE_CF_END_ACK	0xf0
+/* for TYPE_DATA (bit combination) */
+#define	IEEE80211_FC0_SUBTYPE_DATA		0x00
+#define	IEEE80211_FC0_SUBTYPE_CF_ACK		0x10
+#define	IEEE80211_FC0_SUBTYPE_CF_POLL		0x20
+#define	IEEE80211_FC0_SUBTYPE_CF_ACPL		0x30
+#define	IEEE80211_FC0_SUBTYPE_NODATA		0x40
+#define	IEEE80211_FC0_SUBTYPE_NODATA_CF_ACK	0x50
+#define	IEEE80211_FC0_SUBTYPE_NODATA_CF_POLL	0x60
+#define	IEEE80211_FC0_SUBTYPE_NODATA_CF_ACPL	0x70
+#define	IEEE80211_FC0_SUBTYPE_QOS		0x80
+#define	IEEE80211_FC0_SUBTYPE_QOS_NULL		0xc0
+
+#define	IEEE80211_FC1_DIR_MASK			0x03
+#define	IEEE80211_FC1_DIR_NODS			0x00	/* STA->STA */
+#define	IEEE80211_FC1_DIR_TODS			0x01	/* STA->AP  */
+#define	IEEE80211_FC1_DIR_FROMDS		0x02	/* AP ->STA */
+#define	IEEE80211_FC1_DIR_DSTODS		0x03	/* AP ->AP  */
+
+#define	IEEE80211_FC1_MORE_FRAG			0x04
+#define	IEEE80211_FC1_RETRY			0x08
+#define	IEEE80211_FC1_PWR_MGT			0x10
+#define	IEEE80211_FC1_MORE_DATA			0x20
+#define	IEEE80211_FC1_WEP			0x40
+#define	IEEE80211_FC1_ORDER			0x80
+
+#define	IEEE80211_SEQ_FRAG_MASK			0x000f
+#define	IEEE80211_SEQ_FRAG_SHIFT		0
+#define	IEEE80211_SEQ_SEQ_MASK			0xfff0
+#define	IEEE80211_SEQ_SEQ_SHIFT			4
+
+#define	IEEE80211_NWID_LEN			32
+
+#define	IEEE80211_QOS_TXOP			0x00ff
+/* bit 8 is reserved */
+#define	IEEE80211_QOS_ACKPOLICY			0x60
+#define	IEEE80211_QOS_ACKPOLICY_S		5
+#define	IEEE80211_QOS_ESOP			0x10
+#define	IEEE80211_QOS_ESOP_S			4
+#define	IEEE80211_QOS_TID			0x0f
+
+#define IEEE80211_MGT_SUBTYPE_NAMES {			\
+	"assoc-req",		"assoc-resp",		\
+	"reassoc-req",		"reassoc-resp",		\
+	"probe-req",		"probe-resp",		\
+	"reserved#6",		"reserved#7",		\
+	"beacon",		"atim",			\
+	"disassoc",		"auth",			\
+	"deauth",		"reserved#13",		\
+	"reserved#14",		"reserved#15"		\
+}
+
+#define IEEE80211_CTL_SUBTYPE_NAMES {			\
+	"reserved#0",		"reserved#1",		\
+	"reserved#2",		"reserved#3",		\
+	"reserved#3",		"reserved#5",		\
+	"reserved#6",		"reserved#7",		\
+	"reserved#8",		"reserved#9",		\
+	"ps-poll",		"rts",			\
+	"cts",			"ack",			\
+	"cf-end",		"cf-end-ack"		\
+}
+
+#define IEEE80211_DATA_SUBTYPE_NAMES {			\
+	"data",			"data-cf-ack",		\
+	"data-cf-poll",		"data-cf-ack-poll",	\
+	"null",			"cf-ack",		\
+	"cf-poll",		"cf-ack-poll",		\
+	"qos-data",		"qos-data-cf-ack",	\
+	"qos-data-cf-poll",	"qos-data-cf-ack-poll",	\
+	"qos",			"reserved#13",		\
+	"qos-cf-poll",		"qos-cf-ack-poll"	\
+}
+
+#define IEEE80211_TYPE_NAMES	{ "mgt", "ctl", "data", "reserved#4" }
+
+#endif /* _NET80211_IEEE80211_H_ */
diff --git a/contrib/libpcap/inet.c b/contrib/libpcap/inet.c
index 8a44728..aad8796 100644
--- a/contrib/libpcap/inet.c
+++ b/contrib/libpcap/inet.c
@@ -34,7 +34,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.66.2.6 2007/06/11 09:52:04 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.75.2.4 2008-04-20 18:19:24 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -356,6 +356,40 @@ add_or_find_if(pcap_if_t **curdev_ret, pcap_if_t **alldevs, const char *name,
 	return (0);
 }
 
+/*
+ * XXX - on FreeBSDs that support it, should it get the sysctl named
+ * "dev.{adapter family name}.{adapter unit}.%desc" to get a description
+ * of the adapter?  Note that "dev.an.0.%desc" is "Aironet PC4500/PC4800"
+ * with my Cisco 350 card, so the name isn't entirely descriptive.  The
+ * "dev.an.0.%pnpinfo" has a better description, although one might argue
+ * that the problem is really a driver bug - if it can find out that it's
+ * a Cisco 340 or 350, rather than an old Aironet card, it should use
+ * that in the description.
+ *
+ * Do NetBSD, DragonflyBSD, or OpenBSD support this as well?  OpenBSD
+ * lets you get a description, but it's not generated by the OS, it's
+ * set with another ioctl that ifconfig supports; we use that to get
+ * the description in OpenBSD.
+ *
+ * In OS X, the System Configuration framework can apparently return
+ * names in 10.4 and later; it also appears that freedesktop.org's HAL
+ * offers an "info.product" string, but the HAL specification says
+ * it "should not be used in any UI" and "subsystem/capability
+ * specific properties" should be used instead.  Using that would
+ * require that libpcap applications be linked with the frameworks/
+ * libraries in question, which would be a bit of a pain unless we
+ * offer, for example, a pkg-config:
+ *
+ *	http://pkg-config.freedesktop.org/wiki/
+ *
+ * script, so applications can just use that script to find out what
+ * libraries you need to link with when linking with libpcap.
+ * pkg-config is GPLed; I don't know whether that would prevent its
+ * use with a BSD-licensed library such as libpcap.
+ *
+ * Do any other UN*Xes, or desktop environments support getting a
+ * description?
+ */
 int
 add_addr_to_iflist(pcap_if_t **alldevs, const char *name, u_int flags,
     struct sockaddr *addr, size_t addr_size,
@@ -365,9 +399,32 @@ add_addr_to_iflist(pcap_if_t **alldevs, const char *name, u_int flags,
     char *errbuf)
 {
 	pcap_if_t *curdev;
+	char *description = NULL;
 	pcap_addr_t *curaddr, *prevaddr, *nextaddr;
+#ifdef SIOCGIFDESCR
+	struct ifreq ifrdesc;
+	char ifdescr[IFDESCRSIZE];
+	int s;
+#endif
 
-	if (add_or_find_if(&curdev, alldevs, name, flags, NULL, errbuf) == -1) {
+#ifdef SIOCGIFDESCR
+	/*
+	 * Get the description for the interface.
+	 */
+	memset(&ifrdesc, 0, sizeof ifrdesc);
+	strlcpy(ifrdesc.ifr_name, name, sizeof ifrdesc.ifr_name);
+	ifrdesc.ifr_data = (caddr_t)&ifdescr;
+	s = socket(AF_INET, SOCK_DGRAM, 0);
+	if (s >= 0) {
+		if (ioctl(s, SIOCGIFDESCR, &ifrdesc) == 0 &&
+		    strlen(ifrdesc.ifr_data) != 0)
+			description = ifrdesc.ifr_data;
+		close(s);
+	}
+#endif
+
+	if (add_or_find_if(&curdev, alldevs, name, flags, description,
+	    errbuf) == -1) {
 		/*
 		 * Error - give up.
 		 */
@@ -608,6 +665,12 @@ pcap_lookupnet(device, netp, maskp, errbuf)
 #ifdef HAVE_SEPTEL_API
 	    || strstr(device, "septel") != NULL
 #endif
+#ifdef PCAP_SUPPORT_BT
+	    || strstr(device, "bluetooth") != NULL
+#endif
+#ifdef PCAP_SUPPORT_USB
+	    || strstr(device, "usb") != NULL
+#endif
 	    ) {
 		*netp = *maskp = 0;
 		return 0;
diff --git a/contrib/libpcap/missing/snprintf.c b/contrib/libpcap/missing/snprintf.c
new file mode 100644
index 0000000..9c0a6ee
--- /dev/null
+++ b/contrib/libpcap/missing/snprintf.c
@@ -0,0 +1,632 @@
+/*
+ * Copyright (c) 1995-1999 Kungliga Tekniska H�gskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* $Id: snprintf.c,v 1.1 2004/04/05 22:43:51 guy Exp $ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifndef lint
+static const char rcsid[] _U_ =
+     "@(#) $Header: /tcpdump/master/libpcap/missing/snprintf.c,v 1.1 2004/04/05 22:43:51 guy Exp $";
+#endif
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <sys/types.h>
+
+#include <pcap-int.h>
+
+enum format_flags {
+    minus_flag     =  1,
+    plus_flag      =  2,
+    space_flag     =  4,
+    alternate_flag =  8,
+    zero_flag      = 16
+};
+
+/*
+ * Common state
+ */
+
+struct state {
+  unsigned char *str;
+  unsigned char *s;
+  unsigned char *theend;
+  size_t sz;
+  size_t max_sz;
+  int (*append_char)(struct state *, unsigned char);
+  int (*reserve)(struct state *, size_t);
+  /* XXX - methods */
+};
+
+#ifndef HAVE_VSNPRINTF
+static int
+sn_reserve (struct state *state, size_t n)
+{
+  return state->s + n > state->theend;
+}
+
+static int
+sn_append_char (struct state *state, unsigned char c)
+{
+  if (sn_reserve (state, 1)) {
+    return 1;
+  } else {
+    *state->s++ = c;
+    return 0;
+  }
+}
+#endif
+
+#if 0
+static int
+as_reserve (struct state *state, size_t n)
+{
+  if (state->s + n > state->theend) {
+    int off = state->s - state->str;
+    unsigned char *tmp;
+
+    if (state->max_sz && state->sz >= state->max_sz)
+      return 1;
+
+    state->sz = max(state->sz * 2, state->sz + n);
+    if (state->max_sz)
+      state->sz = min(state->sz, state->max_sz);
+    tmp = realloc (state->str, state->sz);
+    if (tmp == NULL)
+      return 1;
+    state->str = tmp;
+    state->s = state->str + off;
+    state->theend = state->str + state->sz - 1;
+  }
+  return 0;
+}
+
+static int
+as_append_char (struct state *state, unsigned char c)
+{
+  if(as_reserve (state, 1))
+    return 1;
+  else {
+    *state->s++ = c;
+    return 0;
+  }
+}
+#endif
+
+static int
+append_number(struct state *state,
+	      unsigned long num, unsigned base, char *rep,
+	      int width, int prec, int flags, int minusp)
+{
+  int len = 0;
+  int i;
+
+  /* given precision, ignore zero flag */
+  if(prec != -1)
+    flags &= ~zero_flag;
+  else
+    prec = 1;
+  /* zero value with zero precision -> "" */
+  if(prec == 0 && num == 0)
+    return 0;
+  do{
+    if((*state->append_char)(state, rep[num % base]))
+      return 1;
+    len++;
+    num /= base;
+  }while(num);
+  prec -= len;
+  /* pad with prec zeros */
+  while(prec-- > 0){
+    if((*state->append_char)(state, '0'))
+      return 1;
+    len++;
+  }
+  /* add length of alternate prefix (added later) to len */
+  if(flags & alternate_flag && (base == 16 || base == 8))
+    len += base / 8;
+  /* pad with zeros */
+  if(flags & zero_flag){
+    width -= len;
+    if(minusp || (flags & space_flag) || (flags & plus_flag))
+      width--;
+    while(width-- > 0){
+      if((*state->append_char)(state, '0'))
+	return 1;
+      len++;
+    }
+  }
+  /* add alternate prefix */
+  if(flags & alternate_flag && (base == 16 || base == 8)){
+    if(base == 16)
+      if((*state->append_char)(state, rep[10] + 23)) /* XXX */
+	return 1;
+    if((*state->append_char)(state, '0'))
+      return 1;
+  }
+  /* add sign */
+  if(minusp){
+    if((*state->append_char)(state, '-'))
+      return 1;
+    len++;
+  } else if(flags & plus_flag) {
+    if((*state->append_char)(state, '+'))
+      return 1;
+    len++;
+  } else if(flags & space_flag) {
+    if((*state->append_char)(state, ' '))
+      return 1;
+    len++;
+  }
+  if(flags & minus_flag)
+    /* swap before padding with spaces */
+    for(i = 0; i < len / 2; i++){
+      char c = state->s[-i-1];
+      state->s[-i-1] = state->s[-len+i];
+      state->s[-len+i] = c;
+    }
+  width -= len;
+  while(width-- > 0){
+    if((*state->append_char)(state,  ' '))
+      return 1;
+    len++;
+  }
+  if(!(flags & minus_flag))
+    /* swap after padding with spaces */
+    for(i = 0; i < len / 2; i++){
+      char c = state->s[-i-1];
+      state->s[-i-1] = state->s[-len+i];
+      state->s[-len+i] = c;
+    }
+
+  return 0;
+}
+
+static int
+append_string (struct state *state,
+	       unsigned char *arg,
+	       int width,
+	       int prec,
+	       int flags)
+{
+  if(prec != -1)
+    width -= prec;
+  else
+    width -= strlen((char *)arg);
+  if(!(flags & minus_flag))
+    while(width-- > 0)
+      if((*state->append_char) (state, ' '))
+	return 1;
+  if (prec != -1) {
+    while (*arg && prec--)
+      if ((*state->append_char) (state, *arg++))
+	return 1;
+  } else {
+    while (*arg)
+      if ((*state->append_char) (state, *arg++))
+	return 1;
+  }
+  if(flags & minus_flag)
+    while(width-- > 0)
+      if((*state->append_char) (state, ' '))
+	return 1;
+  return 0;
+}
+
+static int
+append_char(struct state *state,
+	    unsigned char arg,
+	    int width,
+	    int flags)
+{
+  while(!(flags & minus_flag) && --width > 0)
+    if((*state->append_char) (state, ' '))
+      return 1;
+
+  if((*state->append_char) (state, arg))
+    return 1;
+  while((flags & minus_flag) && --width > 0)
+    if((*state->append_char) (state, ' '))
+      return 1;
+
+  return 0;
+}
+
+/*
+ * This can't be made into a function...
+ */
+
+#define PARSE_INT_FORMAT(res, arg, unsig) \
+if (long_flag) \
+     res = (unsig long)va_arg(arg, unsig long); \
+else if (short_flag) \
+     res = (unsig short)va_arg(arg, unsig int); \
+else \
+     res = (unsig int)va_arg(arg, unsig int)
+
+/*
+ * zyxprintf - return 0 or -1
+ */
+
+static int
+xyzprintf (struct state *state, const char *char_format, va_list ap)
+{
+  const unsigned char *format = (const unsigned char *)char_format;
+  unsigned char c;
+
+  while((c = *format++)) {
+    if (c == '%') {
+      int flags      = 0;
+      int width      = 0;
+      int prec       = -1;
+      int long_flag  = 0;
+      int short_flag = 0;
+
+      /* flags */
+      while((c = *format++)){
+	if(c == '-')
+	  flags |= minus_flag;
+	else if(c == '+')
+	  flags |= plus_flag;
+	else if(c == ' ')
+	  flags |= space_flag;
+	else if(c == '#')
+	  flags |= alternate_flag;
+	else if(c == '0')
+	  flags |= zero_flag;
+	else
+	  break;
+      }
+
+      if((flags & space_flag) && (flags & plus_flag))
+	flags ^= space_flag;
+
+      if((flags & minus_flag) && (flags & zero_flag))
+	flags ^= zero_flag;
+
+      /* width */
+      if (isdigit(c))
+	do {
+	  width = width * 10 + c - '0';
+	  c = *format++;
+	} while(isdigit(c));
+      else if(c == '*') {
+	width = va_arg(ap, int);
+	c = *format++;
+      }
+
+      /* precision */
+      if (c == '.') {
+	prec = 0;
+	c = *format++;
+	if (isdigit(c))
+	  do {
+	    prec = prec * 10 + c - '0';
+	    c = *format++;
+	  } while(isdigit(c));
+	else if (c == '*') {
+	  prec = va_arg(ap, int);
+	  c = *format++;
+	}
+      }
+
+      /* size */
+
+      if (c == 'h') {
+	short_flag = 1;
+	c = *format++;
+      } else if (c == 'l') {
+	long_flag = 1;
+	c = *format++;
+      }
+
+      switch (c) {
+      case 'c' :
+	if(append_char(state, va_arg(ap, int), width, flags))
+	  return -1;
+	break;
+      case 's' :
+	if (append_string(state,
+			  va_arg(ap, unsigned char*),
+			  width,
+			  prec,
+			  flags))
+	  return -1;
+	break;
+      case 'd' :
+      case 'i' : {
+	long arg;
+	unsigned long num;
+	int minusp = 0;
+
+	PARSE_INT_FORMAT(arg, ap, signed);
+
+	if (arg < 0) {
+	  minusp = 1;
+	  num = -arg;
+	} else
+	  num = arg;
+
+	if (append_number (state, num, 10, "0123456789",
+			   width, prec, flags, minusp))
+	  return -1;
+	break;
+      }
+      case 'u' : {
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 10, "0123456789",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'o' : {
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 010, "01234567",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'x' : {
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 0x10, "0123456789abcdef",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'X' :{
+	unsigned long arg;
+
+	PARSE_INT_FORMAT(arg, ap, unsigned);
+
+	if (append_number (state, arg, 0x10, "0123456789ABCDEF",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'p' : {
+	unsigned long arg = (unsigned long)va_arg(ap, void*);
+
+	if (append_number (state, arg, 0x10, "0123456789ABCDEF",
+			   width, prec, flags, 0))
+	  return -1;
+	break;
+      }
+      case 'n' : {
+	int *arg = va_arg(ap, int*);
+	*arg = state->s - state->str;
+	break;
+      }
+      case '\0' :
+	  --format;
+	  /* FALLTHROUGH */
+      case '%' :
+	if ((*state->append_char)(state, c))
+	  return -1;
+	break;
+      default :
+	if (   (*state->append_char)(state, '%')
+	    || (*state->append_char)(state, c))
+	  return -1;
+	break;
+      }
+    } else
+      if ((*state->append_char) (state, c))
+	return -1;
+  }
+  return 0;
+}
+
+#ifndef HAVE_SNPRINTF
+int
+snprintf (char *str, size_t sz, const char *format, ...)
+{
+  va_list args;
+  int ret;
+
+  va_start(args, format);
+  ret = vsnprintf (str, sz, format, args);
+
+#ifdef PARANOIA
+  {
+    int ret2;
+    char *tmp;
+
+    tmp = malloc (sz);
+    if (tmp == NULL)
+      abort ();
+
+    ret2 = vsprintf (tmp, format, args);
+    if (ret != ret2 || strcmp(str, tmp))
+      abort ();
+    free (tmp);
+  }
+#endif
+
+  va_end(args);
+  return ret;
+}
+#endif
+
+#if 0
+#ifndef HAVE_ASPRINTF
+int
+asprintf (char **ret, const char *format, ...)
+{
+  va_list args;
+  int val;
+
+  va_start(args, format);
+  val = vasprintf (ret, format, args);
+
+#ifdef PARANOIA
+  {
+    int ret2;
+    char *tmp;
+    tmp = malloc (val + 1);
+    if (tmp == NULL)
+      abort ();
+
+    ret2 = vsprintf (tmp, format, args);
+    if (val != ret2 || strcmp(*ret, tmp))
+      abort ();
+    free (tmp);
+  }
+#endif
+
+  va_end(args);
+  return val;
+}
+#endif
+
+#ifndef HAVE_ASNPRINTF
+int
+asnprintf (char **ret, size_t max_sz, const char *format, ...)
+{
+  va_list args;
+  int val;
+
+  va_start(args, format);
+  val = vasnprintf (ret, max_sz, format, args);
+
+#ifdef PARANOIA
+  {
+    int ret2;
+    char *tmp;
+    tmp = malloc (val + 1);
+    if (tmp == NULL)
+      abort ();
+
+    ret2 = vsprintf (tmp, format, args);
+    if (val != ret2 || strcmp(*ret, tmp))
+      abort ();
+    free (tmp);
+  }
+#endif
+
+  va_end(args);
+  return val;
+}
+#endif
+
+#ifndef HAVE_VASPRINTF
+int
+vasprintf (char **ret, const char *format, va_list args)
+{
+  return vasnprintf (ret, 0, format, args);
+}
+#endif
+
+
+#ifndef HAVE_VASNPRINTF
+int
+vasnprintf (char **ret, size_t max_sz, const char *format, va_list args)
+{
+  int st;
+  size_t len;
+  struct state state;
+
+  state.max_sz = max_sz;
+  state.sz     = 1;
+  state.str    = malloc(state.sz);
+  if (state.str == NULL) {
+    *ret = NULL;
+    return -1;
+  }
+  state.s = state.str;
+  state.theend = state.s + state.sz - 1;
+  state.append_char = as_append_char;
+  state.reserve     = as_reserve;
+
+  st = xyzprintf (&state, format, args);
+  if (st) {
+    free (state.str);
+    *ret = NULL;
+    return -1;
+  } else {
+    char *tmp;
+
+    *state.s = '\0';
+    len = state.s - state.str;
+    tmp = realloc (state.str, len+1);
+    if (tmp == NULL) {
+      free (state.str);
+      *ret = NULL;
+      return -1;
+    }
+    *ret = tmp;
+    return len;
+  }
+}
+#endif
+#endif
+
+#ifndef HAVE_VSNPRINTF
+int
+vsnprintf (char *str, size_t sz, const char *format, va_list args)
+{
+  struct state state;
+  int ret;
+  unsigned char *ustr = (unsigned char *)str;
+
+  state.max_sz = 0;
+  state.sz     = sz;
+  state.str    = ustr;
+  state.s      = ustr;
+  state.theend = ustr + sz - 1;
+  state.append_char = sn_append_char;
+  state.reserve     = sn_reserve;
+
+  ret = xyzprintf (&state, format, args);
+  *state.s = '\0';
+  if (ret)
+    return sz;
+  else
+    return state.s - state.str;
+}
+#endif
+
diff --git a/contrib/libpcap/mkdep b/contrib/libpcap/mkdep
index 2a9c221..b41a00e 100755
--- a/contrib/libpcap/mkdep
+++ b/contrib/libpcap/mkdep
@@ -13,7 +13,7 @@
 #	@(#)mkdep.sh	5.11 (Berkeley) 5/5/88
 #
 
-PATH=/bin:/usr/bin:/usr/ucb:/usr/local:/usr/local/bin
+PATH=/bin:/usr/bin:/usr/ucb:/usr/local:/usr/local/bin:/usr/sfw/bin
 export PATH
 
 MAKE=Makefile			# default makefile name is "Makefile"
diff --git a/contrib/libpcap/nametoaddr.c b/contrib/libpcap/nametoaddr.c
index 791c281..479f1fd 100644
--- a/contrib/libpcap/nametoaddr.c
+++ b/contrib/libpcap/nametoaddr.c
@@ -26,7 +26,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.77.2.4 2007/06/11 09:52:05 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.82.2.1 2008/02/06 10:21:47 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -82,7 +82,7 @@ struct rtentry;		/* declarations in <net/if.h> */
 #include "pcap-int.h"
 
 #include "gencode.h"
-#include <pcap-namedb.h>
+#include <pcap/namedb.h>
 
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
@@ -409,7 +409,15 @@ __pcap_atodn(const char *s, bpf_u_int32 *addr)
 }
 
 /*
- * Convert 's' which has the form "xx:xx:xx:xx:xx:xx" into a new
+ * Convert 's', which can have the one of the forms:
+ *
+ *	"xx:xx:xx:xx:xx:xx"
+ *	"xx.xx.xx.xx.xx.xx"
+ *	"xx-xx-xx-xx-xx-xx"
+ *	"xxxx.xxxx.xxxx"
+ *	"xxxxxxxxxxxx"
+ *
+ * (or various mixes of ':', '.', and '-') into a new
  * ethernet address.  Assumes 's' is well formed.
  */
 u_char *
@@ -421,7 +429,7 @@ pcap_ether_aton(const char *s)
 	e = ep = (u_char *)malloc(6);
 
 	while (*s) {
-		if (*s == ':')
+		if (*s == ':' || *s == '.' || *s == '-')
 			s += 1;
 		d = xdtoi(*s++);
 		if (isxdigit((unsigned char)*s)) {
diff --git a/contrib/libpcap/net/bpf_filter.c b/contrib/libpcap/net/bpf_filter.c
new file mode 100644
index 0000000..a2733d1
--- /dev/null
+++ b/contrib/libpcap/net/bpf_filter.c
@@ -0,0 +1,666 @@
+/*-
+ * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * This code is derived from the Stanford/CMU enet packet filter,
+ * (net/enet.c) distributed as part of 4.3BSD, and code contributed
+ * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
+ * Berkeley Laboratory.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the University of
+ *	California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	@(#)bpf.c	7.5 (Berkeley) 7/15/91
+ */
+
+#if !(defined(lint) || defined(KERNEL) || defined(_KERNEL))
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)";
+#endif
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#ifdef WIN32
+
+#include <pcap-stdinc.h>
+
+#else /* WIN32 */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/time.h>
+
+#define	SOLARIS	(defined(sun) && (defined(__SVR4) || defined(__svr4__)))
+#if defined(__hpux) || SOLARIS
+# include <sys/sysmacros.h>
+# include <sys/stream.h>
+# define	mbuf	msgb
+# define	m_next	b_cont
+# define	MLEN(m)	((m)->b_wptr - (m)->b_rptr)
+# define	mtod(m,t)	((t)(m)->b_rptr)
+#else
+# define	MLEN(m)	((m)->m_len)
+#endif
+
+#endif /* WIN32 */
+
+#include <pcap/bpf.h>
+
+#if !defined(KERNEL) && !defined(_KERNEL)
+#include <stdlib.h>
+#endif
+
+#define int32 bpf_int32
+#define u_int32 bpf_u_int32
+
+#ifndef LBL_ALIGN
+/*
+ * XXX - IA-64?  If not, this probably won't work on Win64 IA-64
+ * systems, unless LBL_ALIGN is defined elsewhere for them.
+ * XXX - SuperH?  If not, this probably won't work on WinCE SuperH
+ * systems, unless LBL_ALIGN is defined elsewhere for them.
+ */
+#if defined(sparc) || defined(__sparc__) || defined(mips) || \
+    defined(ibm032) || defined(__alpha) || defined(__hpux) || \
+    defined(__arm__)
+#define LBL_ALIGN
+#endif
+#endif
+
+#ifndef LBL_ALIGN
+#ifndef WIN32
+#include <netinet/in.h>
+#endif
+
+#define EXTRACT_SHORT(p)	((u_short)ntohs(*(u_short *)p))
+#define EXTRACT_LONG(p)		(ntohl(*(u_int32 *)p))
+#else
+#define EXTRACT_SHORT(p)\
+	((u_short)\
+		((u_short)*((u_char *)p+0)<<8|\
+		 (u_short)*((u_char *)p+1)<<0))
+#define EXTRACT_LONG(p)\
+		((u_int32)*((u_char *)p+0)<<24|\
+		 (u_int32)*((u_char *)p+1)<<16|\
+		 (u_int32)*((u_char *)p+2)<<8|\
+		 (u_int32)*((u_char *)p+3)<<0)
+#endif
+
+#if defined(KERNEL) || defined(_KERNEL)
+# if !defined(__hpux) && !SOLARIS
+#include <sys/mbuf.h>
+# endif
+#define MINDEX(len, _m, _k) \
+{ \
+	len = MLEN(m); \
+	while ((_k) >= len) { \
+		(_k) -= len; \
+		(_m) = (_m)->m_next; \
+		if ((_m) == 0) \
+			return 0; \
+		len = MLEN(m); \
+	} \
+}
+
+static int
+m_xword(m, k, err)
+	register struct mbuf *m;
+	register int k, *err;
+{
+	register int len;
+	register u_char *cp, *np;
+	register struct mbuf *m0;
+
+	MINDEX(len, m, k);
+	cp = mtod(m, u_char *) + k;
+	if (len - k >= 4) {
+		*err = 0;
+		return EXTRACT_LONG(cp);
+	}
+	m0 = m->m_next;
+	if (m0 == 0 || MLEN(m0) + len - k < 4)
+		goto bad;
+	*err = 0;
+	np = mtod(m0, u_char *);
+	switch (len - k) {
+
+	case 1:
+		return (cp[0] << 24) | (np[0] << 16) | (np[1] << 8) | np[2];
+
+	case 2:
+		return (cp[0] << 24) | (cp[1] << 16) | (np[0] << 8) | np[1];
+
+	default:
+		return (cp[0] << 24) | (cp[1] << 16) | (cp[2] << 8) | np[0];
+	}
+    bad:
+	*err = 1;
+	return 0;
+}
+
+static int
+m_xhalf(m, k, err)
+	register struct mbuf *m;
+	register int k, *err;
+{
+	register int len;
+	register u_char *cp;
+	register struct mbuf *m0;
+
+	MINDEX(len, m, k);
+	cp = mtod(m, u_char *) + k;
+	if (len - k >= 2) {
+		*err = 0;
+		return EXTRACT_SHORT(cp);
+	}
+	m0 = m->m_next;
+	if (m0 == 0)
+		goto bad;
+	*err = 0;
+	return (cp[0] << 8) | mtod(m0, u_char *)[0];
+ bad:
+	*err = 1;
+	return 0;
+}
+#endif
+
+/*
+ * Execute the filter program starting at pc on the packet p
+ * wirelen is the length of the original packet
+ * buflen is the amount of data present
+ * For the kernel, p is assumed to be a pointer to an mbuf if buflen is 0,
+ * in all other cases, p is a pointer to a buffer and buflen is its size.
+ */
+u_int
+bpf_filter(pc, p, wirelen, buflen)
+	register const struct bpf_insn *pc;
+	register const u_char *p;
+	u_int wirelen;
+	register u_int buflen;
+{
+	register u_int32 A, X;
+	register int k;
+	int32 mem[BPF_MEMWORDS];
+#if defined(KERNEL) || defined(_KERNEL)
+	struct mbuf *m, *n;
+	int merr, len;
+
+	if (buflen == 0) {
+		m = (struct mbuf *)p;
+		p = mtod(m, u_char *);
+		buflen = MLEN(m);
+	} else
+		m = NULL;
+#endif
+
+	if (pc == 0)
+		/*
+		 * No filter means accept all.
+		 */
+		return (u_int)-1;
+	A = 0;
+	X = 0;
+	--pc;
+	while (1) {
+		++pc;
+		switch (pc->code) {
+
+		default:
+#if defined(KERNEL) || defined(_KERNEL)
+			return 0;
+#else
+			abort();
+#endif
+		case BPF_RET|BPF_K:
+			return (u_int)pc->k;
+
+		case BPF_RET|BPF_A:
+			return (u_int)A;
+
+		case BPF_LD|BPF_W|BPF_ABS:
+			k = pc->k;
+			if (k + sizeof(int32) > buflen) {
+#if defined(KERNEL) || defined(_KERNEL)
+				if (m == NULL)
+					return 0;
+				A = m_xword(m, k, &merr);
+				if (merr != 0)
+					return 0;
+				continue;
+#else
+				return 0;
+#endif
+			}
+			A = EXTRACT_LONG(&p[k]);
+			continue;
+
+		case BPF_LD|BPF_H|BPF_ABS:
+			k = pc->k;
+			if (k + sizeof(short) > buflen) {
+#if defined(KERNEL) || defined(_KERNEL)
+				if (m == NULL)
+					return 0;
+				A = m_xhalf(m, k, &merr);
+				if (merr != 0)
+					return 0;
+				continue;
+#else
+				return 0;
+#endif
+			}
+			A = EXTRACT_SHORT(&p[k]);
+			continue;
+
+		case BPF_LD|BPF_B|BPF_ABS:
+			k = pc->k;
+			if (k >= buflen) {
+#if defined(KERNEL) || defined(_KERNEL)
+				if (m == NULL)
+					return 0;
+				n = m;
+				MINDEX(len, n, k);
+				A = mtod(n, u_char *)[k];
+				continue;
+#else
+				return 0;
+#endif
+			}
+			A = p[k];
+			continue;
+
+		case BPF_LD|BPF_W|BPF_LEN:
+			A = wirelen;
+			continue;
+
+		case BPF_LDX|BPF_W|BPF_LEN:
+			X = wirelen;
+			continue;
+
+		case BPF_LD|BPF_W|BPF_IND:
+			k = X + pc->k;
+			if (k + sizeof(int32) > buflen) {
+#if defined(KERNEL) || defined(_KERNEL)
+				if (m == NULL)
+					return 0;
+				A = m_xword(m, k, &merr);
+				if (merr != 0)
+					return 0;
+				continue;
+#else
+				return 0;
+#endif
+			}
+			A = EXTRACT_LONG(&p[k]);
+			continue;
+
+		case BPF_LD|BPF_H|BPF_IND:
+			k = X + pc->k;
+			if (k + sizeof(short) > buflen) {
+#if defined(KERNEL) || defined(_KERNEL)
+				if (m == NULL)
+					return 0;
+				A = m_xhalf(m, k, &merr);
+				if (merr != 0)
+					return 0;
+				continue;
+#else
+				return 0;
+#endif
+			}
+			A = EXTRACT_SHORT(&p[k]);
+			continue;
+
+		case BPF_LD|BPF_B|BPF_IND:
+			k = X + pc->k;
+			if (k >= buflen) {
+#if defined(KERNEL) || defined(_KERNEL)
+				if (m == NULL)
+					return 0;
+				n = m;
+				MINDEX(len, n, k);
+				A = mtod(n, u_char *)[k];
+				continue;
+#else
+				return 0;
+#endif
+			}
+			A = p[k];
+			continue;
+
+		case BPF_LDX|BPF_MSH|BPF_B:
+			k = pc->k;
+			if (k >= buflen) {
+#if defined(KERNEL) || defined(_KERNEL)
+				if (m == NULL)
+					return 0;
+				n = m;
+				MINDEX(len, n, k);
+				X = (mtod(n, char *)[k] & 0xf) << 2;
+				continue;
+#else
+				return 0;
+#endif
+			}
+			X = (p[pc->k] & 0xf) << 2;
+			continue;
+
+		case BPF_LD|BPF_IMM:
+			A = pc->k;
+			continue;
+
+		case BPF_LDX|BPF_IMM:
+			X = pc->k;
+			continue;
+
+		case BPF_LD|BPF_MEM:
+			A = mem[pc->k];
+			continue;
+
+		case BPF_LDX|BPF_MEM:
+			X = mem[pc->k];
+			continue;
+
+		case BPF_ST:
+			mem[pc->k] = A;
+			continue;
+
+		case BPF_STX:
+			mem[pc->k] = X;
+			continue;
+
+		case BPF_JMP|BPF_JA:
+			pc += pc->k;
+			continue;
+
+		case BPF_JMP|BPF_JGT|BPF_K:
+			pc += (A > pc->k) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_JMP|BPF_JGE|BPF_K:
+			pc += (A >= pc->k) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_JMP|BPF_JEQ|BPF_K:
+			pc += (A == pc->k) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_JMP|BPF_JSET|BPF_K:
+			pc += (A & pc->k) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_JMP|BPF_JGT|BPF_X:
+			pc += (A > X) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_JMP|BPF_JGE|BPF_X:
+			pc += (A >= X) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_JMP|BPF_JEQ|BPF_X:
+			pc += (A == X) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_JMP|BPF_JSET|BPF_X:
+			pc += (A & X) ? pc->jt : pc->jf;
+			continue;
+
+		case BPF_ALU|BPF_ADD|BPF_X:
+			A += X;
+			continue;
+
+		case BPF_ALU|BPF_SUB|BPF_X:
+			A -= X;
+			continue;
+
+		case BPF_ALU|BPF_MUL|BPF_X:
+			A *= X;
+			continue;
+
+		case BPF_ALU|BPF_DIV|BPF_X:
+			if (X == 0)
+				return 0;
+			A /= X;
+			continue;
+
+		case BPF_ALU|BPF_AND|BPF_X:
+			A &= X;
+			continue;
+
+		case BPF_ALU|BPF_OR|BPF_X:
+			A |= X;
+			continue;
+
+		case BPF_ALU|BPF_LSH|BPF_X:
+			A <<= X;
+			continue;
+
+		case BPF_ALU|BPF_RSH|BPF_X:
+			A >>= X;
+			continue;
+
+		case BPF_ALU|BPF_ADD|BPF_K:
+			A += pc->k;
+			continue;
+
+		case BPF_ALU|BPF_SUB|BPF_K:
+			A -= pc->k;
+			continue;
+
+		case BPF_ALU|BPF_MUL|BPF_K:
+			A *= pc->k;
+			continue;
+
+		case BPF_ALU|BPF_DIV|BPF_K:
+			A /= pc->k;
+			continue;
+
+		case BPF_ALU|BPF_AND|BPF_K:
+			A &= pc->k;
+			continue;
+
+		case BPF_ALU|BPF_OR|BPF_K:
+			A |= pc->k;
+			continue;
+
+		case BPF_ALU|BPF_LSH|BPF_K:
+			A <<= pc->k;
+			continue;
+
+		case BPF_ALU|BPF_RSH|BPF_K:
+			A >>= pc->k;
+			continue;
+
+		case BPF_ALU|BPF_NEG:
+			A = -A;
+			continue;
+
+		case BPF_MISC|BPF_TAX:
+			X = A;
+			continue;
+
+		case BPF_MISC|BPF_TXA:
+			A = X;
+			continue;
+		}
+	}
+}
+
+/*
+ * Return true if the 'fcode' is a valid filter program.
+ * The constraints are that each jump be forward and to a valid
+ * code, that memory accesses are within valid ranges (to the
+ * extent that this can be checked statically; loads of packet
+ * data have to be, and are, also checked at run time), and that
+ * the code terminates with either an accept or reject.
+ *
+ * The kernel needs to be able to verify an application's filter code.
+ * Otherwise, a bogus program could easily crash the system.
+ */
+int
+bpf_validate(f, len)
+	const struct bpf_insn *f;
+	int len;
+{
+	u_int i, from;
+	const struct bpf_insn *p;
+
+	if (len < 1)
+		return 0;
+	/*
+	 * There's no maximum program length in userland.
+	 */
+#if defined(KERNEL) || defined(_KERNEL)
+	if (len > BPF_MAXINSNS)
+		return 0;
+#endif
+
+	for (i = 0; i < len; ++i) {
+		p = &f[i];
+		switch (BPF_CLASS(p->code)) {
+		/*
+		 * Check that memory operations use valid addresses.
+		 */
+		case BPF_LD:
+		case BPF_LDX:
+			switch (BPF_MODE(p->code)) {
+			case BPF_IMM:
+				break;
+			case BPF_ABS:
+			case BPF_IND:
+			case BPF_MSH:
+				/*
+				 * There's no maximum packet data size
+				 * in userland.  The runtime packet length
+				 * check suffices.
+				 */
+#if defined(KERNEL) || defined(_KERNEL)
+				/*
+				 * More strict check with actual packet length
+				 * is done runtime.
+				 */
+				if (p->k >= bpf_maxbufsize)
+					return 0;
+#endif
+				break;
+			case BPF_MEM:
+				if (p->k >= BPF_MEMWORDS)
+					return 0;
+				break;
+			case BPF_LEN:
+				break;
+			default:
+				return 0;
+			}
+			break;
+		case BPF_ST:
+		case BPF_STX:
+			if (p->k >= BPF_MEMWORDS)
+				return 0;
+			break;
+		case BPF_ALU:
+			switch (BPF_OP(p->code)) {
+			case BPF_ADD:
+			case BPF_SUB:
+			case BPF_MUL:
+			case BPF_OR:
+			case BPF_AND:
+			case BPF_LSH:
+			case BPF_RSH:
+			case BPF_NEG:
+				break;
+			case BPF_DIV:
+				/*
+				 * Check for constant division by 0.
+				 */
+				if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
+					return 0;
+				break;
+			default:
+				return 0;
+			}
+			break;
+		case BPF_JMP:
+			/*
+			 * Check that jumps are within the code block,
+			 * and that unconditional branches don't go
+			 * backwards as a result of an overflow.
+			 * Unconditional branches have a 32-bit offset,
+			 * so they could overflow; we check to make
+			 * sure they don't.  Conditional branches have
+			 * an 8-bit offset, and the from address is <=
+			 * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
+			 * is sufficiently small that adding 255 to it
+			 * won't overflow.
+			 *
+			 * We know that len is <= BPF_MAXINSNS, and we
+			 * assume that BPF_MAXINSNS is < the maximum size
+			 * of a u_int, so that i + 1 doesn't overflow.
+			 *
+			 * For userland, we don't know that the from
+			 * or len are <= BPF_MAXINSNS, but we know that
+			 * from <= len, and, except on a 64-bit system,
+			 * it's unlikely that len, if it truly reflects
+			 * the size of the program we've been handed,
+			 * will be anywhere near the maximum size of
+			 * a u_int.  We also don't check for backward
+			 * branches, as we currently support them in
+			 * userland for the protochain operation.
+			 */
+			from = i + 1;
+			switch (BPF_OP(p->code)) {
+			case BPF_JA:
+#if defined(KERNEL) || defined(_KERNEL)
+				if (from + p->k < from || from + p->k >= len)
+#else
+				if (from + p->k >= len)
+#endif
+					return 0;
+				break;
+			case BPF_JEQ:
+			case BPF_JGT:
+			case BPF_JGE:
+			case BPF_JSET:
+				if (from + p->jt >= len || from + p->jf >= len)
+					return 0;
+				break;
+			default:
+				return 0;
+			}
+			break;
+		case BPF_RET:
+			break;
+		case BPF_MISC:
+			break;
+		default:
+			return 0;
+		}
+	}
+	return BPF_CLASS(f[len - 1].code) == BPF_RET;
+}
diff --git a/contrib/libpcap/optimize.c b/contrib/libpcap/optimize.c
index d39273b..475313f 100644
--- a/contrib/libpcap/optimize.c
+++ b/contrib/libpcap/optimize.c
@@ -22,7 +22,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.85.2.3 2007/09/12 21:29:45 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.90.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -53,6 +53,10 @@ extern int _w32_ffs (int mask);
 #define ffs _w32_ffs
 #endif
 
+#if defined(WIN32) && defined (_MSC_VER)
+int ffs(int mask);
+#endif
+
 /*
  * Represents a deleted instruction.
  */
@@ -906,6 +910,17 @@ opt_peep(b)
 			JF(b) = JT(b);
 	}
 	/*
+	 * If we're comparing against the index register, and the index
+	 * register is a known constant, we can just compare against that
+	 * constant.
+	 */
+	val = b->val[X_ATOM];
+	if (vmap[val].is_const && BPF_SRC(b->s.code) == BPF_X) {
+		bpf_int32 v = vmap[val].const_val;
+		b->s.code &= ~BPF_X;
+		b->s.k = v;
+	}
+	/*
 	 * If the accumulator is a known constant, we can compute the
 	 * comparison result.
 	 */
@@ -2277,6 +2292,15 @@ install_bpf_program(pcap_t *p, struct bpf_program *fp)
 	size_t prog_size;
 
 	/*
+	 * Validate the program.
+	 */
+	if (!bpf_validate(fp->bf_insns, fp->bf_len)) {
+		snprintf(p->errbuf, sizeof(p->errbuf),
+			"BPF program is not valid");
+		return (-1);
+	}
+
+	/*
 	 * Free up any already installed program.
 	 */
 	pcap_freecode(&p->fcode);
diff --git a/contrib/libpcap/packaging/pcap.spec.in b/contrib/libpcap/packaging/pcap.spec.in
index 388427e..9e63dac 100644
--- a/contrib/libpcap/packaging/pcap.spec.in
+++ b/contrib/libpcap/packaging/pcap.spec.in
@@ -15,7 +15,7 @@ URL: http://www.tcpdump.org
 Packet-capture library LIBPCAP @VERSION@
 Now maintained by "The Tcpdump Group"
 See http://www.tcpdump.org
-Please send inquiries/comments/reports to tcpdump-workers@tcpdump.org
+Please send inquiries/comments/reports to tcpdump-workers@lists.tcpdump.org
 
 %prep
 %setup
@@ -29,10 +29,6 @@ make
 
 %install
 rm -rf $RPM_BUILD_ROOT
-mkdir -p $RPM_BUILD_ROOT/usr/{lib,include}
-mkdir -p $RPM_BUILD_ROOT/usr/share/man
-mkdir -p $RPM_BUILD_ROOT/usr/include/net
-mkdir -p $RPM_BUILD_ROOT/usr/man/man3
 make install DESTDIR=$RPM_BUILD_ROOT mandir=/usr/share/man
 cd $RPM_BUILD_ROOT/usr/lib
 V1=`echo @VERSION@ | sed 's/\\.[^\.]*$//g'`
@@ -45,12 +41,6 @@ else
     ln -sf libpcap.so.$V1 libpcap.so
 fi
 
-#install -m 755 -o root libpcap.a $RPM_BUILD_ROOT/usr/lib
-#install -m 644 -o root pcap.3 $RPM_BUILD_ROOT/usr/man/man3
-#install -m 644 -o root pcap.h $RPM_BUILD_ROOT/usr/include
-#install -m 644 -o root pcap-bpf.h $RPM_BUILD_ROOT/usr/include/net
-#install -m 644 -o root pcap-namedb.h $RPM_BUILD_ROOT/usr/include
-
 %clean
 rm -rf $RPM_BUILD_ROOT
 
@@ -59,7 +49,10 @@ rm -rf $RPM_BUILD_ROOT
 %doc LICENSE CHANGES INSTALL.txt README.linux TODO VERSION CREDITS packaging/pcap.spec
 /usr/lib/libpcap.a
 /usr/share/man/man3/*
+/usr/share/man/man5/*
+/usr/share/man/man7/*
 /usr/include/pcap.h
+/usr/include/pcap/*.h
 /usr/include/pcap-bpf.h
 /usr/include/pcap-namedb.h
 /usr/lib/libpcap.so*
diff --git a/contrib/libpcap/pcap-bpf.c b/contrib/libpcap/pcap-bpf.c
index d398ec7..5ffcb83 100644
--- a/contrib/libpcap/pcap-bpf.c
+++ b/contrib/libpcap/pcap-bpf.c
@@ -22,7 +22,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.86.2.12 2007/06/15 17:57:27 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.99.2.17 2008-09-16 18:43:02 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -30,7 +30,9 @@ static const char rcsid[] _U_ =
 #endif
 
 #include <sys/param.h>			/* optionally get BSD define */
+#ifdef HAVE_ZEROCOPY_BPF
 #include <sys/mman.h>
+#endif
 #include <sys/time.h>
 #include <sys/timeb.h>
 #include <sys/socket.h>
@@ -38,12 +40,16 @@ static const char rcsid[] _U_ =
 #include <sys/ioctl.h>
 #include <sys/utsname.h>
 
+#ifdef HAVE_ZEROCOPY_BPF
+#include <machine/atomic.h>
+#endif
+
 #include <net/if.h>
 
 #ifdef _AIX
 
 /*
- * Make "pcap.h" not include "pcap-bpf.h"; we are going to include the
+ * Make "pcap.h" not include "pcap/bpf.h"; we are going to include the
  * native OS version, as we need "struct bpf_config" from it.
  */
 #define PCAP_DONT_INCLUDE_PCAP_BPF_H
@@ -99,6 +105,10 @@ static int odmlockid = 0;
 #include <string.h>
 #include <unistd.h>
 
+#ifdef HAVE_NET_IF_MEDIA_H
+# include <net/if_media.h>
+#endif
+
 #include "pcap-int.h"
 
 #ifdef HAVE_DAG_API
@@ -109,12 +119,579 @@ static int odmlockid = 0;
 #include "os-proto.h"
 #endif
 
-#include "gencode.h"	/* for "no_optimize" */
+#ifdef BIOCGDLTLIST
+# if (defined(HAVE_NET_IF_MEDIA_H) && defined(IFM_IEEE80211)) && !defined(__APPLE__)
+#define HAVE_BSD_IEEE80211
+# endif
+
+# if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
+static int find_802_11(struct bpf_dltlist *);
+
+#  ifdef HAVE_BSD_IEEE80211
+static int monitor_mode(pcap_t *, int);
+#  endif
+
+#  if defined(__APPLE__)
+static void remove_en(pcap_t *);
+static void remove_802_11(pcap_t *);
+#  endif
+
+# endif /* defined(__APPLE__) || defined(HAVE_BSD_IEEE80211) */
+
+#endif /* BIOCGDLTLIST */
+
+/*
+ * We include the OS's <net/bpf.h>, not our "pcap/bpf.h", so we probably
+ * don't get DLT_DOCSIS defined.
+ */
+#ifndef DLT_DOCSIS
+#define DLT_DOCSIS	143
+#endif
+
+/*
+ * On OS X, we don't even get any of the 802.11-plus-radio-header DLT_'s
+ * defined, even though some of them are used by various Airport drivers.
+ */
+#ifndef DLT_PRISM_HEADER
+#define DLT_PRISM_HEADER	119
+#endif
+#ifndef DLT_AIRONET_HEADER
+#define DLT_AIRONET_HEADER	120
+#endif
+#ifndef DLT_IEEE802_11_RADIO
+#define DLT_IEEE802_11_RADIO	127
+#endif
+#ifndef DLT_IEEE802_11_RADIO_AVS
+#define DLT_IEEE802_11_RADIO_AVS 163
+#endif
 
+static int pcap_can_set_rfmon_bpf(pcap_t *p);
+static int pcap_activate_bpf(pcap_t *p);
 static int pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp);
 static int pcap_setdirection_bpf(pcap_t *, pcap_direction_t);
 static int pcap_set_datalink_bpf(pcap_t *p, int dlt);
 
+#ifdef HAVE_ZEROCOPY_BPF
+/*
+ * For zerocopy bpf, we need to override the setnonblock/getnonblock routines
+ * so we don't call select(2) if the pcap handle is in non-blocking mode.  We
+ * preserve the timeout supplied by pcap_open functions to make sure it
+ * does not get clobbered if the pcap handle moves between blocking and non-
+ * blocking mode.
+ */
+static int
+pcap_getnonblock_zbuf(pcap_t *p, char *errbuf)
+{ 
+	/*
+	 * Use a negative value for the timeout to represent that the
+	 * pcap handle is in non-blocking mode.
+	 */
+	return (p->md.timeout < 0);
+}
+
+static int
+pcap_setnonblock_zbuf(pcap_t *p, int nonblock, char *errbuf)
+{   
+	/*
+	 * Map each value to the corresponding 2's complement, to
+	 * preserve the timeout value provided with pcap_set_timeout.
+	 * (from pcap-linux.c).
+	 */
+	if (nonblock) {
+		if (p->md.timeout > 0)
+			p->md.timeout = p->md.timeout * -1 - 1;
+	} else
+		if (p->md.timeout < 0)
+			p->md.timeout = (p->md.timeout + 1) * -1;
+	return (0);
+}
+
+/*
+ * Zero-copy specific close method.  Un-map the shared buffers then call
+ * pcap_cleanup_live_common.
+ */
+static void
+pcap_cleanup_zbuf(pcap_t *p)
+{
+	/*
+	 * Delete the mappings.  Note that p->buffer gets initialized to one
+	 * of the mmapped regions in this case, so do not try and free it
+	 * directly; null it out so that pcap_cleanup_live_common() doesn't
+	 * try to free it.
+	 */
+	if (p->md.zbuf1 != MAP_FAILED && p->md.zbuf1 != NULL)
+		(void) munmap(p->md.zbuf1, p->md.zbufsize);
+	if (p->md.zbuf2 != MAP_FAILED && p->md.zbuf2 != NULL)
+		(void) munmap(p->md.zbuf2, p->md.zbufsize);
+	p->buffer = NULL;
+	pcap_cleanup_live_common(p);
+}
+
+/*
+ * Zero-copy BPF buffer routines to check for and acknowledge BPF data in
+ * shared memory buffers.
+ *
+ * pcap_next_zbuf_shm(): Check for a newly available shared memory buffer,
+ * and set up p->buffer and cc to reflect one if available.  Notice that if
+ * there was no prior buffer, we select zbuf1 as this will be the first
+ * buffer filled for a fresh BPF session.
+ */
+static int
+pcap_next_zbuf_shm(pcap_t *p, int *cc)
+{
+	struct bpf_zbuf_header *bzh;
+
+	if (p->md.zbuffer == p->md.zbuf2 || p->md.zbuffer == NULL) {
+		bzh = (struct bpf_zbuf_header *)p->md.zbuf1;
+		if (bzh->bzh_user_gen !=
+		    atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
+			p->md.bzh = bzh;
+			p->md.zbuffer = (u_char *)p->md.zbuf1;
+			p->buffer = p->md.zbuffer + sizeof(*bzh);
+			*cc = bzh->bzh_kernel_len;
+			return (1);
+		}
+	} else if (p->md.zbuffer == p->md.zbuf1) {
+		bzh = (struct bpf_zbuf_header *)p->md.zbuf2;
+		if (bzh->bzh_user_gen !=
+		    atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
+			p->md.bzh = bzh;
+			p->md.zbuffer = (u_char *)p->md.zbuf2;
+  			p->buffer = p->md.zbuffer + sizeof(*bzh);
+			*cc = bzh->bzh_kernel_len;
+			return (1);
+		}
+	}
+	*cc = 0;
+	return (0);
+}
+
+/*
+ * pcap_next_zbuf() -- Similar to pcap_next_zbuf_shm(), except wait using
+ * select() for data or a timeout, and possibly force rotation of the buffer
+ * in the event we time out or are in immediate mode.  Invoke the shared
+ * memory check before doing system calls in order to avoid doing avoidable
+ * work.
+ */
+static int
+pcap_next_zbuf(pcap_t *p, int *cc)
+{
+	struct bpf_zbuf bz;
+	struct timeval tv;
+	struct timespec cur;
+	fd_set r_set;
+	int data, r;
+	int expire, tmout;
+
+#define TSTOMILLI(ts) (((ts)->tv_sec * 1000) + ((ts)->tv_nsec / 1000000))
+	/*
+	 * Start out by seeing whether anything is waiting by checking the
+	 * next shared memory buffer for data.
+	 */
+	data = pcap_next_zbuf_shm(p, cc);
+	if (data)
+		return (data);
+	/*
+	 * If a previous sleep was interrupted due to signal delivery, make
+	 * sure that the timeout gets adjusted accordingly.  This requires
+	 * that we analyze when the timeout should be been expired, and
+	 * subtract the current time from that.  If after this operation,
+	 * our timeout is less then or equal to zero, handle it like a
+	 * regular timeout.
+	 */
+	tmout = p->md.timeout;
+	if (tmout)
+		(void) clock_gettime(CLOCK_MONOTONIC, &cur);
+	if (p->md.interrupted && p->md.timeout) {
+		expire = TSTOMILLI(&p->md.firstsel) + p->md.timeout;
+		tmout = expire - TSTOMILLI(&cur);
+#undef TSTOMILLI
+		if (tmout <= 0) {
+			p->md.interrupted = 0;
+			data = pcap_next_zbuf_shm(p, cc);
+			if (data)
+				return (data);
+			if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
+				(void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+				    "BIOCROTZBUF: %s", strerror(errno));
+				return (PCAP_ERROR);
+			}
+			return (pcap_next_zbuf_shm(p, cc));
+		}
+	}
+	/*
+	 * No data in the buffer, so must use select() to wait for data or
+	 * the next timeout.  Note that we only call select if the handle
+	 * is in blocking mode.
+	 */
+	if (p->md.timeout >= 0) {
+		FD_ZERO(&r_set);
+		FD_SET(p->fd, &r_set);
+		if (tmout != 0) {
+			tv.tv_sec = tmout / 1000;
+			tv.tv_usec = (tmout * 1000) % 1000000;
+		}
+		r = select(p->fd + 1, &r_set, NULL, NULL,
+		    p->md.timeout != 0 ? &tv : NULL);
+		if (r < 0 && errno == EINTR) {
+			if (!p->md.interrupted && p->md.timeout) {
+				p->md.interrupted = 1;
+				p->md.firstsel = cur;
+			}
+			return (0);
+		} else if (r < 0) {
+			(void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+			    "select: %s", strerror(errno));
+			return (PCAP_ERROR);
+		}
+	}
+	p->md.interrupted = 0;
+	/*
+	 * Check again for data, which may exist now that we've either been
+	 * woken up as a result of data or timed out.  Try the "there's data"
+	 * case first since it doesn't require a system call.
+	 */
+	data = pcap_next_zbuf_shm(p, cc);
+	if (data)
+		return (data);
+	/*
+	 * Try forcing a buffer rotation to dislodge timed out or immediate
+	 * data.
+	 */
+	if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
+		(void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+		    "BIOCROTZBUF: %s", strerror(errno));
+		return (PCAP_ERROR);
+	}
+	return (pcap_next_zbuf_shm(p, cc));
+}
+
+/*
+ * Notify kernel that we are done with the buffer.  We don't reset zbuffer so
+ * that we know which buffer to use next time around.
+ */
+static int
+pcap_ack_zbuf(pcap_t *p)
+{
+
+	atomic_store_rel_int(&p->md.bzh->bzh_user_gen,
+	    p->md.bzh->bzh_kernel_gen);
+	p->md.bzh = NULL;
+	p->buffer = NULL;
+	return (0);
+}
+#endif
+
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+#ifdef HAVE_DAG_API
+	if (strstr(device, "dag"))
+		return (dag_create(device, ebuf));
+#endif /* HAVE_DAG_API */
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_bpf;
+	p->can_set_rfmon_op = pcap_can_set_rfmon_bpf;
+	return (p);
+}
+
+static int
+bpf_open(pcap_t *p)
+{
+	int fd;
+#ifdef HAVE_CLONING_BPF
+	static const char device[] = "/dev/bpf";
+#else
+	int n = 0;
+	char device[sizeof "/dev/bpf0000000000"];
+#endif
+
+#ifdef _AIX
+	/*
+	 * Load the bpf driver, if it isn't already loaded,
+	 * and create the BPF device entries, if they don't
+	 * already exist.
+	 */
+	if (bpf_load(p->errbuf) == PCAP_ERROR)
+		return (PCAP_ERROR);
+#endif
+
+#ifdef HAVE_CLONING_BPF
+	if ((fd = open(device, O_RDWR)) == -1 &&
+	    (errno != EACCES || (fd = open(device, O_RDONLY)) == -1)) {
+		if (errno == EACCES)
+			fd = PCAP_ERROR_PERM_DENIED;
+		else
+			fd = PCAP_ERROR;
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+		  "(cannot open device) %s: %s", device, pcap_strerror(errno));
+	}
+#else
+	/*
+	 * Go through all the minors and find one that isn't in use.
+	 */
+	do {
+		(void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
+		/*
+		 * Initially try a read/write open (to allow the inject
+		 * method to work).  If that fails due to permission
+		 * issues, fall back to read-only.  This allows a
+		 * non-root user to be granted specific access to pcap
+		 * capabilities via file permissions.
+		 *
+		 * XXX - we should have an API that has a flag that
+		 * controls whether to open read-only or read-write,
+		 * so that denial of permission to send (or inability
+		 * to send, if sending packets isn't supported on
+		 * the device in question) can be indicated at open
+		 * time.
+		 */
+		fd = open(device, O_RDWR);
+		if (fd == -1 && errno == EACCES)
+			fd = open(device, O_RDONLY);
+	} while (fd < 0 && errno == EBUSY);
+
+	/*
+	 * XXX better message for all minors used
+	 */
+	if (fd < 0) {
+		if (errno == EACCES)
+			fd = PCAP_ERROR_PERM_DENIED;
+		else
+			fd = PCAP_ERROR;
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "(no devices found) %s: %s",
+		    device, pcap_strerror(errno));
+	}
+#endif
+
+	return (fd);
+}
+
+#ifdef BIOCGDLTLIST
+static int
+get_dlt_list(int fd, int v, struct bpf_dltlist *bdlp, char *ebuf)
+{
+	memset(bdlp, 0, sizeof(*bdlp));
+	if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) == 0) {
+		u_int i;
+		int is_ethernet;
+
+		bdlp->bfl_list = (u_int *) malloc(sizeof(u_int) * (bdlp->bfl_len + 1));
+		if (bdlp->bfl_list == NULL) {
+			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
+			    pcap_strerror(errno));
+			return (PCAP_ERROR);
+		}
+
+		if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) < 0) {
+			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
+			    "BIOCGDLTLIST: %s", pcap_strerror(errno));
+			free(bdlp->bfl_list);
+			return (PCAP_ERROR);
+		}
+
+		/*
+		 * OK, for real Ethernet devices, add DLT_DOCSIS to the
+		 * list, so that an application can let you choose it,
+		 * in case you're capturing DOCSIS traffic that a Cisco
+		 * Cable Modem Termination System is putting out onto
+		 * an Ethernet (it doesn't put an Ethernet header onto
+		 * the wire, it puts raw DOCSIS frames out on the wire
+		 * inside the low-level Ethernet framing).
+		 *
+		 * A "real Ethernet device" is defined here as a device
+		 * that has a link-layer type of DLT_EN10MB and that has
+		 * no alternate link-layer types; that's done to exclude
+		 * 802.11 interfaces (which might or might not be the
+		 * right thing to do, but I suspect it is - Ethernet <->
+		 * 802.11 bridges would probably badly mishandle frames
+		 * that don't have Ethernet headers).
+		 */
+		if (v == DLT_EN10MB) {
+			is_ethernet = 1;
+			for (i = 0; i < bdlp->bfl_len; i++) {
+				if (bdlp->bfl_list[i] != DLT_EN10MB) {
+					is_ethernet = 0;
+					break;
+				}
+			}
+			if (is_ethernet) {
+				/*
+				 * We reserved one more slot at the end of
+				 * the list.
+				 */
+				bdlp->bfl_list[bdlp->bfl_len] = DLT_DOCSIS;
+				bdlp->bfl_len++;
+			}
+		}
+	} else {
+		/*
+		 * EINVAL just means "we don't support this ioctl on
+		 * this device"; don't treat it as an error.
+		 */
+		if (errno != EINVAL) {
+			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
+			    "BIOCGDLTLIST: %s", pcap_strerror(errno));
+			return (PCAP_ERROR);
+		}
+	}
+	return (0);
+}
+#endif
+
+static int
+pcap_can_set_rfmon_bpf(pcap_t *p)
+{
+#if defined(__APPLE__)
+	struct utsname osinfo;
+	struct ifreq ifr;
+	int fd;
+#ifdef BIOCGDLTLIST
+	struct bpf_dltlist bdl;
+#endif
+
+	/*
+	 * The joys of monitor mode on OS X.
+	 *
+	 * Prior to 10.4, it's not supported at all.
+	 *
+	 * In 10.4, if adapter enN supports monitor mode, there's a
+	 * wltN adapter corresponding to it; you open it, instead of
+	 * enN, to get monitor mode.  You get whatever link-layer
+	 * headers it supplies.
+	 *
+	 * In 10.5, and, we assume, later releases, if adapter enN
+	 * supports monitor mode, it offers, among its selectable
+	 * DLT_ values, values that let you get the 802.11 header;
+	 * selecting one of those values puts the adapter into monitor
+	 * mode (i.e., you can't get 802.11 headers except in monitor
+	 * mode, and you can't get Ethernet headers in monitor mode).
+	 */
+	if (uname(&osinfo) == -1) {
+		/*
+		 * Can't get the OS version; just say "no".
+		 */
+		return (0);
+	}
+	/*
+	 * We assume osinfo.sysname is "Darwin", because
+	 * __APPLE__ is defined.  We just check the version.
+	 */
+	if (osinfo.release[0] < '8' && osinfo.release[1] == '.') {
+		/*
+		 * 10.3 (Darwin 7.x) or earlier.
+		 * Monitor mode not supported.
+		 */
+		return (0);
+	}
+	if (osinfo.release[0] == '8' && osinfo.release[1] == '.') {
+		/*
+		 * 10.4 (Darwin 8.x).  s/en/wlt/, and check
+		 * whether the device exists.
+		 */
+		if (strncmp(p->opt.source, "en", 2) != 0) {
+			/*
+			 * Not an enN device; no monitor mode.
+			 */
+			return (0);
+		}
+		fd = socket(AF_INET, SOCK_DGRAM, 0);
+		if (fd == -1) {
+			(void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+			    "socket: %s", pcap_strerror(errno));
+			return (PCAP_ERROR);
+		}
+		strlcpy(ifr.ifr_name, "wlt", sizeof(ifr.ifr_name));
+		strlcat(ifr.ifr_name, p->opt.source + 2, sizeof(ifr.ifr_name));
+		if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
+			/*
+			 * No such device?
+			 */
+			close(fd);
+			return (0);
+		}
+		close(fd);
+		return (1);
+	}
+
+#ifdef BIOCGDLTLIST
+	/*
+	 * Everything else is 10.5 or later; for those,
+	 * we just open the enN device, and check whether
+	 * we have any 802.11 devices.
+	 *
+	 * First, open a BPF device.
+	 */
+	fd = bpf_open(p);
+	if (fd < 0)
+		return (fd);
+
+	/*
+	 * Now bind to the device.
+	 */
+	(void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
+	if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
+		if (errno == ENETDOWN) {
+			/*
+			 * Return a "network down" indication, so that
+			 * the application can report that rather than
+			 * saying we had a mysterious failure and
+			 * suggest that they report a problem to the
+			 * libpcap developers.
+			 */
+			close(fd);
+			return (PCAP_ERROR_IFACE_NOT_UP);
+		} else {
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+			    "BIOCSETIF: %s: %s",
+			    p->opt.source, pcap_strerror(errno));
+			close(fd);
+			return (PCAP_ERROR);
+		}
+	}
+
+	/*
+	 * We know the default link type -- now determine all the DLTs
+	 * this interface supports.  If this fails with EINVAL, it's
+	 * not fatal; we just don't get to use the feature later.
+	 * (We don't care about DLT_DOCSIS, so we pass DLT_NULL
+	 * as the default DLT for this adapter.)
+	 */
+	if (get_dlt_list(fd, DLT_NULL, &bdl, p->errbuf) == PCAP_ERROR) {
+		close(fd);
+		return (PCAP_ERROR);
+	}
+	if (find_802_11(&bdl) != -1) {
+		/*
+		 * We have an 802.11 DLT, so we can set monitor mode.
+		 */
+		free(bdl.bfl_list);
+		close(fd);
+		return (1);
+	}
+	free(bdl.bfl_list);
+#endif /* BIOCGDLTLIST */
+	return (0);
+#elif defined(HAVE_BSD_IEEE80211)
+	int ret;
+
+	ret = monitor_mode(p, 0);
+	if (ret == PCAP_ERROR_RFMON_NOTSUP)
+		return (0);	/* not an error, just a "can't do" */
+	if (ret == 0)
+		return (1);	/* success */
+	return (ret);
+#else
+	return (0);
+#endif
+}
+
 static int
 pcap_stats_bpf(pcap_t *p, struct pcap_stat *ps)
 {
@@ -136,7 +713,7 @@ pcap_stats_bpf(pcap_t *p, struct pcap_stat *ps)
 	if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) {
 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s",
 		    pcap_strerror(errno));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	ps->ps_recv = s.bs_recv;
@@ -304,15 +881,16 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 	int n = 0;
 	register u_char *bp, *ep;
 	u_char *datap;
-	struct bpf_insn *fcode;
 #ifdef BIOCSETBUFMODE
 	int i;
 #endif
 #ifdef PCAP_FDDIPAD
 	register int pad;
 #endif
+#ifdef HAVE_ZEROCOPY_BPF
+	int i;
+#endif
 
-	fcode = p->md.use_bpf ? NULL : p->fcode.bf_insns;
  again:
 	/*
 	 * Has "pcap_breakloop()" been called?
@@ -320,11 +898,11 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 	if (p->break_loop) {
 		/*
 		 * Yes - clear the flag that indicates that it
-		 * has, and return -2 to indicate that we were
-		 * told to break out of the loop.
+		 * has, and return PCAP_ERROR_BREAK to indicate
+		 * that we were told to break out of the loop.
 		 */
 		p->break_loop = 0;
-		return (-2);
+		return (PCAP_ERROR_BREAK);
 	}
 	cc = p->cc;
 	if (p->cc == 0) {
@@ -336,19 +914,20 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		 * data and update cc to reflect the data found in the
 		 * buffer.
 		 */
-#ifdef BIOCSETBUFMODE
-		if (p->zerocopy) {
+#ifdef HAVE_ZEROCOPY_BPF
+		if (p->md.zerocopy) {
 			if (p->buffer != NULL)
 				pcap_ack_zbuf(p);
 			i = pcap_next_zbuf(p, &cc);
 			if (i == 0)
 				goto again;
 			if (i < 0)
-				return (-1);
+				return (PCAP_ERROR);
 		} else
 #endif
+		{
 			cc = read(p->fd, (char *)p->buffer, p->bufsize);
-
+		}
 		if (cc < 0) {
 			/* Don't choke when we get ptraced */
 			switch (errno) {
@@ -363,16 +942,16 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 				 *
 				 * For some unknown reason the uiomove()
 				 * operation in the bpf kernel extension
-				 * used to copy the buffer into user 
+				 * used to copy the buffer into user
 				 * space sometimes returns EFAULT. I have
 				 * no idea why this is the case given that
-				 * a kernel debugger shows the user buffer 
-				 * is correct. This problem appears to 
-				 * be mostly mitigated by the memset of 
-				 * the buffer before it is first used. 
+				 * a kernel debugger shows the user buffer
+				 * is correct. This problem appears to
+				 * be mostly mitigated by the memset of
+				 * the buffer before it is first used.
 				 * Very strange.... Shaun Clowes
 				 *
-				 * In any case this means that we shouldn't 
+				 * In any case this means that we shouldn't
 				 * treat EFAULT as a fatal error; as we
 				 * don't have an API for returning
 				 * a "some packets were dropped since
@@ -380,8 +959,8 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 				 * we just ignore EFAULT and keep reading.
 				 */
 				goto again;
-#endif 
-  
+#endif
+
 			case EWOULDBLOCK:
 				return (0);
 #if defined(sun) && !defined(BSD)
@@ -401,7 +980,7 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 			}
 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read: %s",
 			    pcap_strerror(errno));
-			return (-1);
+			return (PCAP_ERROR);
 		}
 		bp = p->buffer;
 	} else
@@ -421,16 +1000,17 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		/*
 		 * Has "pcap_breakloop()" been called?
 		 * If so, return immediately - if we haven't read any
-		 * packets, clear the flag and return -2 to indicate
-		 * that we were told to break out of the loop, otherwise
-		 * leave the flag set, so that the *next* call will break
-		 * out of the loop without having read any packets, and
-		 * return the number of packets we've processed so far.
+		 * packets, clear the flag and return PCAP_ERROR_BREAK
+		 * to indicate that we were told to break out of the loop,
+		 * otherwise leave the flag set, so that the *next* call
+		 * will break out of the loop without having read any
+		 * packets, and return the number of packets we've
+		 * processed so far.
 		 */
 		if (p->break_loop) {
 			if (n == 0) {
 				p->break_loop = 0;
-				return (-2);
+				return (PCAP_ERROR_BREAK);
 			} else {
 				p->bp = bp;
 				p->cc = ep - bp;
@@ -443,7 +1023,8 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		datap = bp + hdrlen;
 		/*
 		 * Short-circuit evaluation: if using BPF filter
-		 * in kernel, no need to do it now.
+		 * in kernel, no need to do it now - we already know
+		 * the packet passed the filter.
 		 *
 #ifdef PCAP_FDDIPAD
 		 * Note: the filter code was generated assuming
@@ -453,8 +1034,8 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		 * skipping that padding.
 #endif
 		 */
-		if (fcode == NULL ||
-		    bpf_filter(fcode, datap, bhp->bh_datalen, caplen)) {
+		if (p->md.use_bpf ||
+		    bpf_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) {
 			struct pcap_pkthdr pkthdr;
 
 			pkthdr.ts.tv_sec = bhp->bh_tstamp.tv_sec;
@@ -532,7 +1113,7 @@ pcap_inject_bpf(pcap_t *p, const void *buf, size_t size)
 			(void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 			    "send: can't turn off BIOCSHDRCMPLT: %s",
 			    pcap_strerror(errno));
-			return (-1);
+			return (PCAP_ERROR);
 		}
 
 		/*
@@ -544,13 +1125,13 @@ pcap_inject_bpf(pcap_t *p, const void *buf, size_t size)
 	if (ret == -1) {
 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
 		    pcap_strerror(errno));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 	return (ret);
 }
 
 #ifdef _AIX
-static int 
+static int
 bpf_odminit(char *errbuf)
 {
 	char *errstr;
@@ -561,7 +1142,7 @@ bpf_odminit(char *errbuf)
 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
 		    "bpf_load: odm_initialize failed: %s",
 		    errstr);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	if ((odmlockid = odm_lock("/etc/objrepos/config_lock", ODM_WAIT)) == -1) {
@@ -570,13 +1151,13 @@ bpf_odminit(char *errbuf)
 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
 		    "bpf_load: odm_lock of /etc/objrepos/config_lock failed: %s",
 		    errstr);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	return (0);
 }
 
-static int 
+static int
 bpf_odmcleanup(char *errbuf)
 {
 	char *errstr;
@@ -587,7 +1168,7 @@ bpf_odmcleanup(char *errbuf)
 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
 		    "bpf_load: odm_unlock failed: %s",
 		    errstr);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	if (odm_terminate() == -1) {
@@ -596,7 +1177,7 @@ bpf_odmcleanup(char *errbuf)
 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
 		    "bpf_load: odm_terminate failed: %s",
 		    errstr);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	return (0);
@@ -621,14 +1202,14 @@ bpf_load(char *errbuf)
 	if (bpfloadedflag)
 		return (0);
 
-	if (bpf_odminit(errbuf) != 0)
-		return (-1);
+	if (bpf_odminit(errbuf) == PCAP_ERROR)
+		return (PCAP_ERROR);
 
 	major = genmajor(BPF_NAME);
 	if (major == -1) {
 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
 		    "bpf_load: genmajor failed: %s", pcap_strerror(errno));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	minors = getminor(major, &numminors, BPF_NAME);
@@ -638,19 +1219,19 @@ bpf_load(char *errbuf)
 			snprintf(errbuf, PCAP_ERRBUF_SIZE,
 			    "bpf_load: genminor failed: %s",
 			    pcap_strerror(errno));
-			return (-1);
+			return (PCAP_ERROR);
 		}
 	}
 
-	if (bpf_odmcleanup(errbuf))
-		return (-1);
+	if (bpf_odmcleanup(errbuf) == PCAP_ERROR)
+		return (PCAP_ERROR);
 
 	rc = stat(BPF_NODE "0", &sbuf);
 	if (rc == -1 && errno != ENOENT) {
 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
 		    "bpf_load: can't stat %s: %s",
 		    BPF_NODE "0", pcap_strerror(errno));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	if (rc == -1 || getmajor(sbuf.st_rdev) != major) {
@@ -661,7 +1242,7 @@ bpf_load(char *errbuf)
 				snprintf(errbuf, PCAP_ERRBUF_SIZE,
 				    "bpf_load: can't mknod %s: %s",
 				    buf, pcap_strerror(errno));
-				return (-1);
+				return (PCAP_ERROR);
 			}
 		}
 	}
@@ -677,7 +1258,7 @@ bpf_load(char *errbuf)
 			snprintf(errbuf, PCAP_ERRBUF_SIZE,
 			    "bpf_load: could not load driver: %s",
 			    strerror(errno));
-			return (-1);
+			return (PCAP_ERROR);
 		}
 	}
 
@@ -685,115 +1266,229 @@ bpf_load(char *errbuf)
 	cfg_km.cmd = CFG_INIT;
 	cfg_km.kmid = cfg_ld.kmid;
 	cfg_km.mdilen = sizeof(cfg_bpf);
-	cfg_km.mdiptr = (void *)&cfg_bpf; 
+	cfg_km.mdiptr = (void *)&cfg_bpf;
 	for (i = 0; i < BPF_MINORS; i++) {
 		cfg_bpf.devno = domakedev(major, i);
 		if (sysconfig(SYS_CFGKMOD, (void *)&cfg_km, sizeof(cfg_km)) == -1) {
 			snprintf(errbuf, PCAP_ERRBUF_SIZE,
 			    "bpf_load: could not configure driver: %s",
 			    strerror(errno));
-			return (-1);
+			return (PCAP_ERROR);
 		}
 	}
-	
+
 	bpfloadedflag = 1;
 
 	return (0);
 }
 #endif
 
-static inline int
-bpf_open(pcap_t *p, char *errbuf)
+/*
+ * Turn off rfmon mode if necessary.
+ */
+static void
+pcap_cleanup_bpf(pcap_t *p)
 {
-	int fd;
-#ifdef HAVE_CLONING_BPF
-	static const char device[] = "/dev/bpf";
-#else
-	int n = 0;
-	char device[sizeof "/dev/bpf0000000000"];
+#ifdef HAVE_BSD_IEEE80211
+	int sock;
+	struct ifmediareq req;
+	struct ifreq ifr;
 #endif
 
-#ifdef _AIX
-	/*
-	 * Load the bpf driver, if it isn't already loaded,
-	 * and create the BPF device entries, if they don't
-	 * already exist.
-	 */
-	if (bpf_load(errbuf) == -1)
-		return (-1);
-#endif
+	if (p->md.must_clear != 0) {
+		/*
+		 * There's something we have to do when closing this
+		 * pcap_t.
+		 */
+#ifdef HAVE_BSD_IEEE80211
+		if (p->md.must_clear & MUST_CLEAR_RFMON) {
+			/*
+			 * We put the interface into rfmon mode;
+			 * take it out of rfmon mode.
+			 *
+			 * XXX - if somebody else wants it in rfmon
+			 * mode, this code cannot know that, so it'll take
+			 * it out of rfmon mode.
+			 */
+			sock = socket(AF_INET, SOCK_DGRAM, 0);
+			if (sock == -1) {
+				fprintf(stderr,
+				    "Can't restore interface flags (socket() failed: %s).\n"
+				    "Please adjust manually.\n",
+				    strerror(errno));
+			} else {
+				memset(&req, 0, sizeof(req));
+				strncpy(req.ifm_name, p->md.device,
+				    sizeof(req.ifm_name));
+				if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
+					fprintf(stderr,
+					    "Can't restore interface flags (SIOCGIFMEDIA failed: %s).\n"
+					    "Please adjust manually.\n",
+					    strerror(errno));
+				} else {
+					if (req.ifm_current & IFM_IEEE80211_MONITOR) {
+						/*
+						 * Rfmon mode is currently on;
+						 * turn it off.
+						 */
+						memset(&ifr, 0, sizeof(ifr));
+						(void)strncpy(ifr.ifr_name,
+						    p->md.device,
+						    sizeof(ifr.ifr_name));
+						ifr.ifr_media =
+						    req.ifm_current & ~IFM_IEEE80211_MONITOR;
+						if (ioctl(sock, SIOCSIFMEDIA,
+						    &ifr) == -1) {
+							fprintf(stderr,
+							    "Can't restore interface flags (SIOCSIFMEDIA failed: %s).\n"
+							    "Please adjust manually.\n",
+							    strerror(errno));
+						}
+					}
+				}
+				close(sock);
+			}
+		}
+#endif /* HAVE_BSD_IEEE80211 */
 
-#ifdef HAVE_CLONING_BPF
-	if ((fd = open(device, O_RDWR)) == -1 &&
-	    (errno != EACCES || (fd = open(device, O_RDONLY)) == -1))
-		snprintf(errbuf, PCAP_ERRBUF_SIZE,
-		  "(cannot open device) %s: %s", device, pcap_strerror(errno));
-#else
-	/*
-	 * Go through all the minors and find one that isn't in use.
-	 */
-	do {
-		(void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
 		/*
-		 * Initially try a read/write open (to allow the inject
-		 * method to work).  If that fails due to permission
-		 * issues, fall back to read-only.  This allows a
-		 * non-root user to be granted specific access to pcap
-		 * capabilities via file permissions.
-		 *
-		 * XXX - we should have an API that has a flag that
-		 * controls whether to open read-only or read-write,
-		 * so that denial of permission to send (or inability
-		 * to send, if sending packets isn't supported on
-		 * the device in question) can be indicated at open
-		 * time.
+		 * Take this pcap out of the list of pcaps for which we
+		 * have to take the interface out of some mode.
 		 */
-		fd = open(device, O_RDWR);
-		if (fd == -1 && errno == EACCES)
-			fd = open(device, O_RDONLY);
-	} while (fd < 0 && errno == EBUSY);
+		pcap_remove_from_pcaps_to_close(p);
+		p->md.must_clear = 0;
+	}
 
+#ifdef HAVE_ZEROCOPY_BPF
 	/*
-	 * XXX better message for all minors used
+	 * In zero-copy mode, p->buffer is just a pointer into one of the two
+	 * memory-mapped buffers, so no need to free it.
 	 */
-	if (fd < 0)
-		snprintf(errbuf, PCAP_ERRBUF_SIZE, "(no devices found) %s: %s",
-		    device, pcap_strerror(errno));
+	if (p->md.zerocopy) {
+		if (p->md.zbuf1 != MAP_FAILED && p->md.zbuf1 != NULL)
+			munmap(p->md.zbuf1, p->md.zbufsize);
+		if (p->md.zbuf2 != MAP_FAILED && p->md.zbuf2 != NULL)
+			munmap(p->md.zbuf2, p->md.zbufsize);
+	}
 #endif
-
-	return (fd);
+	if (p->md.device != NULL) {
+		free(p->md.device);
+		p->md.device = NULL;
+	}
+	pcap_cleanup_live_common(p);
 }
 
-/*
- * We include the OS's <net/bpf.h>, not our "pcap-bpf.h", so we probably
- * don't get DLT_DOCSIS defined.
- */
-#ifndef DLT_DOCSIS
-#define DLT_DOCSIS	143
+static int
+check_setif_failure(pcap_t *p, int error)
+{
+#ifdef __APPLE__
+	int fd;
+	struct ifreq ifr;
+	int err;
 #endif
 
-pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+	if (error == ENXIO) {
+		/*
+		 * No such device exists.
+		 */
+#ifdef __APPLE__
+		if (p->opt.rfmon && strncmp(p->opt.source, "wlt", 3) == 0) {
+			/*
+			 * Monitor mode was requested, and we're trying
+			 * to open a "wltN" device.  Assume that this
+			 * is 10.4 and that we were asked to open an
+			 * "enN" device; if that device exists, return
+			 * "monitor mode not supported on the device".
+			 */
+			fd = socket(AF_INET, SOCK_DGRAM, 0);
+			if (fd != -1) {
+				strlcpy(ifr.ifr_name, "en",
+				    sizeof(ifr.ifr_name));
+				strlcat(ifr.ifr_name, p->opt.source + 3,
+				    sizeof(ifr.ifr_name));
+				if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
+					/*
+					 * We assume this failed because
+					 * the underlying device doesn't
+					 * exist.
+					 */
+					err = PCAP_ERROR_NO_SUCH_DEVICE;
+					strcpy(p->errbuf, "");
+				} else {
+					/*
+					 * The underlying "enN" device
+					 * exists, but there's no
+					 * corresponding "wltN" device;
+					 * that means that the "enN"
+					 * device doesn't support
+					 * monitor mode, probably because
+					 * it's an Ethernet device rather
+					 * than a wireless device.
+					 */
+					err = PCAP_ERROR_RFMON_NOTSUP;
+				}
+				close(fd);
+			} else {
+				/*
+				 * We can't find out whether there's
+				 * an underlying "enN" device, so
+				 * just report "no such device".
+				 */
+				err = PCAP_ERROR_NO_SUCH_DEVICE;
+				strcpy(p->errbuf, "");
+			}
+			return (err);
+		}
+#endif
+		/*
+		 * No such device.
+		 */
+		strcpy(p->errbuf, "");
+		return (PCAP_ERROR_NO_SUCH_DEVICE);
+	} else if (errno == ENETDOWN) {
+		/*
+		 * Return a "network down" indication, so that
+		 * the application can report that rather than
+		 * saying we had a mysterious failure and
+		 * suggest that they report a problem to the
+		 * libpcap developers.
+		 */
+		return (PCAP_ERROR_IFACE_NOT_UP);
+	} else {
+		/*
+		 * Some other error; fill in the error string, and
+		 * return PCAP_ERROR.
+		 */
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
+		    p->opt.source, pcap_strerror(errno));
+		return (PCAP_ERROR);
+	}
+}
+
+static int
+pcap_activate_bpf(pcap_t *p)
 {
+	int status = 0;
 	int fd;
 	struct ifreq ifr;
 	struct bpf_version bv;
+#ifdef __APPLE__
+	int sockfd;
+	char *wltdev = NULL;
+#endif
 #ifdef BIOCGDLTLIST
 	struct bpf_dltlist bdl;
+#if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
+	int new_dlt;
 #endif
+#endif /* BIOCGDLTLIST */
 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
 	u_int spoof_eth_src = 1;
 #endif
 	u_int v;
-	pcap_t *p;
 	struct bpf_insn total_insn;
 	struct bpf_program total_prog;
 	struct utsname osinfo;
-#ifdef BIOCSETBUFMODE
-	struct bpf_zbuf bz;
-	u_int bufmode, zbufmax;
-#endif
 
 #ifdef HAVE_DAG_API
 	if (strstr(device, "dag")) {
@@ -803,35 +1498,135 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 
 #ifdef BIOCGDLTLIST
 	memset(&bdl, 0, sizeof(bdl));
+	int have_osinfo = 0;
+#ifdef HAVE_ZEROCOPY_BPF
+	struct bpf_zbuf bz;
+	u_int bufmode, zbufmax;
 #endif
 
-	p = (pcap_t *)malloc(sizeof(*p));
-	if (p == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
-		    pcap_strerror(errno));
-		return (NULL);
-	}
-	memset(p, 0, sizeof(*p));
-	fd = bpf_open(p, ebuf);
-	if (fd < 0)
+	fd = bpf_open(p);
+	if (fd < 0) {
+		status = fd;
 		goto bad;
+	}
 
 	p->fd = fd;
-	p->snapshot = snaplen;
 
 	if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCVERSION: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCVERSION: %s",
 		    pcap_strerror(errno));
+		status = PCAP_ERROR;
 		goto bad;
 	}
 	if (bv.bv_major != BPF_MAJOR_VERSION ||
 	    bv.bv_minor < BPF_MINOR_VERSION) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 		    "kernel bpf filter out of date");
+		status = PCAP_ERROR;
+		goto bad;
+	}
+
+	p->md.device = strdup(p->opt.source);
+	if (p->md.device == NULL) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
+		     pcap_strerror(errno));
+		status = PCAP_ERROR;
 		goto bad;
 	}
 
-#ifdef BIOCSETBUFMODE
+	/*
+	 * Try finding a good size for the buffer; 32768 may be too
+	 * big, so keep cutting it in half until we find a size
+	 * that works, or run out of sizes to try.  If the default
+	 * is larger, don't make it smaller.
+	 *
+	 * XXX - there should be a user-accessible hook to set the
+	 * initial buffer size.
+	 * Attempt to find out the version of the OS on which we're running.
+	 */
+	if (uname(&osinfo) == 0)
+		have_osinfo = 1;
+
+#ifdef __APPLE__
+	/*
+	 * See comment in pcap_can_set_rfmon_bpf() for an explanation
+	 * of why we check the version number.
+	 */
+	if (p->opt.rfmon) {
+		if (have_osinfo) {
+			/*
+			 * We assume osinfo.sysname is "Darwin", because
+			 * __APPLE__ is defined.  We just check the version.
+			 */
+			if (osinfo.release[0] < '8' &&
+			    osinfo.release[1] == '.') {
+				/*
+				 * 10.3 (Darwin 7.x) or earlier.
+				 */
+				status = PCAP_ERROR_RFMON_NOTSUP;
+				goto bad;
+			}
+			if (osinfo.release[0] == '8' &&
+			    osinfo.release[1] == '.') {
+				/*
+				 * 10.4 (Darwin 8.x).  s/en/wlt/
+				 */
+				if (strncmp(p->opt.source, "en", 2) != 0) {
+					/*
+					 * Not an enN device; check
+					 * whether the device even exists.
+					 */
+					sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+					if (sockfd != -1) {
+						strlcpy(ifr.ifr_name,
+						    p->opt.source,
+						    sizeof(ifr.ifr_name));
+						if (ioctl(sockfd, SIOCGIFFLAGS,
+						    (char *)&ifr) < 0) {
+							/*
+							 * We assume this
+							 * failed because
+							 * the underlying
+							 * device doesn't
+							 * exist.
+							 */
+							status = PCAP_ERROR_NO_SUCH_DEVICE;
+							strcpy(p->errbuf, "");
+						} else
+							status = PCAP_ERROR_RFMON_NOTSUP;
+						close(sockfd);
+					} else {
+						/*
+						 * We can't find out whether
+						 * the device exists, so just
+						 * report "no such device".
+						 */
+						status = PCAP_ERROR_NO_SUCH_DEVICE;
+						strcpy(p->errbuf, "");
+					}
+					goto bad;
+				}
+				wltdev = malloc(strlen(p->opt.source) + 2);
+				if (wltdev == NULL) {
+					(void)snprintf(p->errbuf,
+					    PCAP_ERRBUF_SIZE, "malloc: %s",
+					    pcap_strerror(errno));
+					status = PCAP_ERROR;
+					goto bad;
+				}
+				strcpy(wltdev, "wlt");
+				strcat(wltdev, p->opt.source + 2);
+				free(p->opt.source);
+				p->opt.source = wltdev;
+			}
+			/*
+			 * Everything else is 10.5 or later; for those,
+			 * we just open the enN device, and set the DLT.
+			 */
+		}
+	}
+#endif /* __APPLE__ */
+#ifdef HAVE_ZEROCOPY_BPF
 	/*
 	 * If the BPF extension to set buffer mode is present, try setting
 	 * the mode to zero-copy.  If that fails, use regular buffering.  If
@@ -839,104 +1634,156 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 */
 	bufmode = BPF_BUFMODE_ZBUF;
 	if (ioctl(fd, BIOCSETBUFMODE, (caddr_t)&bufmode) == 0) {
-		p->zerocopy = 1;
+		/*
+		 * We have zerocopy BPF; use it.
+		 */
+		p->md.zerocopy = 1;
+
+		/*
+		 * Set the cleanup and set/get nonblocking mode ops
+		 * as appropriate for zero-copy mode.
+		 */
+		p->cleanup_op = pcap_cleanup_zbuf;
+		p->setnonblock_op = pcap_setnonblock_zbuf;
+		p->getnonblock_op = pcap_getnonblock_zbuf;
 
 		/*
 		 * How to pick a buffer size: first, query the maximum buffer
 		 * size supported by zero-copy.  This also lets us quickly
 		 * determine whether the kernel generally supports zero-copy.
-		 * Then, query the default buffer size, which reflects kernel
+		 * Then, if a buffer size was specified, use that, otherwise
+		 * query the default buffer size, which reflects kernel
 		 * policy for a desired default.  Round to the nearest page
 		 * size.
 		 */
 		if (ioctl(fd, BIOCGETZMAX, (caddr_t)&zbufmax) < 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCGETZMAX: %s",
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGETZMAX: %s",
 			    pcap_strerror(errno));
 			goto bad;
 		}
-		if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) || v < 32768)
-			v = 32768;
+
+		if (p->opt.buffer_size != 0) {
+			/*
+			 * A buffer size was explicitly specified; use it.
+			 */
+			v = p->opt.buffer_size;
+		} else {
+			if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
+			    v < 32768)
+				v = 32768;
+		}
 #ifndef roundup
-#define	roundup(x, y)	((((x)+((y)-1))/(y))*(y))  /* to any y */
+#define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))  /* to any y */
 #endif
-		p->zbufsize = roundup(v, getpagesize());
-		if (p->zbufsize > zbufmax)
-			p->zbufsize = zbufmax;
-		p->zbuf1 = mmap(NULL, p->zbufsize, PROT_READ | PROT_WRITE,
+		p->md.zbufsize = roundup(v, getpagesize());
+		if (p->md.zbufsize > zbufmax)
+			p->md.zbufsize = zbufmax;
+		p->md.zbuf1 = mmap(NULL, p->md.zbufsize, PROT_READ | PROT_WRITE,
 		    MAP_ANON, -1, 0);
-		p->zbuf2 = mmap(NULL, p->zbufsize, PROT_READ | PROT_WRITE,
+		p->md.zbuf2 = mmap(NULL, p->md.zbufsize, PROT_READ | PROT_WRITE,
 		    MAP_ANON, -1, 0);
-		if (p->zbuf1 == MAP_FAILED || p->zbuf2 == MAP_FAILED) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "mmap: %s",
+		if (p->md.zbuf1 == MAP_FAILED || p->md.zbuf2 == MAP_FAILED) {
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "mmap: %s",
 			    pcap_strerror(errno));
 			goto bad;
 		}
 		bzero(&bz, sizeof(bz));
-		bz.bz_bufa = p->zbuf1;
-		bz.bz_bufb = p->zbuf2;
-		bz.bz_buflen = p->zbufsize;
+		bz.bz_bufa = p->md.zbuf1;
+		bz.bz_bufb = p->md.zbuf2;
+		bz.bz_buflen = p->md.zbufsize;
 		if (ioctl(fd, BIOCSETZBUF, (caddr_t)&bz) < 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSETZBUF: %s",
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETZBUF: %s",
 			    pcap_strerror(errno));
 			goto bad;
 		}
-		(void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
+		(void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
 		if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
-			    device, pcap_strerror(errno));
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
+			    p->opt.source, pcap_strerror(errno));
 			goto bad;
 		}
-		v = p->zbufsize - sizeof(struct bpf_zbuf_header);
-	} else {
+		v = p->md.zbufsize - sizeof(struct bpf_zbuf_header);
+	} else
 #endif
-
+	{
 		/*
-		 * Try finding a good size for the buffer; 32768 may be too
-		 * big, so keep cutting it in half until we find a size
-		 * that works, or run out of sizes to try.  If the default
-		 * is larger, don't make it smaller.
-		 *
-		 * XXX - there should be a user-accessible hook to set the
-		 * initial buffer size.
+		 * We don't have zerocopy BPF.
+		 * Set the buffer size.
 		 */
-		if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) || v < 32768)
-			v = 32768;
-		for ( ; v != 0; v >>= 1) {
-			/* Ignore the return value - this is because the call
-			 * fails on BPF systems that don't have kernel
-			 * malloc.  And if the call fails, it's no big deal,
-			 * we just continue to use the standard buffer size.
+		if (p->opt.buffer_size != 0) {
+			/*
+			 * A buffer size was explicitly specified; use it.
 			 */
-			(void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
+			if (ioctl(fd, BIOCSBLEN,
+			    (caddr_t)&p->opt.buffer_size) < 0) {
+				snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+				    "BIOCSBLEN: %s: %s", p->opt.source,
+				    pcap_strerror(errno));
+				status = PCAP_ERROR;
+				goto bad;
+			}
 
-			(void)strncpy(ifr.ifr_name, device,
+			/*
+			 * Now bind to the device.
+			 */
+			(void)strncpy(ifr.ifr_name, p->opt.source,
 			    sizeof(ifr.ifr_name));
-			if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) >= 0)
-				break;	/* that size worked; we're done */
-
-			if (errno != ENOBUFS) {
-				snprintf(ebuf, PCAP_ERRBUF_SIZE,
-				    "BIOCSETIF: %s: %s",
-				    device, pcap_strerror(errno));
+			if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
+				status = check_setif_failure(p, errno);
 				goto bad;
 			}
-		}
+		} else {
+			/*
+			 * No buffer size was explicitly specified.
+			 *
+			 * Try finding a good size for the buffer; 32768 may
+			 * be too big, so keep cutting it in half until we
+			 * find a size that works, or run out of sizes to try.
+			 * If the default is larger, don't make it smaller.
+			 */
+			if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
+			    v < 32768)
+				v = 32768;
+			for ( ; v != 0; v >>= 1) {
+				/*
+				 * Ignore the return value - this is because the
+				 * call fails on BPF systems that don't have
+				 * kernel malloc.  And if the call fails, it's
+				 * no big deal, we just continue to use the
+				 * standard buffer size.
+				 */
+				(void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
 
-		if (v == 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE,
-			    "BIOCSBLEN: %s: No buffer size worked", device);
-			goto bad;
+				(void)strncpy(ifr.ifr_name, p->opt.source,
+				    sizeof(ifr.ifr_name));
+				if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) >= 0)
+					break;	/* that size worked; we're done */
+
+				if (errno != ENOBUFS) {
+					status = check_setif_failure(p, errno);
+					goto bad;
+				}
+			}
+
+			if (v == 0) {
+				snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+				    "BIOCSBLEN: %s: No buffer size worked",
+				    p->opt.source);
+				status = PCAP_ERROR;
+				goto bad;
+			}
 		}
-#ifdef BIOCSETBUFMODE
 	}
 #endif
 
 	/* Get the data link layer type. */
 	if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCGDLT: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGDLT: %s",
 		    pcap_strerror(errno));
+		status = PCAP_ERROR;
 		goto bad;
 	}
+
 #ifdef _AIX
 	/*
 	 * AIX's BPF returns IFF_ types, not DLT_ types, in BIOCGDLT.
@@ -964,8 +1811,9 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		/*
 		 * We don't know what to map this to yet.
 		 */
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "unknown interface type %u",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown interface type %u",
 		    v);
+		status = PCAP_ERROR;
 		goto bad;
 	}
 #endif
@@ -990,13 +1838,6 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		break;
 	}
 #endif
-#ifdef PCAP_FDDIPAD
-	if (v == DLT_FDDI)
-		p->fddipad = PCAP_FDDIPAD;
-	else
-		p->fddipad = 0;
-#endif
-	p->linktype = v;
 
 #ifdef BIOCGDLTLIST
 	/*
@@ -1004,68 +1845,144 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * this interface supports.  If this fails with EINVAL, it's
 	 * not fatal; we just don't get to use the feature later.
 	 */
-	if (ioctl(fd, BIOCGDLTLIST, (caddr_t)&bdl) == 0) {
-		u_int i;
-		int is_ethernet;
+	if (get_dlt_list(fd, v, &bdl, p->errbuf) == -1) {
+		status = PCAP_ERROR;
+		goto bad;
+	}
+	p->dlt_count = bdl.bfl_len;
+	p->dlt_list = bdl.bfl_list;
 
-		bdl.bfl_list = (u_int *) malloc(sizeof(u_int) * (bdl.bfl_len + 1));
-		if (bdl.bfl_list == NULL) {
-			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
-			    pcap_strerror(errno));
-			goto bad;
+#ifdef __APPLE__
+	/*
+	 * Monitor mode fun, continued.
+	 *
+	 * For 10.5 and, we're assuming, later releases, as noted above,
+	 * 802.1 adapters that support monitor mode offer both DLT_EN10MB,
+	 * DLT_IEEE802_11, and possibly some 802.11-plus-radio-information
+	 * DLT_ value.  Choosing one of the 802.11 DLT_ values will turn
+	 * monitor mode on.
+	 *
+	 * Therefore, if the user asked for monitor mode, we filter out
+	 * the DLT_EN10MB value, as you can't get that in monitor mode,
+	 * and, if the user didn't ask for monitor mode, we filter out
+	 * the 802.11 DLT_ values, because selecting those will turn
+	 * monitor mode on.  Then, for monitor mode, if an 802.11-plus-
+	 * radio DLT_ value is offered, we try to select that, otherwise
+	 * we try to select DLT_IEEE802_11.
+	 */
+	if (have_osinfo) {
+		if (isdigit((unsigned)osinfo.release[0]) &&
+		     (osinfo.release[0] == '9' ||
+		     isdigit((unsigned)osinfo.release[1]))) {
+			/*
+			 * 10.5 (Darwin 9.x), or later.
+			 */
+			new_dlt = find_802_11(&bdl);
+			if (new_dlt != -1) {
+				/*
+				 * We have at least one 802.11 DLT_ value,
+				 * so this is an 802.11 interface.
+				 * new_dlt is the best of the 802.11
+				 * DLT_ values in the list.
+				 */
+				if (p->opt.rfmon) {
+					/*
+					 * Our caller wants monitor mode.
+					 * Purge DLT_EN10MB from the list
+					 * of link-layer types, as selecting
+					 * it will keep monitor mode off.
+					 */
+					remove_en(p);
+
+					/*
+					 * If the new mode we want isn't
+					 * the default mode, attempt to
+					 * select the new mode.
+					 */
+					if (new_dlt != v) {
+						if (ioctl(p->fd, BIOCSDLT,
+						    &new_dlt) != -1) {
+							/*
+							 * We succeeded;
+							 * make this the
+							 * new DLT_ value.
+							 */
+							v = new_dlt;
+						}
+					}
+				} else {
+					/*
+					 * Our caller doesn't want
+					 * monitor mode.  Unless this
+					 * is being done by pcap_open_live(),
+					 * purge the 802.11 link-layer types
+					 * from the list, as selecting
+					 * one of them will turn monitor
+					 * mode on.
+					 */
+					if (!p->oldstyle)
+						remove_802_11(p);
+				}
+			} else {
+				if (p->opt.rfmon) {
+					/*
+					 * The caller requested monitor
+					 * mode, but we have no 802.11
+					 * link-layer types, so they
+					 * can't have it.
+					 */
+					status = PCAP_ERROR_RFMON_NOTSUP;
+					goto bad;
+				}
+			}
 		}
-
-		if (ioctl(fd, BIOCGDLTLIST, (caddr_t)&bdl) < 0) {
-			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
-			    "BIOCGDLTLIST: %s", pcap_strerror(errno));
-			free(bdl.bfl_list);
+	}
+#elif defined(HAVE_BSD_IEEE80211)
+	/*
+	 * *BSD with the new 802.11 ioctls.
+	 * Do we want monitor mode?
+	 */
+	if (p->opt.rfmon) {
+		/*
+		 * Try to put the interface into monitor mode.
+		 */
+		status = monitor_mode(p, 1);
+		if (status != 0) {
+			/*
+			 * We failed.
+			 */
 			goto bad;
 		}
 
 		/*
-		 * OK, for real Ethernet devices, add DLT_DOCSIS to the
-		 * list, so that an application can let you choose it,
-		 * in case you're capturing DOCSIS traffic that a Cisco
-		 * Cable Modem Termination System is putting out onto
-		 * an Ethernet (it doesn't put an Ethernet header onto
-		 * the wire, it puts raw DOCSIS frames out on the wire
-		 * inside the low-level Ethernet framing).
-		 *
-		 * A "real Ethernet device" is defined here as a device
-		 * that has a link-layer type of DLT_EN10MB and that has
-		 * no alternate link-layer types; that's done to exclude
-		 * 802.11 interfaces (which might or might not be the
-		 * right thing to do, but I suspect it is - Ethernet <->
-		 * 802.11 bridges would probably badly mishandle frames
-		 * that don't have Ethernet headers).
+		 * We're in monitor mode.
+		 * Try to find the best 802.11 DLT_ value and, if we
+		 * succeed, try to switch to that mode if we're not
+		 * already in that mode.
 		 */
-		if (p->linktype == DLT_EN10MB) {
-			is_ethernet = 1;
-			for (i = 0; i < bdl.bfl_len; i++) {
-				if (bdl.bfl_list[i] != DLT_EN10MB) {
-					is_ethernet = 0;
-					break;
+		new_dlt = find_802_11(&bdl);
+		if (new_dlt != -1) {
+			/*
+			 * We have at least one 802.11 DLT_ value.
+			 * new_dlt is the best of the 802.11
+			 * DLT_ values in the list.
+			 *
+			 * If the new mode we want isn't the default mode,
+			 * attempt to select the new mode.
+			 */
+			if (new_dlt != v) {
+				if (ioctl(p->fd, BIOCSDLT, &new_dlt) != -1) {
+					/*
+					 * We succeeded; make this the
+					 * new DLT_ value.
+					 */
+					v = new_dlt;
 				}
 			}
-			if (is_ethernet) {
-				/*
-				 * We reserved one more slot at the end of
-				 * the list.
-				 */
-				bdl.bfl_list[bdl.bfl_len] = DLT_DOCSIS;
-				bdl.bfl_len++;
-			}
-		}
-		p->dlt_count = bdl.bfl_len;
-		p->dlt_list = bdl.bfl_list;
-	} else {
-		if (errno != EINVAL) {
-			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
-			    "BIOCGDLTLIST: %s", pcap_strerror(errno));
-			goto bad;
 		}
 	}
-#endif
+#endif /* various platforms */
+#endif /* BIOCGDLTLIST */
 
 	/*
 	 * If this is an Ethernet device, and we don't have a DLT_ list,
@@ -1075,7 +1992,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * some other way of determining whether it's an Ethernet or 802.11
 	 * device.)
 	 */
-	if (p->linktype == DLT_EN10MB && p->dlt_count == 0) {
+	if (v == DLT_EN10MB && p->dlt_count == 0) {
 		p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
 		/*
 		 * If that fails, just leave the list empty.
@@ -1086,7 +2003,14 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 			p->dlt_count = 2;
 		}
 	}
-		
+#ifdef PCAP_FDDIPAD
+	if (v == DLT_FDDI)
+		p->fddipad = PCAP_FDDIPAD;
+	else
+		p->fddipad = 0;
+#endif
+	p->linktype = v;
+
 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
 	/*
 	 * Do a BIOCSHDRCMPLT, if defined, to turn that flag on, so
@@ -1098,25 +2022,30 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * BSDs - check CVS log for "bpf.c"?
 	 */
 	if (ioctl(fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) {
-		(void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
+		(void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 		    "BIOCSHDRCMPLT: %s", pcap_strerror(errno));
+		status = PCAP_ERROR;
 		goto bad;
 	}
 #endif
 	/* set timeout */
-	p->to_ms = to_ms;
-	if (to_ms != 0 && !p->zerocopy) {
+#ifdef HAVE_ZEROCOPY_BPF
+	if (p->md.timeout != 0 && !p->md.zerocopy) {
+#else
+	if (p->md.timeout) {
+#endif
 		/*
 		 * XXX - is this seconds/nanoseconds in AIX?
 		 * (Treating it as such doesn't fix the timeout
 		 * problem described below.)
 		 */
 		struct timeval to;
-		to.tv_sec = to_ms / 1000;
-		to.tv_usec = (to_ms * 1000) % 1000000;
+		to.tv_sec = p->md.timeout / 1000;
+		to.tv_usec = (p->md.timeout * 1000) % 1000000;
 		if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSRTIMEOUT: %s",
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSRTIMEOUT: %s",
 			    pcap_strerror(errno));
+			status = PCAP_ERROR;
 			goto bad;
 		}
 	}
@@ -1174,42 +2103,46 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 */
 	v = 1;
 	if (ioctl(p->fd, BIOCIMMEDIATE, &v) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCIMMEDIATE: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCIMMEDIATE: %s",
 		    pcap_strerror(errno));
+		status = PCAP_ERROR;
 		goto bad;
 	}
 #endif	/* BIOCIMMEDIATE */
 #endif	/* _AIX */
 
-	if (promisc) {
-		/* set promiscuous mode, okay if it fails */
+	if (p->opt.promisc) {
+		/* set promiscuous mode, just warn if it fails */
 		if (ioctl(p->fd, BIOCPROMISC, NULL) < 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCPROMISC: %s",
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCPROMISC: %s",
 			    pcap_strerror(errno));
+			status = PCAP_WARNING_PROMISC_NOTSUP;
 		}
 	}
 
 	if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCGBLEN: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGBLEN: %s",
 		    pcap_strerror(errno));
+		status = PCAP_ERROR;
 		goto bad;
 	}
 	p->bufsize = v;
-#ifdef BIOCSETBUFMODE
-	if (!p->zerocopy) {
+#ifdef HAVE_ZEROCOPY_BPF
+	if (!p->md.zerocopy) {
 #endif
-		p->buffer = (u_char *)malloc(p->bufsize);
-		if (p->buffer == NULL) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
-			    pcap_strerror(errno));
-			goto bad;
-		}
+	p->buffer = (u_char *)malloc(p->bufsize);
+	if (p->buffer == NULL) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
+		    pcap_strerror(errno));
+		status = PCAP_ERROR;
+		goto bad;
+	}
 #ifdef _AIX
-		/* For some strange reason this seems to prevent the EFAULT 
-		 * problems we have experienced from AIX BPF. */
-		memset(p->buffer, 0x0, p->bufsize);
+	/* For some strange reason this seems to prevent the EFAULT
+	 * problems we have experienced from AIX BPF. */
+	memset(p->buffer, 0x0, p->bufsize);
 #endif
-#ifdef BIOCSETBUFMODE
+#ifdef HAVE_ZEROCOPY_BPF
 	}
 #endif
 
@@ -1225,13 +2158,14 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	total_insn.code = (u_short)(BPF_RET | BPF_K);
 	total_insn.jt = 0;
 	total_insn.jf = 0;
-	total_insn.k = snaplen;
+	total_insn.k = p->snapshot;
 
 	total_prog.bf_len = 1;
 	total_prog.bf_insns = &total_insn;
 	if (ioctl(p->fd, BIOCSETF, (caddr_t)&total_prog) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
 		    pcap_strerror(errno));
+		status = PCAP_ERROR;
 		goto bad;
 	}
 
@@ -1272,7 +2206,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * XXX - what about AIX?
 	 */
 	p->selectable_fd = p->fd;	/* assume select() works until we know otherwise */
-	if (uname(&osinfo) == 0) {
+	if (have_osinfo) {
 		/*
 		 * We can check what OS this is.
 		 */
@@ -1291,30 +2225,12 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->getnonblock_op = pcap_getnonblock_fd;
 	p->setnonblock_op = pcap_setnonblock_fd;
 	p->stats_op = pcap_stats_bpf;
-	p->close_op = pcap_close_common;
+	p->cleanup_op = pcap_cleanup_bpf;
 
-	return (p);
+	return (status);
  bad:
-
-	(void)close(fd);
-#ifdef BIOCSETBUFMODE
-	/*
-	 * In zero-copy mode, p->buffer is just a pointer into one of the two
-	 * memory-mapped buffers, so no need to free it.
-	 */
-	if (p->zerocopy) {
-		if (p->zbuf1 != MAP_FAILED && p->zbuf1 != NULL)
-			munmap(p->zbuf1, p->zbufsize);
-		if (p->zbuf2 != MAP_FAILED && p->zbuf2 != NULL)
-			munmap(p->zbuf2, p->zbufsize);
-	} else
-#endif
-	if (p->buffer != NULL)
-		free(p->buffer);
-	if (p->dlt_list != NULL)
-		free(p->dlt_list);
-	free(p);
-	return (NULL);
+ 	pcap_cleanup_bpf(p);
+	return (status);
 }
 
 int
@@ -1328,25 +2244,314 @@ pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
 	return (0);
 }
 
+#ifdef HAVE_BSD_IEEE80211
 static int
-pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp)
+monitor_mode(pcap_t *p, int set)
 {
+	int sock;
+	struct ifmediareq req;
+	int *media_list;
+	int i;
+	int can_do;
+	struct ifreq ifr;
+
+	sock = socket(AF_INET, SOCK_DGRAM, 0);
+	if (sock == -1) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't open socket: %s",
+		    pcap_strerror(errno));
+		return (PCAP_ERROR);
+	}
+
+	memset(&req, 0, sizeof req);
+	strncpy(req.ifm_name, p->opt.source, sizeof req.ifm_name);
+
 	/*
-	 * It looks that BPF code generated by gen_protochain() is not
-	 * compatible with some of kernel BPF code (for example BSD/OS 3.1).
-	 * Take a safer side for now.
+	 * Find out how many media types we have.
 	 */
-	if (no_optimize) {
+	if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
 		/*
-		 * XXX - what if we already have a filter in the kernel?
+		 * Can't get the media types.
 		 */
-		if (install_bpf_program(p, fp) < 0)
-			return (-1);
-		p->md.use_bpf = 0;	/* filtering in userland */
-		return (0);
+		if (errno == EINVAL) {
+			/*
+			 * Interface doesn't support SIOC{G,S}IFMEDIA.
+			 */
+			close(sock);
+			return (PCAP_ERROR_RFMON_NOTSUP);
+		}
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMEDIA 1: %s",
+		    pcap_strerror(errno));
+		close(sock);
+		return (PCAP_ERROR);
+	}
+	if (req.ifm_count == 0) {
+		/*
+		 * No media types.
+		 */
+		close(sock);
+		return (PCAP_ERROR_RFMON_NOTSUP);
+	}
+
+	/*
+	 * Allocate a buffer to hold all the media types, and
+	 * get the media types.
+	 */
+	media_list = malloc(req.ifm_count * sizeof(int));
+	if (media_list == NULL) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
+		    pcap_strerror(errno));
+		close(sock);
+		return (PCAP_ERROR);
+	}
+	req.ifm_ulist = media_list;
+	if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMEDIA: %s",
+		    pcap_strerror(errno));
+		free(media_list);
+		close(sock);
+		return (PCAP_ERROR);
+	}
+
+	/*
+	 * Look for an 802.11 "automatic" media type.
+	 * We assume that all 802.11 adapters have that media type,
+	 * and that it will carry the monitor mode supported flag.
+	 */
+	can_do = 0;
+	for (i = 0; i < req.ifm_count; i++) {
+		if (IFM_TYPE(media_list[i]) == IFM_IEEE80211
+		    && IFM_SUBTYPE(media_list[i]) == IFM_AUTO) {
+			/* OK, does it do monitor mode? */
+			if (media_list[i] & IFM_IEEE80211_MONITOR) {
+				can_do = 1;
+				break;
+			}
+		}
+	}
+	free(media_list);
+	if (!can_do) {
+		/*
+		 * This adapter doesn't support monitor mode.
+		 */
+		close(sock);
+		return (PCAP_ERROR_RFMON_NOTSUP);
+	}
+
+	if (set) {
+		/*
+		 * Don't just check whether we can enable monitor mode,
+		 * do so, if it's not already enabled.
+		 */
+		if ((req.ifm_current & IFM_IEEE80211_MONITOR) == 0) {
+			/*
+			 * Monitor mode isn't currently on, so turn it on,
+			 * and remember that we should turn it off when the
+			 * pcap_t is closed.
+			 */
+
+			/*
+			 * If we haven't already done so, arrange to have
+			 * "pcap_close_all()" called when we exit.
+			 */
+			if (!pcap_do_addexit(p)) {
+				/*
+				 * "atexit()" failed; don't put the interface
+				 * in monitor mode, just give up.
+				 */
+				snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+				     "atexit failed");
+				close(sock);
+				return (PCAP_ERROR);
+			}
+			memset(&ifr, 0, sizeof(ifr));
+			(void)strncpy(ifr.ifr_name, p->opt.source,
+			    sizeof(ifr.ifr_name));
+			ifr.ifr_media = req.ifm_current | IFM_IEEE80211_MONITOR;
+			if (ioctl(sock, SIOCSIFMEDIA, &ifr) == -1) {
+				snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+				     "SIOCSIFMEDIA: %s", pcap_strerror(errno));
+				close(sock);
+				return (PCAP_ERROR);
+			}
+
+			p->md.must_clear |= MUST_CLEAR_RFMON;
+
+			/*
+			 * Add this to the list of pcaps to close when we exit.
+			 */
+			pcap_add_to_pcaps_to_close(p);
+		}
+	}
+	return (0);
+}
+#endif /* HAVE_BSD_IEEE80211 */
+
+#if defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211))
+/*
+ * Check whether we have any 802.11 link-layer types; return the best
+ * of the 802.11 link-layer types if we find one, and return -1
+ * otherwise.
+ *
+ * DLT_IEEE802_11_RADIO, with the radiotap header, is considered the
+ * best 802.11 link-layer type; any of the other 802.11-plus-radio
+ * headers are second-best; 802.11 with no radio information is
+ * the least good.
+ */
+static int
+find_802_11(struct bpf_dltlist *bdlp)
+{
+	int new_dlt;
+	int i;
+
+	/*
+	 * Scan the list of DLT_ values, looking for 802.11 values,
+	 * and, if we find any, choose the best of them.
+	 */
+	new_dlt = -1;
+	for (i = 0; i < bdlp->bfl_len; i++) {
+		switch (bdlp->bfl_list[i]) {
+
+		case DLT_IEEE802_11:
+			/*
+			 * 802.11, but no radio.
+			 *
+			 * Offer this, and select it as the new mode
+			 * unless we've already found an 802.11
+			 * header with radio information.
+			 */
+			if (new_dlt == -1)
+				new_dlt = bdlp->bfl_list[i];
+			break;
+
+		case DLT_PRISM_HEADER:
+		case DLT_AIRONET_HEADER:
+		case DLT_IEEE802_11_RADIO_AVS:
+			/*
+			 * 802.11 with radio, but not radiotap.
+			 *
+			 * Offer this, and select it as the new mode
+			 * unless we've already found the radiotap DLT_.
+			 */
+			if (new_dlt != DLT_IEEE802_11_RADIO)
+				new_dlt = bdlp->bfl_list[i];
+			break;
+
+		case DLT_IEEE802_11_RADIO:
+			/*
+			 * 802.11 with radiotap.
+			 *
+			 * Offer this, and select it as the new mode.
+			 */
+			new_dlt = bdlp->bfl_list[i];
+			break;
+
+		default:
+			/*
+			 * Not 802.11.
+			 */
+			break;
+		}
+	}
+
+	return (new_dlt);
+}
+#endif /* defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)) */
+
+#if defined(__APPLE__) && defined(BIOCGDLTLIST)
+/*
+ * Remove DLT_EN10MB from the list of DLT_ values.
+ */
+static void
+remove_en(pcap_t *p)
+{
+	int i, j;
+
+	/*
+	 * Scan the list of DLT_ values and discard DLT_EN10MB.
+	 */
+	j = 0;
+	for (i = 0; i < p->dlt_count; i++) {
+		switch (p->dlt_list[i]) {
+
+		case DLT_EN10MB:
+			/*
+			 * Don't offer this one.
+			 */
+			continue;
+
+		default:
+			/*
+			 * Just copy this mode over.
+			 */
+			break;
+		}
+
+		/*
+		 * Copy this DLT_ value to its new position.
+		 */
+		p->dlt_list[j] = p->dlt_list[i];
+		j++;
 	}
 
 	/*
+	 * Set the DLT_ count to the number of entries we copied.
+	 */
+	p->dlt_count = j;
+}
+
+/*
+ * Remove DLT_EN10MB from the list of DLT_ values, and look for the
+ * best 802.11 link-layer type in that list and return it.
+ * Radiotap is better than anything else; 802.11 with any other radio
+ * header is better than 802.11 with no radio header.
+ */
+static void
+remove_802_11(pcap_t *p)
+{
+	int i, j;
+
+	/*
+	 * Scan the list of DLT_ values and discard 802.11 values.
+	 */
+	j = 0;
+	for (i = 0; i < p->dlt_count; i++) {
+		switch (p->dlt_list[i]) {
+
+		case DLT_IEEE802_11:
+		case DLT_PRISM_HEADER:
+		case DLT_AIRONET_HEADER:
+		case DLT_IEEE802_11_RADIO:
+		case DLT_IEEE802_11_RADIO_AVS:
+			/*
+			 * 802.11.  Don't offer this one.
+			 */
+			continue;
+
+		default:
+			/*
+			 * Just copy this mode over.
+			 */
+			break;
+		}
+
+		/*
+		 * Copy this DLT_ value to its new position.
+		 */
+		p->dlt_list[j] = p->dlt_list[i];
+		j++;
+	}
+
+	/*
+	 * Set the DLT_ count to the number of entries we copied.
+	 */
+	p->dlt_count = j;
+}
+#endif /* defined(__APPLE__) && defined(BIOCGDLTLIST) */
+
+static int
+pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp)
+{
+	/*
 	 * Free any user-mode filter we might happen to have installed.
 	 */
 	pcap_freecode(&p->fcode);
@@ -1354,20 +2559,51 @@ pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp)
 	/*
 	 * Try to install the kernel filter.
 	 */
-	if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) {
+	if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) == 0) {
+		/*
+		 * It worked.
+		 */
+		p->md.use_bpf = 1;	/* filtering in the kernel */
+
+		/*
+		 * Discard any previously-received packets, as they might
+		 * have passed whatever filter was formerly in effect, but
+		 * might not pass this filter (BIOCSETF discards packets
+		 * buffered in the kernel, so you can lose packets in any
+		 * case).
+		 */
+		p->cc = 0;
+		return (0);
+	}
+
+	/*
+	 * We failed.
+	 *
+	 * If it failed with EINVAL, that's probably because the program
+	 * is invalid or too big.  Validate it ourselves; if we like it
+	 * (we currently allow backward branches, to support protochain),
+	 * run it in userland.  (There's no notion of "too big" for
+	 * userland.)
+	 *
+	 * Otherwise, just give up.
+	 * XXX - if the copy of the program into the kernel failed,
+	 * we will get EINVAL rather than, say, EFAULT on at least
+	 * some kernels.
+	 */
+	if (errno != EINVAL) {
 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
 		    pcap_strerror(errno));
 		return (-1);
 	}
-	p->md.use_bpf = 1;	/* filtering in the kernel */
 
 	/*
-	 * Discard any previously-received packets, as they might have
-	 * passed whatever filter was formerly in effect, but might
-	 * not pass this filter (BIOCSETF discards packets buffered
-	 * in the kernel, so you can lose packets in any case).
+	 * install_bpf_program() validates the program.
+	 *
+	 * XXX - what if we already have a filter in the kernel?
 	 */
-	p->cc = 0;
+	if (install_bpf_program(p, fp) < 0)
+		return (-1);
+	p->md.use_bpf = 0;	/* filtering in userland */
 	return (0);
 }
 
diff --git a/contrib/libpcap/pcap-bpf.h b/contrib/libpcap/pcap-bpf.h
index 62c493b..5fe129d 100644
--- a/contrib/libpcap/pcap-bpf.h
+++ b/contrib/libpcap/pcap-bpf.h
@@ -35,800 +35,13 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
- *
- * @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.34.2.24 2007/09/19 02:52:12 guy Exp $ (LBL)
- */
-
-/*
- * This is libpcap's cut-down version of bpf.h; it includes only
- * the stuff needed for the code generator and the userland BPF
- * interpreter, and the libpcap APIs for setting filters, etc..
- *
- * "pcap-bpf.c" will include the native OS version, as it deals with
- * the OS's BPF implementation.
- *
- * XXX - should this all just be moved to "pcap.h"?
- */
-
-#ifndef BPF_MAJOR_VERSION
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* BSD style release date */
-#define BPF_RELEASE 199606
-
-#ifdef MSDOS /* must be 32-bit */
-typedef long          bpf_int32;
-typedef unsigned long bpf_u_int32;
-#else
-typedef	int bpf_int32;
-typedef	u_int bpf_u_int32;
-#endif
-
-/*
- * Alignment macros.  BPF_WORDALIGN rounds up to the next 
- * even multiple of BPF_ALIGNMENT. 
- */
-#ifndef __NetBSD__
-#define BPF_ALIGNMENT sizeof(bpf_int32)
-#else
-#define BPF_ALIGNMENT sizeof(long)
-#endif
-#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
-
-#define BPF_MAXINSNS 512
-#define BPF_MAXBUFSIZE 0x8000
-#define BPF_MINBUFSIZE 32
-
-/*
- * Structure for "pcap_compile()", "pcap_setfilter()", etc..
- */
-struct bpf_program {
-	u_int bf_len;
-	struct bpf_insn *bf_insns;
-};
- 
-/*
- * Struct return by BIOCVERSION.  This represents the version number of 
- * the filter language described by the instruction encodings below.
- * bpf understands a program iff kernel_major == filter_major &&
- * kernel_minor >= filter_minor, that is, if the value returned by the
- * running kernel has the same major number and a minor number equal
- * equal to or less than the filter being downloaded.  Otherwise, the
- * results are undefined, meaning an error may be returned or packets
- * may be accepted haphazardly.
- * It has nothing to do with the source code version.
- */
-struct bpf_version {
-	u_short bv_major;
-	u_short bv_minor;
-};
-/* Current version number of filter architecture. */
-#define BPF_MAJOR_VERSION 1
-#define BPF_MINOR_VERSION 1
-
-/*
- * Data-link level type codes.
- *
- * Do *NOT* add new values to this list without asking
- * "tcpdump-workers@tcpdump.org" for a value.  Otherwise, you run the
- * risk of using a value that's already being used for some other purpose,
- * and of having tools that read libpcap-format captures not being able
- * to handle captures with your new DLT_ value, with no hope that they
- * will ever be changed to do so (as that would destroy their ability
- * to read captures using that value for that other purpose).
- */
-
-/*
- * These are the types that are the same on all platforms, and that
- * have been defined by <net/bpf.h> for ages.
- */
-#define DLT_NULL	0	/* BSD loopback encapsulation */
-#define DLT_EN10MB	1	/* Ethernet (10Mb) */
-#define DLT_EN3MB	2	/* Experimental Ethernet (3Mb) */
-#define DLT_AX25	3	/* Amateur Radio AX.25 */
-#define DLT_PRONET	4	/* Proteon ProNET Token Ring */
-#define DLT_CHAOS	5	/* Chaos */
-#define DLT_IEEE802	6	/* 802.5 Token Ring */
-#define DLT_ARCNET	7	/* ARCNET, with BSD-style header */
-#define DLT_SLIP	8	/* Serial Line IP */
-#define DLT_PPP		9	/* Point-to-point Protocol */
-#define DLT_FDDI	10	/* FDDI */
-
-/*
- * These are types that are different on some platforms, and that
- * have been defined by <net/bpf.h> for ages.  We use #ifdefs to
- * detect the BSDs that define them differently from the traditional
- * libpcap <net/bpf.h>
- *
- * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
- * but I don't know what the right #define is for BSD/OS.
- */
-#define DLT_ATM_RFC1483	11	/* LLC-encapsulated ATM */
-
-#ifdef __OpenBSD__
-#define DLT_RAW		14	/* raw IP */
-#else
-#define DLT_RAW		12	/* raw IP */
-#endif
-
-/*
- * Given that the only OS that currently generates BSD/OS SLIP or PPP
- * is, well, BSD/OS, arguably everybody should have chosen its values
- * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
- * didn't.  So it goes.
- */
-#if defined(__NetBSD__) || defined(__FreeBSD__)
-#ifndef DLT_SLIP_BSDOS
-#define DLT_SLIP_BSDOS	13	/* BSD/OS Serial Line IP */
-#define DLT_PPP_BSDOS	14	/* BSD/OS Point-to-point Protocol */
-#endif
-#else
-#define DLT_SLIP_BSDOS	15	/* BSD/OS Serial Line IP */
-#define DLT_PPP_BSDOS	16	/* BSD/OS Point-to-point Protocol */
-#endif
-
-/*
- * 17 is used for DLT_OLD_PFLOG in OpenBSD;
- *     OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below.
- * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else.
- */
-
-#define DLT_ATM_CLIP	19	/* Linux Classical-IP over ATM */
-
-/*
- * Apparently Redback uses this for its SmartEdge 400/800.  I hope
- * nobody else decided to use it, too.
- */
-#define DLT_REDBACK_SMARTEDGE	32
-
-/*
- * These values are defined by NetBSD; other platforms should refrain from
- * using them for other purposes, so that NetBSD savefiles with link
- * types of 50 or 51 can be read as this type on all platforms.
- */
-#define DLT_PPP_SERIAL	50	/* PPP over serial with HDLC encapsulation */
-#define DLT_PPP_ETHER	51	/* PPP over Ethernet */
-
-/*
- * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
- * a link-layer type of 99 for the tcpdump it supplies.  The link-layer
- * header has 6 bytes of unknown data, something that appears to be an
- * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
- * I've seen.
- */
-#define DLT_SYMANTEC_FIREWALL	99
-
-/*
- * Values between 100 and 103 are used in capture file headers as
- * link-layer types corresponding to DLT_ types that differ
- * between platforms; don't use those values for new DLT_ new types.
- */
-
-/*
- * This value was defined by libpcap 0.5; platforms that have defined
- * it with a different value should define it here with that value -
- * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
- * whatever value that happens to be, so programs will correctly
- * handle files with that link type regardless of the value of
- * DLT_C_HDLC.
- *
- * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
- * compatibility with programs written for BSD/OS.
- *
- * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
- * for source compatibility with programs written for libpcap 0.5.
- */
-#define DLT_C_HDLC	104	/* Cisco HDLC */
-#define DLT_CHDLC	DLT_C_HDLC
-
-#define DLT_IEEE802_11	105	/* IEEE 802.11 wireless */
-
-/*
- * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
- * except when it isn't.  (I.e., sometimes it's just raw IP, and
- * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL,
- * so that we don't have to worry about the link-layer header.)
- */
-
-/*
- * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
- * with other values.
- * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
- * (DLCI, etc.).
- */
-#define DLT_FRELAY	107
-
-/*
- * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
- * that the AF_ type in the link-layer header is in network byte order.
- *
- * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
- * we don't use 12 for it in OSes other than OpenBSD.
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.50 2007/04/01 21:43:55 guy Exp $ (LBL)
  */
-#ifdef __OpenBSD__
-#define DLT_LOOP	12
-#else
-#define DLT_LOOP	108
-#endif
 
 /*
- * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
- * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
- * than OpenBSD.
- */
-#ifdef __OpenBSD__
-#define DLT_ENC		13
-#else
-#define DLT_ENC		109
-#endif
-
-/*
- * Values between 110 and 112 are reserved for use in capture file headers
- * as link-layer types corresponding to DLT_ types that might differ
- * between platforms; don't use those values for new DLT_ types
- * other than the corresponding DLT_ types.
- */
-
-/*
- * This is for Linux cooked sockets.
- */
-#define DLT_LINUX_SLL	113
-
-/*
- * Apple LocalTalk hardware.
- */
-#define DLT_LTALK	114
-
-/*
- * Acorn Econet.
- */
-#define DLT_ECONET	115
-
-/*
- * Reserved for use with OpenBSD ipfilter.
- */
-#define DLT_IPFILTER	116
-
-/*
- * OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023
- * in SuSE 6.3, so we can't use 17 for it in capture-file headers.
- *
- * XXX: is there a conflict with DLT_PFSYNC 18 as well?
- */
-#ifdef __OpenBSD__
-#define DLT_OLD_PFLOG	17
-#define DLT_PFSYNC	18
-#endif
-#define DLT_PFLOG	117
-
-/*
- * Registered for Cisco-internal use.
- */
-#define DLT_CISCO_IOS	118
-
-/*
- * For 802.11 cards using the Prism II chips, with a link-layer
- * header including Prism monitor mode information plus an 802.11
- * header.
- */
-#define DLT_PRISM_HEADER	119
-
-/*
- * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
- * (see Doug Ambrisko's FreeBSD patches).
- */
-#define DLT_AIRONET_HEADER	120
-
-/*
- * Reserved for Siemens HiPath HDLC.
- */
-#define DLT_HHDLC		121
-
-/*
- * This is for RFC 2625 IP-over-Fibre Channel.
- *
- * This is not for use with raw Fibre Channel, where the link-layer
- * header starts with a Fibre Channel frame header; it's for IP-over-FC,
- * where the link-layer header starts with an RFC 2625 Network_Header
- * field.
- */
-#define DLT_IP_OVER_FC		122
-
-/*
- * This is for Full Frontal ATM on Solaris with SunATM, with a
- * pseudo-header followed by an AALn PDU.
+ * For backwards compatibility.
  *
- * There may be other forms of Full Frontal ATM on other OSes,
- * with different pseudo-headers.
- *
- * If ATM software returns a pseudo-header with VPI/VCI information
- * (and, ideally, packet type information, e.g. signalling, ILMI,
- * LANE, LLC-multiplexed traffic, etc.), it should not use
- * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
- * and the like don't have to infer the presence or absence of a
- * pseudo-header and the form of the pseudo-header.
- */
-#define DLT_SUNATM		123	/* Solaris+SunATM */
-
-/* 
- * Reserved as per request from Kent Dahlgren <kent@praesum.com>
- * for private use.
- */
-#define DLT_RIO                 124     /* RapidIO */
-#define DLT_PCI_EXP             125     /* PCI Express */
-#define DLT_AURORA              126     /* Xilinx Aurora link layer */
-
-/*
- * Header for 802.11 plus a number of bits of link-layer information
- * including radio information, used by some recent BSD drivers as
- * well as the madwifi Atheros driver for Linux.
- */
-#define DLT_IEEE802_11_RADIO	127	/* 802.11 plus radiotap radio header */
-
-/*
- * Reserved for the TZSP encapsulation, as per request from
- * Chris Waters <chris.waters@networkchemistry.com>
- * TZSP is a generic encapsulation for any other link type,
- * which includes a means to include meta-information
- * with the packet, e.g. signal strength and channel
- * for 802.11 packets.
- */
-#define DLT_TZSP                128     /* Tazmen Sniffer Protocol */
-
-/*
- * BSD's ARCNET headers have the source host, destination host,
- * and type at the beginning of the packet; that's what's handed
- * up to userland via BPF.
- *
- * Linux's ARCNET headers, however, have a 2-byte offset field
- * between the host IDs and the type; that's what's handed up
- * to userland via PF_PACKET sockets.
- *
- * We therefore have to have separate DLT_ values for them.
- */
-#define DLT_ARCNET_LINUX	129	/* ARCNET */
-
-/*
- * Juniper-private data link types, as per request from
- * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
- * for passing on chassis-internal metainformation such as
- * QOS profiles, etc..
- */
-#define DLT_JUNIPER_MLPPP       130
-#define DLT_JUNIPER_MLFR        131
-#define DLT_JUNIPER_ES          132
-#define DLT_JUNIPER_GGSN        133
-#define DLT_JUNIPER_MFR         134
-#define DLT_JUNIPER_ATM2        135
-#define DLT_JUNIPER_SERVICES    136
-#define DLT_JUNIPER_ATM1        137
-
-/*
- * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
- * <dieter@apple.com>.  The header that's presented is an Ethernet-like
- * header:
- *
- *	#define FIREWIRE_EUI64_LEN	8
- *	struct firewire_header {
- *		u_char  firewire_dhost[FIREWIRE_EUI64_LEN];
- *		u_char  firewire_shost[FIREWIRE_EUI64_LEN];
- *		u_short firewire_type;
- *	};
- *
- * with "firewire_type" being an Ethernet type value, rather than,
- * for example, raw GASP frames being handed up.
- */
-#define DLT_APPLE_IP_OVER_IEEE1394	138
-
-/*
- * Various SS7 encapsulations, as per a request from Jeff Morriss
- * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
- */
-#define DLT_MTP2_WITH_PHDR	139	/* pseudo-header with various info, followed by MTP2 */
-#define DLT_MTP2		140	/* MTP2, without pseudo-header */
-#define DLT_MTP3		141	/* MTP3, without pseudo-header or MTP2 */
-#define DLT_SCCP		142	/* SCCP, without pseudo-header or MTP2 or MTP3 */
-
-/*
- * DOCSIS MAC frames.
+ * Note to OS vendors: do NOT get rid of this file!  Some applications
+ * might expect to be able to include <pcap-bpf.h>.
  */
-#define DLT_DOCSIS		143
-
-/*
- * Linux-IrDA packets. Protocol defined at http://www.irda.org.
- * Those packets include IrLAP headers and above (IrLMP...), but
- * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
- * framing can be handled by the hardware and depend on the bitrate.
- * This is exactly the format you would get capturing on a Linux-IrDA
- * interface (irdaX), but not on a raw serial port.
- * Note the capture is done in "Linux-cooked" mode, so each packet include
- * a fake packet header (struct sll_header). This is because IrDA packet
- * decoding is dependant on the direction of the packet (incomming or
- * outgoing).
- * When/if other platform implement IrDA capture, we may revisit the
- * issue and define a real DLT_IRDA...
- * Jean II
- */
-#define DLT_LINUX_IRDA		144
-
-/*
- * Reserved for IBM SP switch and IBM Next Federation switch.
- */
-#define DLT_IBM_SP		145
-#define DLT_IBM_SN		146
-
-/*
- * Reserved for private use.  If you have some link-layer header type
- * that you want to use within your organization, with the capture files
- * using that link-layer header type not ever be sent outside your
- * organization, you can use these values.
- *
- * No libpcap release will use these for any purpose, nor will any
- * tcpdump release use them, either.
- *
- * Do *NOT* use these in capture files that you expect anybody not using
- * your private versions of capture-file-reading tools to read; in
- * particular, do *NOT* use them in products, otherwise you may find that
- * people won't be able to use tcpdump, or snort, or Ethereal, or... to
- * read capture files from your firewall/intrusion detection/traffic
- * monitoring/etc. appliance, or whatever product uses that DLT_ value,
- * and you may also find that the developers of those applications will
- * not accept patches to let them read those files.
- *
- * Also, do not use them if somebody might send you a capture using them
- * for *their* private type and tools using them for *your* private type
- * would have to read them.
- *
- * Instead, ask "tcpdump-workers@tcpdump.org" for a new DLT_ value,
- * as per the comment above, and use the type you're given.
- */
-#define DLT_USER0		147
-#define DLT_USER1		148
-#define DLT_USER2		149
-#define DLT_USER3		150
-#define DLT_USER4		151
-#define DLT_USER5		152
-#define DLT_USER6		153
-#define DLT_USER7		154
-#define DLT_USER8		155
-#define DLT_USER9		156
-#define DLT_USER10		157
-#define DLT_USER11		158
-#define DLT_USER12		159
-#define DLT_USER13		160
-#define DLT_USER14		161
-#define DLT_USER15		162
-
-/*
- * For future use with 802.11 captures - defined by AbsoluteValue
- * Systems to store a number of bits of link-layer information
- * including radio information:
- *
- *	http://www.shaftnet.org/~pizza/software/capturefrm.txt
- *
- * but it might be used by some non-AVS drivers now or in the
- * future.
- */
-#define DLT_IEEE802_11_RADIO_AVS 163	/* 802.11 plus AVS radio header */
-
-/*
- * Juniper-private data link type, as per request from
- * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
- * for passing on chassis-internal metainformation such as
- * QOS profiles, etc..
- */
-#define DLT_JUNIPER_MONITOR     164
-
-/*
- * Reserved for BACnet MS/TP.
- */
-#define DLT_BACNET_MS_TP	165
-
-/*
- * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
- *
- * This is used in some OSes to allow a kernel socket filter to distinguish
- * between incoming and outgoing packets, on a socket intended to
- * supply pppd with outgoing packets so it can do dial-on-demand and
- * hangup-on-lack-of-demand; incoming packets are filtered out so they
- * don't cause pppd to hold the connection up (you don't want random
- * input packets such as port scans, packets from old lost connections,
- * etc. to force the connection to stay up).
- *
- * The first byte of the PPP header (0xff03) is modified to accomodate
- * the direction - 0x00 = IN, 0x01 = OUT.
- */
-#define DLT_PPP_PPPD		166
-
-/*
- * Names for backwards compatibility with older versions of some PPP
- * software; new software should use DLT_PPP_PPPD.
- */
-#define DLT_PPP_WITH_DIRECTION	DLT_PPP_PPPD
-#define DLT_LINUX_PPP_WITHDIRECTION	DLT_PPP_PPPD
-
-/*
- * Juniper-private data link type, as per request from
- * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
- * for passing on chassis-internal metainformation such as
- * QOS profiles, cookies, etc..
- */
-#define DLT_JUNIPER_PPPOE       167
-#define DLT_JUNIPER_PPPOE_ATM   168
-
-#define DLT_GPRS_LLC		169	/* GPRS LLC */
-#define DLT_GPF_T		170	/* GPF-T (ITU-T G.7041/Y.1303) */
-#define DLT_GPF_F		171	/* GPF-F (ITU-T G.7041/Y.1303) */
-
-/*
- * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
- * monitoring equipment.
- */
-#define DLT_GCOM_T1E1		172
-#define DLT_GCOM_SERIAL		173
-
-/*
- * Juniper-private data link type, as per request from
- * Hannes Gredler <hannes@juniper.net>.  The DLT_ is used
- * for internal communication to Physical Interface Cards (PIC)
- */
-#define DLT_JUNIPER_PIC_PEER    174
-
-/*
- * Link types requested by Gregor Maier <gregor@endace.com> of Endace
- * Measurement Systems.  They add an ERF header (see
- * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
- * the link-layer header.
- */
-#define DLT_ERF_ETH		175	/* Ethernet */
-#define DLT_ERF_POS		176	/* Packet-over-SONET */
-
-/*
- * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
- * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
- * includes additional information before the LAPD header, so it's
- * not necessarily a generic LAPD header.
- */
-#define DLT_LINUX_LAPD		177
-
-/*
- * Juniper-private data link type, as per request from
- * Hannes Gredler <hannes@juniper.net>. 
- * The DLT_ are used for prepending meta-information
- * like interface index, interface name
- * before standard Ethernet, PPP, Frelay & C-HDLC Frames
- */
-#define DLT_JUNIPER_ETHER       178
-#define DLT_JUNIPER_PPP         179
-#define DLT_JUNIPER_FRELAY      180
-#define DLT_JUNIPER_CHDLC       181
-
-/*
- * Multi Link Frame Relay (FRF.16)
- */
-#define DLT_MFR                 182
-
-/*
- * Juniper-private data link type, as per request from
- * Hannes Gredler <hannes@juniper.net>. 
- * The DLT_ is used for internal communication with a
- * voice Adapter Card (PIC)
- */
-#define DLT_JUNIPER_VP          183
-
-/*
- * Arinc 429 frames.
- * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
- * Every frame contains a 32bit A429 label.
- * More documentation on Arinc 429 can be found at
- * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
- */
-#define DLT_A429                184
-
-/*
- * Arinc 653 Interpartition Communication messages.
- * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
- * Please refer to the A653-1 standard for more information.
- */
-#define DLT_A653_ICM            185
-
-/*
- * USB packets, beginning with a USB setup header; requested by
- * Paolo Abeni <paolo.abeni@email.it>.
- */
-#define DLT_USB			186
-
-/*
- * Bluetooth HCI UART transport layer (part H:4); requested by
- * Paolo Abeni.
- */
-#define DLT_BLUETOOTH_HCI_H4	187
-
-/*
- * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
- * <cruz_petagay@bah.com>.
- */
-#define DLT_IEEE802_16_MAC_CPS	188
-
-/*
- * USB packets, beginning with a Linux USB header; requested by
- * Paolo Abeni <paolo.abeni@email.it>.
- */
-#define DLT_USB_LINUX		189
-
-/*
- * Controller Area Network (CAN) v. 2.0B packets.
- * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
- * Used to dump CAN packets coming from a CAN Vector board.
- * More documentation on the CAN v2.0B frames can be found at
- * http://www.can-cia.org/downloads/?269
- */
-#define DLT_CAN20B              190
-
-/*
- * IEEE 802.15.4, with address fields padded, as is done by Linux
- * drivers; requested by Juergen Schimmer.
- */
-#define DLT_IEEE802_15_4_LINUX	191
-
-/*
- * Per Packet Information encapsulated packets.
- * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
- */
-#define DLT_PPI			192
-
-/*
- * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
- * requested by Charles Clancy.
- */
-#define DLT_IEEE802_16_MAC_CPS_RADIO	193
-
-/*
- * Juniper-private data link type, as per request from
- * Hannes Gredler <hannes@juniper.net>. 
- * The DLT_ is used for internal communication with a
- * integrated service module (ISM).
- */
-#define DLT_JUNIPER_ISM         194
-
-/*
- * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
- * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
- */
-#define DLT_IEEE802_15_4	195
-
-/*
- * Various link-layer types, with a pseudo-header, for SITA
- * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
- */
-#define DLT_SITA		196
-
-/*
- * Various link-layer types, with a pseudo-header, for Endace DAG cards;
- * encapsulates Endace ERF records.  Requested by Stephen Donnelly
- * <stephen@endace.com>.
- */
-#define DLT_ERF			197
-
-/*
- * Special header prepended to Ethernet packets when capturing from a
- * u10 Networks board.  Requested by Phil Mulholland
- * <phil@u10networks.com>.
- */
-#define DLT_RAIF1		198
-
-/*
- * IPMB packet for IPMI, beginning with the I2C slave address, followed
- * by the netFn and LUN, etc..  Requested by Chanthy Toeung
- * <chanthy.toeung@ca.kontron.com>.
- */
-#define DLT_IPMB		199
-
-/*
- * Juniper-private data link type, as per request from
- * Hannes Gredler <hannes@juniper.net>. 
- * The DLT_ is used for capturing data on a secure tunnel interface.
- */
-#define DLT_JUNIPER_ST          200
-
-/*
- * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
- * that includes direction information; requested by Paolo Abeni.
- */
-#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR	201
-
-
-/*
- * The instruction encodings.
- */
-/* instruction classes */
-#define BPF_CLASS(code) ((code) & 0x07)
-#define		BPF_LD		0x00
-#define		BPF_LDX		0x01
-#define		BPF_ST		0x02
-#define		BPF_STX		0x03
-#define		BPF_ALU		0x04
-#define		BPF_JMP		0x05
-#define		BPF_RET		0x06
-#define		BPF_MISC	0x07
-
-/* ld/ldx fields */
-#define BPF_SIZE(code)	((code) & 0x18)
-#define		BPF_W		0x00
-#define		BPF_H		0x08
-#define		BPF_B		0x10
-#define BPF_MODE(code)	((code) & 0xe0)
-#define		BPF_IMM 	0x00
-#define		BPF_ABS		0x20
-#define		BPF_IND		0x40
-#define		BPF_MEM		0x60
-#define		BPF_LEN		0x80
-#define		BPF_MSH		0xa0
-
-/* alu/jmp fields */
-#define BPF_OP(code)	((code) & 0xf0)
-#define		BPF_ADD		0x00
-#define		BPF_SUB		0x10
-#define		BPF_MUL		0x20
-#define		BPF_DIV		0x30
-#define		BPF_OR		0x40
-#define		BPF_AND		0x50
-#define		BPF_LSH		0x60
-#define		BPF_RSH		0x70
-#define		BPF_NEG		0x80
-#define		BPF_JA		0x00
-#define		BPF_JEQ		0x10
-#define		BPF_JGT		0x20
-#define		BPF_JGE		0x30
-#define		BPF_JSET	0x40
-#define BPF_SRC(code)	((code) & 0x08)
-#define		BPF_K		0x00
-#define		BPF_X		0x08
-
-/* ret - BPF_K and BPF_X also apply */
-#define BPF_RVAL(code)	((code) & 0x18)
-#define		BPF_A		0x10
-
-/* misc */
-#define BPF_MISCOP(code) ((code) & 0xf8)
-#define		BPF_TAX		0x00
-#define		BPF_TXA		0x80
-
-/*
- * The instruction data structure.
- */
-struct bpf_insn {
-	u_short	code;
-	u_char 	jt;
-	u_char 	jf;
-	bpf_int32 k;
-};
-
-/*
- * Macros for insn array initializers.
- */
-#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
-#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
-
-#if __STDC__ || defined(__cplusplus)
-extern int bpf_validate(struct bpf_insn *, int);
-extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
-#else
-extern int bpf_validate();
-extern u_int bpf_filter();
-#endif
-
-/*
- * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
- */
-#define BPF_MEMWORDS 16
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
+#include <pcap/bpf.h>
diff --git a/contrib/libpcap/pcap-bt-linux.c b/contrib/libpcap/pcap-bt-linux.c
new file mode 100644
index 0000000..2c619ff
--- /dev/null
+++ b/contrib/libpcap/pcap-bt-linux.c
@@ -0,0 +1,372 @@
+/*
+ * Copyright (c) 2006 Paolo Abeni (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote 
+ * products derived from this software without specific prior written 
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * Bluetooth sniffing API implementation for Linux platform
+ * By Paolo Abeni <paolo.abeni@email.it>
+ *
+ */
+#ifndef lint
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-bt-linux.c,v 1.9.2.6 2008-07-01 07:06:37 guy Exp $ (LBL)";
+#endif
+ 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "pcap-int.h"
+#include "pcap-bt-linux.h"
+#include "pcap/bluetooth.h"
+
+#ifdef NEED_STRERROR_H
+#include "strerror.h"
+#endif
+
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#include <bluetooth/bluetooth.h>
+#include <bluetooth/hci.h>
+
+#define BT_IFACE "bluetooth"
+#define BT_CTRL_SIZE 128
+
+/* forward declaration */
+static int bt_activate(pcap_t *);
+static int bt_read_linux(pcap_t *, int , pcap_handler , u_char *);
+static int bt_inject_linux(pcap_t *, const void *, size_t);
+static int bt_setfilter_linux(pcap_t *, struct bpf_program *);
+static int bt_setdirection_linux(pcap_t *, pcap_direction_t);
+static int bt_stats_linux(pcap_t *, struct pcap_stat *);
+
+int 
+bt_platform_finddevs(pcap_if_t **alldevsp, char *err_str)
+{
+	pcap_if_t *found_dev = *alldevsp;
+	struct hci_dev_list_req *dev_list;
+	struct hci_dev_req *dev_req;
+	int i, sock;
+	int ret = 0;
+	
+	sock  = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
+	if (sock < 0)
+	{
+		/* if bluetooth is not supported this this is not fatal*/ 
+		if (errno == EAFNOSUPPORT)
+			return 0;
+		snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't open raw Bluetooth socket %d:%s",
+			errno, strerror(errno));
+		return -1;
+	}
+
+	dev_list = malloc(HCI_MAX_DEV * sizeof(*dev_req) + sizeof(*dev_list));
+	if (!dev_list) 
+	{
+		snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't allocate %zu bytes for Bluetooth device list",
+			HCI_MAX_DEV * sizeof(*dev_req) + sizeof(*dev_list));
+		ret = -1;
+		goto done;
+	}
+
+	dev_list->dev_num = HCI_MAX_DEV;
+
+	if (ioctl(sock, HCIGETDEVLIST, (void *) dev_list) < 0) 
+	{
+		snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't get Bluetooth device list via ioctl %d:%s",
+			errno, strerror(errno));
+		ret = -1;
+		goto free;
+	}
+
+	dev_req = dev_list->dev_req;
+	for (i = 0; i < dev_list->dev_num; i++, dev_req++) {
+		char dev_name[20], dev_descr[30];
+		
+		snprintf(dev_name, 20, BT_IFACE"%d", dev_req->dev_id);
+		snprintf(dev_descr, 30, "Bluetooth adapter number %d", i);
+			
+		if (pcap_add_if(&found_dev, dev_name, 0, 
+		       dev_descr, err_str) < 0)
+		{
+			ret = -1;
+			break;
+		}
+
+	}
+
+free:
+	free(dev_list);
+
+done:
+	close(sock);
+	return ret;
+}
+
+pcap_t *
+bt_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = bt_activate;
+	return (p);
+}
+
+static int
+bt_activate(pcap_t* handle)
+{
+	struct sockaddr_hci addr;
+	int opt;
+	int		dev_id;
+	struct hci_filter	flt;
+	int err = PCAP_ERROR;
+
+	/* get bt interface id */
+	if (sscanf(handle->opt.source, BT_IFACE"%d", &dev_id) != 1)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't get Bluetooth device index from %s", 
+			 handle->opt.source);
+		return PCAP_ERROR;
+	}
+
+	/* Initialize some components of the pcap structure. */
+	handle->bufsize = handle->snapshot+BT_CTRL_SIZE+sizeof(pcap_bluetooth_h4_header);
+	handle->offset = BT_CTRL_SIZE;
+	handle->linktype = DLT_BLUETOOTH_HCI_H4_WITH_PHDR;
+
+	handle->read_op = bt_read_linux;
+	handle->inject_op = bt_inject_linux;
+	handle->setfilter_op = bt_setfilter_linux;
+	handle->setdirection_op = bt_setdirection_linux;
+	handle->set_datalink_op = NULL;	/* can't change data link type */
+	handle->getnonblock_op = pcap_getnonblock_fd;
+	handle->setnonblock_op = pcap_setnonblock_fd;
+	handle->stats_op = bt_stats_linux;
+	handle->md.ifindex = dev_id;
+	
+	/* Create HCI socket */
+	handle->fd = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
+	if (handle->fd < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't create raw socket %d:%s",
+			errno, strerror(errno));
+		return PCAP_ERROR;
+	}
+
+	handle->buffer = malloc(handle->bufsize);
+	if (!handle->buffer) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't allocate dump buffer: %s",
+			pcap_strerror(errno));
+		goto close_fail;
+	}
+
+	opt = 1;
+	if (setsockopt(handle->fd, SOL_HCI, HCI_DATA_DIR, &opt, sizeof(opt)) < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't enable data direction info %d:%s",
+			errno, strerror(errno));
+		goto close_fail;
+	}
+
+	opt = 1;
+	if (setsockopt(handle->fd, SOL_HCI, HCI_TIME_STAMP, &opt, sizeof(opt)) < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't enable time stamp %d:%s",
+			errno, strerror(errno));
+		goto close_fail;
+	}
+
+	/* Setup filter, do not call hci function to avoid dependence on 
+	 * external libs	*/
+	memset(&flt, 0, sizeof(flt));
+	memset((void *) &flt.type_mask, 0xff, sizeof(flt.type_mask));	
+	memset((void *) &flt.event_mask, 0xff, sizeof(flt.event_mask));
+	if (setsockopt(handle->fd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't set filter %d:%s",
+			errno, strerror(errno));
+		goto close_fail;
+	}
+
+
+	/* Bind socket to the HCI device */
+	addr.hci_family = AF_BLUETOOTH;
+	addr.hci_dev = handle->md.ifindex;
+	if (bind(handle->fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't attach to device %d %d:%s",
+			handle->md.ifindex, errno, strerror(errno));
+		goto close_fail;
+	}
+
+	if (handle->opt.rfmon) {
+		/*
+		 * Monitor mode doesn't apply to Bluetooth devices.
+		 */
+		err = PCAP_ERROR_RFMON_NOTSUP;
+		goto close_fail;
+	}
+
+	if (handle->opt.buffer_size == 0) {
+		/*
+		 * Set the socket buffer size to the specified value.
+		 */
+		if (setsockopt(handle->fd, SOL_SOCKET, SO_RCVBUF,
+		    &handle->opt.buffer_size,
+		    sizeof(handle->opt.buffer_size)) == -1) {
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				 "SO_RCVBUF: %s", pcap_strerror(errno));
+			goto close_fail;
+		}
+	}
+
+	handle->selectable_fd = handle->fd;
+	return 0;
+
+close_fail:
+	pcap_cleanup_live_common(handle);
+	return err;
+}
+
+static int
+bt_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
+{
+	struct cmsghdr *cmsg;
+	struct msghdr msg;
+	struct iovec  iv;
+	struct pcap_pkthdr pkth;
+	pcap_bluetooth_h4_header* bthdr;
+
+	bthdr = (pcap_bluetooth_h4_header*) &handle->buffer[handle->offset];
+	iv.iov_base = &handle->buffer[handle->offset+sizeof(pcap_bluetooth_h4_header)];
+	iv.iov_len  = handle->snapshot;
+	
+	memset(&msg, 0, sizeof(msg));
+	msg.msg_iov = &iv;
+	msg.msg_iovlen = 1;
+	msg.msg_control = handle->buffer;
+	msg.msg_controllen = handle->offset;
+
+	/* ignore interrupt system call error */
+	do {
+		pkth.caplen = recvmsg(handle->fd, &msg, 0);
+		if (handle->break_loop)
+		{
+			handle->break_loop = 0;
+			return -2;
+		}
+	} while ((pkth.caplen == -1) && (errno == EINTR));
+
+		
+	if (pkth.caplen < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't receive packet %d:%s",
+			errno, strerror(errno));
+		return -1;
+	}
+
+	/* get direction and timestamp*/ 
+	cmsg = CMSG_FIRSTHDR(&msg);
+	int in=0;
+	while (cmsg) {
+		switch (cmsg->cmsg_type) {
+			case HCI_CMSG_DIR:
+				in = *((int *) CMSG_DATA(cmsg));
+				break;
+                      	case HCI_CMSG_TSTAMP:
+				pkth.ts = *((struct timeval *) CMSG_DATA(cmsg));
+				break;
+		}
+		cmsg = CMSG_NXTHDR(&msg, cmsg);
+	}
+	if ((in && (handle->direction == PCAP_D_OUT)) || 
+				((!in) && (handle->direction == PCAP_D_IN)))
+		return 0;
+
+	bthdr->direction = htonl(in != 0);
+	pkth.caplen+=sizeof(pcap_bluetooth_h4_header);
+	pkth.len = pkth.caplen;
+	callback(user, &pkth, &handle->buffer[handle->offset]);
+	return 1;
+}
+
+static int
+bt_inject_linux(pcap_t *handle, const void *buf, size_t size)
+{
+	snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "inject not supported on "
+    		"bluetooth devices");
+	return (-1);
+}                           
+
+
+static int 
+bt_stats_linux(pcap_t *handle, struct pcap_stat *stats)
+{
+	int ret;
+	struct hci_dev_info dev_info;
+	struct hci_dev_stats * s = &dev_info.stat;
+	dev_info.dev_id = handle->md.ifindex;
+	
+	/* ingnore eintr */
+	do {
+		ret = ioctl(handle->fd, HCIGETDEVINFO, (void *)&dev_info);
+	} while ((ret == -1) && (errno == EINTR));
+	    
+	if (ret < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "can get stats"
+			" via ioctl %d:%s", errno, strerror(errno));
+		return (-1);
+		
+	}
+
+	/* we receive both rx and tx frames, so comulate all stats */	
+	stats->ps_recv = s->evt_rx + s->acl_rx + s->sco_rx + s->cmd_tx + 
+		s->acl_tx +s->sco_tx;
+	stats->ps_drop = s->err_rx + s->err_tx;
+	stats->ps_ifdrop = 0;
+	return 0;
+}
+
+static int 
+bt_setfilter_linux(pcap_t *p, struct bpf_program *fp)
+{
+	return 0;
+}
+
+
+static int 
+bt_setdirection_linux(pcap_t *p, pcap_direction_t d)
+{
+	p->direction = d;
+	return 0;
+}
diff --git a/contrib/libpcap/pcap-bt-linux.h b/contrib/libpcap/pcap-bt-linux.h
new file mode 100644
index 0000000..87d22a6
--- /dev/null
+++ b/contrib/libpcap/pcap-bt-linux.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2006 Paolo Abeni (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote 
+ * products derived from this software without specific prior written 
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * Bluetooth sniffing API implementation for Linux platform
+ * By Paolo Abeni <paolo.abeni@email.it>
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-bt-linux.h,v 1.4.2.1 2008-04-04 19:39:05 guy Exp $ (LBL)
+ */
+
+/*
+ * Prototypes for Bluetooth-related functions
+ */
+int bt_platform_finddevs(pcap_if_t **alldevsp, char *err_str);
+pcap_t *bt_create(const char *device, char *ebuf);
diff --git a/contrib/libpcap/pcap-config.1 b/contrib/libpcap/pcap-config.1
new file mode 100644
index 0000000..a99b379
--- /dev/null
+++ b/contrib/libpcap/pcap-config.1
@@ -0,0 +1,54 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap-config.1,v 1.1.2.2 2008-09-23 18:06:01 guy Exp $ (LBL)
+.\"
+.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP-CONFIG 1 "23 September 2008"
+.SH NAME
+pcap-config \- write libpcap compiler and linker flags to standard output
+.SH SYNOPSIS
+.na
+.B pcap-config
+[
+.B \-\-cflags | \-\-libs
+]
+.ad
+.SH DESCRIPTION
+.LP
+When run with the
+.B \-\-cflags
+option,
+.I pcap-config
+writes to the standard output the
+.B \-I
+compiler flags required to include libpcap's header files.
+When run with the
+.B \-\-libs
+option,
+.I pcap-config
+writes to the standard output the
+.B \-L
+and
+.B \-l
+linker required to link with libpcap, including
+.B \-l
+flags for libraries required by libpcap.
+.SH "SEE ALSO"
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap-config.in b/contrib/libpcap/pcap-config.in
new file mode 100644
index 0000000..19f2114
--- /dev/null
+++ b/contrib/libpcap/pcap-config.in
@@ -0,0 +1,16 @@
+#! /bin/sh
+
+#
+# Script to give the appropriate compiler flags and linker flags
+# to use when building code that uses libpcap.
+#
+case "$1" in
+
+--cflags)
+	echo "-I @includedir@"
+	;;
+
+--libs)
+	echo "-L @libdir@ -lpcap @DEPLIBS@"
+	;;
+esac
diff --git a/contrib/libpcap/pcap-dag.c b/contrib/libpcap/pcap-dag.c
index 3ef2508..039d926 100644
--- a/contrib/libpcap/pcap-dag.c
+++ b/contrib/libpcap/pcap-dag.c
@@ -17,7 +17,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-	"@(#) $Header: /tcpdump/master/libpcap/pcap-dag.c,v 1.21.2.7 2007/06/22 06:43:58 guy Exp $ (LBL)";
+	"@(#) $Header: /tcpdump/master/libpcap/pcap-dag.c,v 1.31.2.8 2008-04-14 20:41:51 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -46,6 +46,8 @@ struct rtentry;		/* declarations in <net/if.h> */
 #include "dagnew.h"
 #include "dagapi.h"
 
+#include "pcap-dag.h"
+
 #define ATM_CELL_SIZE		52
 #define ATM_HDR_SIZE		4
 
@@ -83,10 +85,9 @@ static const unsigned short endian_test_word = 0x0100;
 
 #ifdef DAG_ONLY
 /* This code is required when compiling for a DAG device only. */
-#include "pcap-dag.h"
 
 /* Replace dag function names with pcap equivalent. */
-#define dag_open_live pcap_open_live
+#define dag_create pcap_create
 #define dag_platform_finddevs pcap_platform_finddevs
 #endif /* DAG_ONLY */
 
@@ -124,7 +125,7 @@ delete_pcap_dag(pcap_t *p)
  */
 
 static void
-dag_platform_close(pcap_t *p)
+dag_platform_cleanup(pcap_t *p)
 {
 	
 	if (p != NULL) {
@@ -138,10 +139,14 @@ dag_platform_close(pcap_t *p)
 		if(dag_stop(p->fd) < 0)
 			fprintf(stderr,"dag_stop: %s\n", strerror(errno));
 #endif /* HAVE_DAG_STREAMS_API */
-		if(dag_close(p->fd) < 0)
-			fprintf(stderr,"dag_close: %s\n", strerror(errno));
+		if(p->fd != -1) {
+			if(dag_close(p->fd) < 0)
+				fprintf(stderr,"dag_close: %s\n", strerror(errno));
+			p->fd = -1;
+		}
+		delete_pcap_dag(p);
+		pcap_cleanup_live_common(p);
 	}
-	delete_pcap_dag(p);
 	/* Note: don't need to call close(p->fd) here as dag_close(p->fd) does this. */
 }
 
@@ -150,7 +155,7 @@ atexit_handler(void)
 {
 	while (pcap_dags != NULL) {
 		if (pcap_dags->pid == getpid()) {
-			dag_platform_close(pcap_dags->p);
+			dag_platform_cleanup(pcap_dags->p);
 		} else {
 			delete_pcap_dag(pcap_dags->p);
 		}
@@ -180,6 +185,38 @@ new_pcap_dag(pcap_t *p)
 	return 0;
 }
 
+static unsigned int
+dag_erf_ext_header_count(uint8_t * erf, size_t len)
+{
+	uint32_t hdr_num = 0;
+	uint8_t  hdr_type;
+
+	/* basic sanity checks */
+	if ( erf == NULL )
+		return 0;
+	if ( len < 16 )
+		return 0;
+
+	/* check if we have any extension headers */
+	if ( (erf[8] & 0x80) == 0x00 )
+		return 0;
+
+	/* loop over the extension headers */
+	do {
+	
+		/* sanity check we have enough bytes */
+		if ( len <= (24 + (hdr_num * 8)) )
+			return hdr_num;
+
+		/* get the header type */
+		hdr_type = erf[(16 + (hdr_num * 8))];
+		hdr_num++;
+
+	} while ( hdr_type & 0x80 );
+
+	return hdr_num;
+}
+
 /*
  *  Read at most max_packets from the capture stream and call the callback
  *  for each of them. Returns the number of packets handled, -1 if an
@@ -191,6 +228,7 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 	unsigned int processed = 0;
 	int flags = p->md.dag_offset_flags;
 	unsigned int nonblocking = flags & DAGF_NONBLOCK;
+	unsigned int num_ext_hdr = 0;
 
 	/* Get the next bufferful of packets (if necessary). */
 	while (p->md.dag_mem_top - p->md.dag_mem_bottom < dag_record_size) {
@@ -220,7 +258,9 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		 * If non-block is specified it will return immediately. The user
 		 * is then responsible for efficiency.
 		 */
-		p->md.dag_mem_top = dag_advance_stream(p->fd, p->md.dag_stream, &(p->md.dag_mem_bottom));
+		if ( NULL == (p->md.dag_mem_top = dag_advance_stream(p->fd, p->md.dag_stream, &(p->md.dag_mem_bottom))) ) {
+		     return -1;
+		}
 #else
 		/* dag_offset does not support timeouts */
 		p->md.dag_mem_top = dag_offset(p->fd, &(p->md.dag_mem_bottom), flags);
@@ -244,18 +284,18 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 	
 	/* Process the packets. */
 	while (p->md.dag_mem_top - p->md.dag_mem_bottom >= dag_record_size) {
-
+		
 		unsigned short packet_len = 0;
 		int caplen = 0;
 		struct pcap_pkthdr	pcap_header;
-
+		
 #ifdef HAVE_DAG_STREAMS_API
 		dag_record_t *header = (dag_record_t *)(p->md.dag_mem_bottom);
 #else
 		dag_record_t *header = (dag_record_t *)(p->md.dag_mem_base + p->md.dag_mem_bottom);
 #endif /* HAVE_DAG_STREAMS_API */
 
-		u_char *dp = ((u_char *)header) + dag_record_size;
+		u_char *dp = ((u_char *)header); /* + dag_record_size; */
 		unsigned short rlen;
  
 		/*
@@ -279,146 +319,17 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		}
 		p->md.dag_mem_bottom += rlen;
 
-		switch(header->type) {
-		case TYPE_ATM:
-#ifdef TYPE_AAL5
-		case TYPE_AAL5:
-			if (header->type == TYPE_AAL5) {
-				packet_len = ntohs(header->wlen);
-				caplen = rlen - dag_record_size;
-			}
-#endif
-#ifdef TYPE_MC_ATM
-		case TYPE_MC_ATM:
-			if (header->type == TYPE_MC_ATM) {
-				caplen = packet_len = ATM_CELL_SIZE;
-				dp+=4;
-			}
-#endif
-#ifdef TYPE_MC_AAL5
-		case TYPE_MC_AAL5:
-			if (header->type == TYPE_MC_AAL5) {
-				packet_len = ntohs(header->wlen);
-				caplen = rlen - dag_record_size - 4;
-				dp+=4;
-			}
-#endif
-			if (header->type == TYPE_ATM) {
-				caplen = packet_len = ATM_CELL_SIZE;
-			}
-			if (p->linktype == DLT_SUNATM) {
-				struct sunatm_hdr *sunatm = (struct sunatm_hdr *)dp;
-				unsigned long rawatm;
-					
-				rawatm = ntohl(*((unsigned long *)dp));
-				sunatm->vci = htons((rawatm >>  4) & 0xffff);
-				sunatm->vpi = (rawatm >> 20) & 0x00ff;
-				sunatm->flags = ((header->flags.iface & 1) ? 0x80 : 0x00) | 
-					((sunatm->vpi == 0 && sunatm->vci == htons(5)) ? 6 :
-					 ((sunatm->vpi == 0 && sunatm->vci == htons(16)) ? 5 : 
-					  ((dp[ATM_HDR_SIZE] == 0xaa &&
-					    dp[ATM_HDR_SIZE+1] == 0xaa &&
-					    dp[ATM_HDR_SIZE+2] == 0x03) ? 2 : 1)));
-
-			} else {
-				packet_len -= ATM_HDR_SIZE;
-				caplen -= ATM_HDR_SIZE;
-				dp += ATM_HDR_SIZE;
-			}
-			break;
-
-#ifdef TYPE_DSM_COLOR_ETH
-		case TYPE_DSM_COLOR_ETH:
-#endif
-#ifdef TYPE_COLOR_ETH
-		case TYPE_COLOR_ETH:
-#endif
-		case TYPE_ETH:
-			packet_len = ntohs(header->wlen);
-			packet_len -= (p->md.dag_fcs_bits >> 3);
-			caplen = rlen - dag_record_size - 2;
-			if (caplen > packet_len) {
-				caplen = packet_len;
-			}
-			dp += 2;
-			break;
-#ifdef TYPE_DSM_COLOR_HDLC_POS
-		case TYPE_DSM_COLOR_HDLC_POS:
-#endif
-#ifdef TYPE_COLOR_HDLC_POS
-		case TYPE_COLOR_HDLC_POS:
-#endif
-		case TYPE_HDLC_POS:
-			packet_len = ntohs(header->wlen);
-			packet_len -= (p->md.dag_fcs_bits >> 3);
-			caplen = rlen - dag_record_size;
-			if (caplen > packet_len) {
-				caplen = packet_len;
-			}
-			break;
-#ifdef TYPE_COLOR_MC_HDLC_POS
-		case TYPE_COLOR_MC_HDLC_POS:
-#endif
-#ifdef TYPE_MC_HDLC
-		case TYPE_MC_HDLC:
-			packet_len = ntohs(header->wlen);
-			packet_len -= (p->md.dag_fcs_bits >> 3);
-			caplen = rlen - dag_record_size - 4;
-			if (caplen > packet_len) {
-				caplen = packet_len;
-			}
-			/* jump the MC_HDLC_HEADER */
-			dp += 4;
-			if (p->linktype == DLT_MTP2_WITH_PHDR) {
-				/* Add the MTP2 Pseudo Header */
-				caplen += MTP2_HDR_LEN;
-				packet_len += MTP2_HDR_LEN;
-
-				TempPkt[MTP2_SENT_OFFSET] = 0;
-				TempPkt[MTP2_ANNEX_A_USED_OFFSET] = MTP2_ANNEX_A_USED_UNKNOWN;
-				*(TempPkt+MTP2_LINK_NUMBER_OFFSET) = ((header->rec.mc_hdlc.mc_header>>16)&0x01);
-				*(TempPkt+MTP2_LINK_NUMBER_OFFSET+1) = ((header->rec.mc_hdlc.mc_header>>24)&0xff);
-				memcpy(TempPkt+MTP2_HDR_LEN, dp, caplen);
-				dp = TempPkt;
-			}
-			break;
-#endif
-		default:
-			/* Unhandled ERF type.
-			 * Ignore rather than generating error
-			 */
-			continue;
-		}
- 
-		if (caplen > p->snapshot)
-			caplen = p->snapshot;
-
 		/* Count lost packets. */
-		switch(header->type) {
-#ifdef TYPE_COLOR_HDLC_POS
-			/* in this type the color value overwrites the lctr */
+		switch((header->type & 0x7f)) {
+			/* in these types the color value overwrites the lctr */
 		case TYPE_COLOR_HDLC_POS:
-			break;
-#endif
-#ifdef TYPE_COLOR_ETH
-			/* in this type the color value overwrites the lctr */
 		case TYPE_COLOR_ETH:
-			break;
-#endif
-#ifdef TYPE_DSM_COLOR_HDLC_POS
-			/* in this type the color value overwrites the lctr */
 		case TYPE_DSM_COLOR_HDLC_POS:
-			break;
-#endif
-#ifdef TYPE_DSM_COLOR_ETH
-			/* in this type the color value overwrites the lctr */
 		case TYPE_DSM_COLOR_ETH:
-			break;
-#endif
-#ifdef TYPE_COLOR_MC_HDLC_POS
 		case TYPE_COLOR_MC_HDLC_POS:
+		case TYPE_COLOR_HASH_ETH:
+		case TYPE_COLOR_HASH_POS:
 			break;
-#endif
 
 		default:
 			if (header->lctr) {
@@ -429,10 +340,178 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 				}
 			}
 		}
+		
+		if ((header->type & 0x7f) == TYPE_PAD) {
+			continue;
+		}
+
+		num_ext_hdr = dag_erf_ext_header_count(dp, rlen);
+
+		/* ERF encapsulation */
+		/* The Extensible Record Format is not dropped for this kind of encapsulation, 
+		 * and will be handled as a pseudo header by the decoding application.
+		 * The information carried in the ERF header and in the optional subheader (if present)
+		 * could be merged with the libpcap information, to offer a better decoding.
+		 * The packet length is
+		 * o the length of the packet on the link (header->wlen),
+		 * o plus the length of the ERF header (dag_record_size), as the length of the 
+		 *   pseudo header will be adjusted during the decoding,
+		 * o plus the length of the optional subheader (if present).
+		 *
+		 * The capture length is header.rlen and the byte stuffing for alignment will be dropped
+		 * if the capture length is greater than the packet length.
+		 */
+		if (p->linktype == DLT_ERF) {
+			packet_len = ntohs(header->wlen) + dag_record_size;
+			caplen = rlen;
+			switch ((header->type & 0x7f)) {
+			case TYPE_MC_AAL5:
+			case TYPE_MC_ATM:
+			case TYPE_MC_HDLC:
+				packet_len += 4; /* MC header */
+				break;
+
+			case TYPE_COLOR_HASH_ETH:
+			case TYPE_DSM_COLOR_ETH:
+			case TYPE_COLOR_ETH:
+			case TYPE_ETH:
+				packet_len += 2; /* ETH header */
+				break;
+			} /* switch type */
+
+			/* Include ERF extension headers */
+			packet_len += (8 * num_ext_hdr);
+
+			if (caplen > packet_len) {
+				caplen = packet_len;
+			}
+		} else {
+			/* Other kind of encapsulation according to the header Type */
+
+			/* Skip over generic ERF header */
+			dp += dag_record_size;
+			/* Skip over extension headers */
+			dp += 8 * num_ext_hdr;
+			
+			switch((header->type & 0x7f)) {
+			case TYPE_ATM:
+			case TYPE_AAL5:
+				if (header->type == TYPE_AAL5) {
+					packet_len = ntohs(header->wlen);
+					caplen = rlen - dag_record_size;
+				}
+			case TYPE_MC_ATM:
+				if (header->type == TYPE_MC_ATM) {
+					caplen = packet_len = ATM_CELL_SIZE;
+					dp+=4;
+				}
+			case TYPE_MC_AAL5:
+				if (header->type == TYPE_MC_AAL5) {
+					packet_len = ntohs(header->wlen);
+					caplen = rlen - dag_record_size - 4;
+					dp+=4;
+				}
+				if (header->type == TYPE_ATM) {
+					caplen = packet_len = ATM_CELL_SIZE;
+				}
+				if (p->linktype == DLT_SUNATM) {
+					struct sunatm_hdr *sunatm = (struct sunatm_hdr *)dp;
+					unsigned long rawatm;
+					
+					rawatm = ntohl(*((unsigned long *)dp));
+					sunatm->vci = htons((rawatm >>  4) & 0xffff);
+					sunatm->vpi = (rawatm >> 20) & 0x00ff;
+					sunatm->flags = ((header->flags.iface & 1) ? 0x80 : 0x00) | 
+						((sunatm->vpi == 0 && sunatm->vci == htons(5)) ? 6 :
+						 ((sunatm->vpi == 0 && sunatm->vci == htons(16)) ? 5 : 
+						  ((dp[ATM_HDR_SIZE] == 0xaa &&
+						    dp[ATM_HDR_SIZE+1] == 0xaa &&
+						    dp[ATM_HDR_SIZE+2] == 0x03) ? 2 : 1)));
+
+				} else {
+					packet_len -= ATM_HDR_SIZE;
+					caplen -= ATM_HDR_SIZE;
+					dp += ATM_HDR_SIZE;
+				}
+				break;
+
+			case TYPE_COLOR_HASH_ETH:
+			case TYPE_DSM_COLOR_ETH:
+			case TYPE_COLOR_ETH:
+			case TYPE_ETH:
+				packet_len = ntohs(header->wlen);
+				packet_len -= (p->md.dag_fcs_bits >> 3);
+				caplen = rlen - dag_record_size - 2;
+				if (caplen > packet_len) {
+					caplen = packet_len;
+				}
+				dp += 2;
+				break;
+
+			case TYPE_COLOR_HASH_POS:
+			case TYPE_DSM_COLOR_HDLC_POS:
+			case TYPE_COLOR_HDLC_POS:
+			case TYPE_HDLC_POS:
+				packet_len = ntohs(header->wlen);
+				packet_len -= (p->md.dag_fcs_bits >> 3);
+				caplen = rlen - dag_record_size;
+				if (caplen > packet_len) {
+					caplen = packet_len;
+				}
+				break;
+
+			case TYPE_COLOR_MC_HDLC_POS:
+			case TYPE_MC_HDLC:
+				packet_len = ntohs(header->wlen);
+				packet_len -= (p->md.dag_fcs_bits >> 3);
+				caplen = rlen - dag_record_size - 4;
+				if (caplen > packet_len) {
+					caplen = packet_len;
+				}
+				/* jump the MC_HDLC_HEADER */
+				dp += 4;
+#ifdef DLT_MTP2_WITH_PHDR
+				if (p->linktype == DLT_MTP2_WITH_PHDR) {
+					/* Add the MTP2 Pseudo Header */
+					caplen += MTP2_HDR_LEN;
+					packet_len += MTP2_HDR_LEN;
+					
+					TempPkt[MTP2_SENT_OFFSET] = 0;
+					TempPkt[MTP2_ANNEX_A_USED_OFFSET] = MTP2_ANNEX_A_USED_UNKNOWN;
+					*(TempPkt+MTP2_LINK_NUMBER_OFFSET) = ((header->rec.mc_hdlc.mc_header>>16)&0x01);
+					*(TempPkt+MTP2_LINK_NUMBER_OFFSET+1) = ((header->rec.mc_hdlc.mc_header>>24)&0xff);
+					memcpy(TempPkt+MTP2_HDR_LEN, dp, caplen);
+					dp = TempPkt;
+				}
+#endif
+				break;
+
+			case TYPE_IPV4:
+				packet_len = ntohs(header->wlen);
+				caplen = rlen - dag_record_size;
+				if (caplen > packet_len) {
+					caplen = packet_len;
+				}
+				break;
+
+			default:
+				/* Unhandled ERF type.
+				 * Ignore rather than generating error
+				 */
+				continue;
+			} /* switch type */
+
+			/* Skip over extension headers */
+			caplen -= (8 * num_ext_hdr);
+
+		} /* ERF encapsulation */
+		
+		if (caplen > p->snapshot)
+			caplen = p->snapshot;
 
 		/* Run the packet filter if there is one. */
 		if ((p->fcode.bf_insns == NULL) || bpf_filter(p->fcode.bf_insns, dp, packet_len, caplen)) {
-
+			
 			/* convert between timestamp formats */
 			register unsigned long long ts;
 				
@@ -463,7 +542,7 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 	
 			/* Only count packets that pass the filter, for consistency with standard Linux behaviour. */
 			processed++;
-			if (processed == cnt)
+			if (processed == cnt && cnt > 0)
 			{
 				/* Reached the user-specified limit. */
 				return cnt;
@@ -485,23 +564,24 @@ dag_inject(pcap_t *p, const void *buf _U_, size_t size _U_)
 /*
  *  Get a handle for a live capture from the given DAG device.  Passing a NULL
  *  device will result in a failure.  The promisc flag is ignored because DAG
- *  cards are always promiscuous.  The to_ms parameter is also ignored as it is
- *  not supported in hardware.
+ *  cards are always promiscuous.  The to_ms parameter is used in setting the
+ *  API polling parameters.
  *  
  *  snaplen is now also ignored, until we get per-stream slen support. Set
- *  slen with approprite DAG tool BEFORE pcap_open_live().
+ *  slen with approprite DAG tool BEFORE pcap_activate().
  *
  *  See also pcap(3).
  */
-pcap_t *
-dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebuf)
+static int dag_activate(pcap_t* handle)
 {
+#if 0
 	char conf[30]; /* dag configure string */
-	pcap_t *handle;
+#endif
 	char *s;
 	int n;
 	daginf_t* daginf;
 	char * newDev = NULL;
+	char * device = handle->opt.source;
 #ifdef HAVE_DAG_STREAMS_API
 	uint32_t mindata;
 	struct timeval maxwait;
@@ -509,44 +589,35 @@ dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebu
 #endif
 
 	if (device == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "device is NULL: %s", pcap_strerror(errno));
-		return NULL;
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "device is NULL: %s", pcap_strerror(errno));
+		return -1;
 	}
-	/* Allocate a handle for this session. */
 
-	handle = malloc(sizeof(*handle));
-	if (handle == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc %s: %s", device, pcap_strerror(errno));
-		return NULL;
-	}
-	
 	/* Initialize some components of the pcap structure. */
-	
-	memset(handle, 0, sizeof(*handle));
 
 #ifdef HAVE_DAG_STREAMS_API
 	newDev = (char *)malloc(strlen(device) + 16);
 	if (newDev == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "Can't allocate string for device name: %s\n", pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't allocate string for device name: %s\n", pcap_strerror(errno));
 		goto fail;
 	}
 	
 	/* Parse input name to get dag device and stream number if provided */
 	if (dag_parse_name(device, newDev, strlen(device) + 16, &handle->md.dag_stream) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_parse_name: %s\n", pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_parse_name: %s\n", pcap_strerror(errno));
 		goto fail;
 	}
 	device = newDev;
 
 	if (handle->md.dag_stream%2) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_parse_name: tx (even numbered) streams not supported for capture\n");
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_parse_name: tx (even numbered) streams not supported for capture\n");
 		goto fail;
 	}
 #else
 	if (strncmp(device, "/dev/", 5) != 0) {
 		newDev = (char *)malloc(strlen(device) + 5);
 		if (newDev == NULL) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "Can't allocate string for device name: %s\n", pcap_strerror(errno));
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't allocate string for device name: %s\n", pcap_strerror(errno));
 			goto fail;
 		}
 		strcpy(newDev, "/dev/");
@@ -557,14 +628,14 @@ dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebu
 
 	/* setup device parameters */
 	if((handle->fd = dag_open((char *)device)) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_open %s: %s", device, pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_open %s: %s", device, pcap_strerror(errno));
 		goto fail;
 	}
 
 #ifdef HAVE_DAG_STREAMS_API
 	/* Open requested stream. Can fail if already locked or on error */
 	if (dag_attach_stream(handle->fd, handle->md.dag_stream, 0, 0) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_attach_stream: %s\n", pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_attach_stream: %s\n", pcap_strerror(errno));
 		goto failclose;
 	}
 
@@ -573,7 +644,7 @@ dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebu
 	 */
 	if (dag_get_stream_poll(handle->fd, handle->md.dag_stream,
 				&mindata, &maxwait, &poll) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_get_stream_poll: %s\n", pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_get_stream_poll: %s\n", pcap_strerror(errno));
 		goto faildetach;
 	}
 	
@@ -583,21 +654,21 @@ dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebu
 	 */
 	mindata = 65536;
 
-	/* Obey to_ms if supplied. This is a good idea!
+	/* Obey md.timeout (was to_ms) if supplied. This is a good idea!
 	 * Recommend 10-100ms. Calls will time out even if no data arrived.
 	 */
-	maxwait.tv_sec = to_ms/1000;
-	maxwait.tv_usec = (to_ms%1000) * 1000;
+	maxwait.tv_sec = handle->md.timeout/1000;
+	maxwait.tv_usec = (handle->md.timeout%1000) * 1000;
 
 	if (dag_set_stream_poll(handle->fd, handle->md.dag_stream,
 				mindata, &maxwait, &poll) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_set_stream_poll: %s\n", pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_set_stream_poll: %s\n", pcap_strerror(errno));
 		goto faildetach;
 	}
 		
 #else
 	if((handle->md.dag_mem_base = dag_mmap(handle->fd)) == MAP_FAILED) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,"dag_mmap %s: %s\n", device, pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,"dag_mmap %s: %s\n", device, pcap_strerror(errno));
 		goto failclose;
 	}
 
@@ -611,28 +682,28 @@ dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebu
 	/* set the card snap length to the specified snaplen parameter */
 	/* This is a really bad idea, as different cards have different
 	 * valid slen ranges. Should fix in Config API. */
-	if (snaplen == 0 || snaplen > MAX_DAG_SNAPLEN) {
-		snaplen = MAX_DAG_SNAPLEN;
+	if (handle->snapshot == 0 || handle->snapshot > MAX_DAG_SNAPLEN) {
+		handle->snapshot = MAX_DAG_SNAPLEN;
 	} else if (snaplen < MIN_DAG_SNAPLEN) {
-		snaplen = MIN_DAG_SNAPLEN;
+		handle->snapshot = MIN_DAG_SNAPLEN;
 	}
 	/* snap len has to be a multiple of 4 */
 	snprintf(conf, 30, "varlen slen=%d", (snaplen + 3) & ~3); 
 
 	if(dag_configure(handle->fd, conf) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,"dag_configure %s: %s\n", device, pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,"dag_configure %s: %s\n", device, pcap_strerror(errno));
 		goto faildetach;
 	}
 #endif	
 	
 #ifdef HAVE_DAG_STREAMS_API
 	if(dag_start_stream(handle->fd, handle->md.dag_stream) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_start_stream %s: %s\n", device, pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_start_stream %s: %s\n", device, pcap_strerror(errno));
 		goto faildetach;
 	}
 #else
 	if(dag_start(handle->fd) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_start %s: %s\n", device, pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "dag_start %s: %s\n", device, pcap_strerror(errno));
 		goto failclose;
 	}
 #endif /* HAVE_DAG_STREAMS_API */
@@ -644,40 +715,58 @@ dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebu
 	 */
 	handle->md.dag_mem_bottom = 0;
 	handle->md.dag_mem_top = 0;
-	handle->md.dag_fcs_bits = 32;
 
-	/* Query the card first for special cases. */
+	/*
+	 * Find out how many FCS bits we should strip.
+	 * First, query the card to see if it strips the FCS.
+	 */
 	daginf = dag_info(handle->fd);
-	if ((0x4200 == daginf->device_code) || (0x4230 == daginf->device_code))
-	{
+	if ((0x4200 == daginf->device_code) || (0x4230 == daginf->device_code))	{
 		/* DAG 4.2S and 4.23S already strip the FCS.  Stripping the final word again truncates the packet. */
 		handle->md.dag_fcs_bits = 0;
-	}
 
-	/* Then allow an environment variable to override. */
-	if ((s = getenv("ERF_FCS_BITS")) != NULL) {
-		if ((n = atoi(s)) == 0 || n == 16|| n == 32) {
-			handle->md.dag_fcs_bits = n;
-		} else {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE,
-				"pcap_open_live %s: bad ERF_FCS_BITS value (%d) in environment\n", device, n);
-			goto failstop;
+		/* Note that no FCS will be supplied. */
+		handle->linktype_ext = LT_FCS_DATALINK_EXT(0);
+	} else {
+		/*
+		 * Start out assuming it's 32 bits.
+		 */
+		handle->md.dag_fcs_bits = 32;
+
+		/* Allow an environment variable to override. */
+		if ((s = getenv("ERF_FCS_BITS")) != NULL) {
+			if ((n = atoi(s)) == 0 || n == 16 || n == 32) {
+				handle->md.dag_fcs_bits = n;
+			} else {
+				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+					"pcap_activate %s: bad ERF_FCS_BITS value (%d) in environment\n", device, n);
+				goto failstop;
+			}
+		}
+
+		/*
+		 * Did the user request that they not be stripped?
+		 */
+		if ((s = getenv("ERF_DONT_STRIP_FCS")) != NULL) {
+			/* Yes.  Note the number of bytes that will be
+			   supplied. */
+			handle->linktype_ext = LT_FCS_DATALINK_EXT(handle->md.dag_fcs_bits/16);
+
+			/* And don't strip them. */
+			handle->md.dag_fcs_bits = 0;
 		}
 	}
 
-	handle->snapshot	= snaplen;
-	handle->md.dag_timeout	= to_ms;
+	handle->md.dag_timeout	= handle->md.timeout;
 
 	handle->linktype = -1;
-	if (dag_get_datalink(handle) < 0) {
-		strcpy(ebuf, handle->errbuf);
+	if (dag_get_datalink(handle) < 0)
 		goto failstop;
-	}
 	
 	handle->bufsize = 0;
 
 	if (new_pcap_dag(handle) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "new_pcap_dag %s: %s\n", device, pcap_strerror(errno));
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "new_pcap_dag %s: %s\n", device, pcap_strerror(errno));
 		goto failstop;
 	}
 
@@ -698,54 +787,50 @@ dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebu
 	handle->getnonblock_op = pcap_getnonblock_fd;
 	handle->setnonblock_op = dag_setnonblock;
 	handle->stats_op = dag_stats;
-	handle->close_op = dag_platform_close;
+	handle->cleanup_op = dag_platform_cleanup;
 	handle->md.stat.ps_drop = 0;
 	handle->md.stat.ps_recv = 0;
-	return handle;
+	return 0;
 
 #ifdef HAVE_DAG_STREAMS_API 
 failstop:
-	if (handle != NULL) {
-		if (dag_stop_stream(handle->fd, handle->md.dag_stream) < 0)
-			fprintf(stderr,"dag_stop_stream: %s\n", strerror(errno));
+	if (dag_stop_stream(handle->fd, handle->md.dag_stream) < 0) {
+		fprintf(stderr,"dag_stop_stream: %s\n", strerror(errno));
 	}
 	
 faildetach:
-	if (handle != NULL) {
-		if (dag_detach_stream(handle->fd, handle->md.dag_stream) < 0)
-			fprintf(stderr,"dag_detach_stream: %s\n", strerror(errno));
-	}
-#else	
+	if (dag_detach_stream(handle->fd, handle->md.dag_stream) < 0)
+		fprintf(stderr,"dag_detach_stream: %s\n", strerror(errno));
+#else
 failstop:
-	if (handle != NULL) {
-		if (dag_stop(p->fd) < 0)
-			fprintf(stderr,"dag_stop: %s\n", strerror(errno));
-	}
+	if (dag_stop(handle->fd) < 0)
+		fprintf(stderr,"dag_stop: %s\n", strerror(errno));
 #endif /* HAVE_DAG_STREAMS_API */
 	
 failclose:
-	if (handle != NULL) {
-		if (dag_close(handle->fd) < 0)
-			fprintf(stderr,"dag_close: %s\n", strerror(errno));
-	}
-	if (handle != NULL)
-		delete_pcap_dag(handle);
-	
+	if (dag_close(handle->fd) < 0)
+		fprintf(stderr,"dag_close: %s\n", strerror(errno));
+	delete_pcap_dag(handle);
+
 fail:
+	pcap_cleanup_live_common(handle);
 	if (newDev != NULL) {
 		free((char *)newDev);
 	}
-	if (handle != NULL) {
-		/*
-		 * Get rid of any link-layer type list we allocated.
-		 */
-		if (handle->dlt_list != NULL) {
-			free(handle->dlt_list);
-		}
-		free(handle);
-	}
 
-	return NULL;
+	return PCAP_ERROR;
+}
+
+pcap_t *dag_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return NULL;
+
+	p->activate_op = dag_activate;
+	return p;
 }
 
 static int
@@ -762,10 +847,13 @@ dag_stats(pcap_t *p, struct pcap_stat *ps) {
 }
 
 /*
- * Simply submit all possible dag names as candidates.
- * pcap_add_if() internally tests each candidate with pcap_open_live(),
- * so any non-existent devices are dropped.
- * For 2.5 try all rx stream names as well.
+ * Previously we just generated a list of all possible names and let
+ * pcap_add_if() attempt to open each one, but with streams this adds up
+ * to 81 possibilities which is inefficient.
+ *
+ * Since we know more about the devices we can prune the tree here.
+ * pcap_add_if() will still retest each device but the total number of
+ * open attempts will still be much less than the naive approach.
  */
 int
 dag_platform_finddevs(pcap_if_t **devlistp, char *errbuf)
@@ -773,30 +861,46 @@ dag_platform_finddevs(pcap_if_t **devlistp, char *errbuf)
 	char name[12];	/* XXX - pick a size */
 	int ret = 0;
 	int c;
+	char dagname[DAGNAME_BUFSIZE];
+	int dagstream;
+	int dagfd;
 
 	/* Try all the DAGs 0-9 */
 	for (c = 0; c < 9; c++) {
 		snprintf(name, 12, "dag%d", c);
-		if (pcap_add_if(devlistp, name, 0, NULL, errbuf) == -1) {
-			/*
-			 * Failure.
-			 */
-			ret = -1;
-		}
-#ifdef HAVE_DAG_STREAMS_API
+		if (-1 == dag_parse_name(name, dagname, DAGNAME_BUFSIZE, &dagstream))
 		{
-			int stream;
-			for(stream=0;stream<16;stream+=2) {
-				snprintf(name,  10, "dag%d:%d", c, stream);
-				if (pcap_add_if(devlistp, name, 0, NULL, errbuf) == -1) {
-					/*
-					 * Failure.
-					 */
-					ret = -1;
-				}
-			}				
+			return -1;
 		}
+		if ( (dagfd = dag_open(dagname)) >= 0 ) {
+			if (pcap_add_if(devlistp, name, 0, NULL, errbuf) == -1) {
+				/*
+				 * Failure.
+				 */
+				ret = -1;
+			}
+#ifdef HAVE_DAG_STREAMS_API
+			{
+				int stream, rxstreams;
+				rxstreams = dag_rx_get_stream_count(dagfd);
+				for(stream=0;stream<16;stream+=2) {
+					if (0 == dag_attach_stream(dagfd, stream, 0, 0)) {
+						dag_detach_stream(dagfd, stream);
+
+						snprintf(name,  10, "dag%d:%d", c, stream);
+						if (pcap_add_if(devlistp, name, 0, NULL, errbuf) == -1) {
+							/*
+							 * Failure.
+							 */
+							ret = -1;
+						}
+					}
+				}				
+			}
 #endif  /* HAVE_DAG_STREAMS_API */
+			dag_close(dagfd);
+		}
+
 	}
 	return (ret);
 }
@@ -885,7 +989,7 @@ dag_setnonblock(pcap_t *p, int nonblock, char *errbuf)
 static int
 dag_get_datalink(pcap_t *p)
 {
-	int index=0;
+	int index=0, dlt_index=0;
 	uint8_t types[255];
 
 	memset(types, 0, 255);
@@ -897,7 +1001,16 @@ dag_get_datalink(pcap_t *p)
 
 	p->linktype = 0;
 
-#ifdef HAVE_DAG_GET_ERF_TYPES
+#ifdef HAVE_DAG_GET_STREAM_ERF_TYPES
+	/* Get list of possible ERF types for this card */
+	if (dag_get_stream_erf_types(p->fd, p->md.dag_stream, types, 255) < 0) {
+		snprintf(p->errbuf, sizeof(p->errbuf), "dag_get_stream_erf_types: %s", pcap_strerror(errno));
+		return (-1);		
+	}
+	
+	while (types[index]) {
+
+#elif defined HAVE_DAG_GET_ERF_TYPES
 	/* Get list of possible ERF types for this card */
 	if (dag_get_erf_types(p->fd, types, 255) < 0) {
 		snprintf(p->errbuf, sizeof(p->errbuf), "dag_get_erf_types: %s", pcap_strerror(errno));
@@ -911,31 +1024,26 @@ dag_get_datalink(pcap_t *p)
 
 	{
 #endif
-		switch(types[index]) {
+		switch((types[index] & 0x7f)) {
 
 		case TYPE_HDLC_POS:
-#ifdef TYPE_COLOR_HDLC_POS
 		case TYPE_COLOR_HDLC_POS:
-#endif
-#ifdef TYPE_DSM_COLOR_HDLC_POS
 		case TYPE_DSM_COLOR_HDLC_POS:
-#endif
+		case TYPE_COLOR_HASH_POS:
+
 			if (p->dlt_list != NULL) {
-				p->dlt_list[index++] = DLT_CHDLC;
-				p->dlt_list[index++] = DLT_PPP_SERIAL;
-				p->dlt_list[index++] = DLT_FRELAY;
+				p->dlt_list[dlt_index++] = DLT_CHDLC;
+				p->dlt_list[dlt_index++] = DLT_PPP_SERIAL;
+				p->dlt_list[dlt_index++] = DLT_FRELAY;
 			}
 			if(!p->linktype)
 				p->linktype = DLT_CHDLC;
 			break;
 
 		case TYPE_ETH:
-#ifdef TYPE_COLOR_ETH
 		case TYPE_COLOR_ETH:
-#endif
-#ifdef TYPE_DSM_COLOR_ETH
 		case TYPE_DSM_COLOR_ETH:
-#endif
+		case TYPE_COLOR_HASH_ETH:
 			/*
 			 * This is (presumably) a real Ethernet capture; give it a
 			 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
@@ -947,61 +1055,66 @@ dag_get_datalink(pcap_t *p)
 			 * Ethernet framing).
 			 */
 			if (p->dlt_list != NULL) {
-				p->dlt_list[index++] = DLT_EN10MB;
-				p->dlt_list[index++] = DLT_DOCSIS;
+				p->dlt_list[dlt_index++] = DLT_EN10MB;
+				p->dlt_list[dlt_index++] = DLT_DOCSIS;
 			}
 			if(!p->linktype)
 				p->linktype = DLT_EN10MB;
 			break;
 
 		case TYPE_ATM: 
-#ifdef TYPE_AAL5
 		case TYPE_AAL5:
-#endif
-#ifdef TYPE_MC_ATM
 		case TYPE_MC_ATM:
-#endif
-#ifdef TYPE_MC_AAL5
 		case TYPE_MC_AAL5:
-#endif
 			if (p->dlt_list != NULL) {
-				p->dlt_list[index++] = DLT_ATM_RFC1483;
-				p->dlt_list[index++] = DLT_SUNATM;
+				p->dlt_list[dlt_index++] = DLT_ATM_RFC1483;
+				p->dlt_list[dlt_index++] = DLT_SUNATM;
 			}
 			if(!p->linktype)
 				p->linktype = DLT_ATM_RFC1483;
 			break;
 
-#ifdef TYPE_COLOR_MC_HDLC_POS
 		case TYPE_COLOR_MC_HDLC_POS:
-#endif
-#ifdef TYPE_MC_HDLC
 		case TYPE_MC_HDLC:
 			if (p->dlt_list != NULL) {
-				p->dlt_list[index++] = DLT_CHDLC;
-				p->dlt_list[index++] = DLT_PPP_SERIAL;
-				p->dlt_list[index++] = DLT_FRELAY;
-				p->dlt_list[index++] = DLT_MTP2;
-				p->dlt_list[index++] = DLT_MTP2_WITH_PHDR;
+				p->dlt_list[dlt_index++] = DLT_CHDLC;
+				p->dlt_list[dlt_index++] = DLT_PPP_SERIAL;
+				p->dlt_list[dlt_index++] = DLT_FRELAY;
+				p->dlt_list[dlt_index++] = DLT_MTP2;
+				p->dlt_list[dlt_index++] = DLT_MTP2_WITH_PHDR;
+				p->dlt_list[dlt_index++] = DLT_LAPD;
 			}
 			if(!p->linktype)
 				p->linktype = DLT_CHDLC;
 			break;
-#endif
 
-		case TYPE_LEGACY:
+		case TYPE_IPV4:
 			if(!p->linktype)
-				p->linktype = DLT_NULL;
+				p->linktype = DLT_RAW;
 			break;
 
+		case TYPE_LEGACY:
+		case TYPE_MC_RAW:
+		case TYPE_MC_RAW_CHANNEL:
+		case TYPE_IP_COUNTER:
+		case TYPE_TCP_FLOW_COUNTER:
+		case TYPE_INFINIBAND:
+		case TYPE_IPV6:
 		default:
-			snprintf(p->errbuf, sizeof(p->errbuf), "unknown DAG linktype %d", types[index]);
-			return (-1);
+			/* Libpcap cannot deal with these types yet */
+			/* Add no DLTs, but still covered by DLT_ERF */
+			break;
 
 		} /* switch */
+		index++;
 	}
 
-	p->dlt_count = index;
+	p->dlt_list[dlt_index++] = DLT_ERF;
+
+	p->dlt_count = dlt_index;
+
+	if(!p->linktype)
+		p->linktype = DLT_ERF;
 
 	return p->linktype;
 }
diff --git a/contrib/libpcap/pcap-dag.h b/contrib/libpcap/pcap-dag.h
index eff01d6..7ba272b 100644
--- a/contrib/libpcap/pcap-dag.h
+++ b/contrib/libpcap/pcap-dag.h
@@ -7,8 +7,94 @@
  *
  * Author: Richard Littin, Sean Irvine ({richard,sean}@reeltwo.com)
  *
- * @(#) $Header: /tcpdump/master/libpcap/pcap-dag.h,v 1.3.4.1 2005/07/07 06:56:04 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-dag.h,v 1.4.2.3 2008-04-04 19:39:06 guy Exp $ (LBL)
  */
 
-pcap_t *dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebuf);
+pcap_t *dag_create(const char *, char *);
 int dag_platform_finddevs(pcap_if_t **devlistp, char *errbuf);
+
+#ifndef TYPE_AAL5
+#define TYPE_AAL5               4
+#endif
+
+#ifndef TYPE_MC_HDLC
+#define TYPE_MC_HDLC            5
+#endif
+
+#ifndef TYPE_MC_RAW
+#define TYPE_MC_RAW             6
+#endif
+
+#ifndef TYPE_MC_ATM
+#define TYPE_MC_ATM             7
+#endif
+
+#ifndef TYPE_MC_RAW_CHANNEL
+#define TYPE_MC_RAW_CHANNEL     8
+#endif
+
+#ifndef TYPE_MC_AAL5
+#define TYPE_MC_AAL5            9
+#endif
+
+#ifndef TYPE_COLOR_HDLC_POS
+#define TYPE_COLOR_HDLC_POS     10
+#endif
+
+#ifndef TYPE_COLOR_ETH
+#define TYPE_COLOR_ETH          11
+#endif
+
+#ifndef TYPE_MC_AAL2
+#define TYPE_MC_AAL2            12
+#endif
+
+#ifndef TYPE_IP_COUNTER
+#define TYPE_IP_COUNTER         13
+#endif
+
+#ifndef TYPE_TCP_FLOW_COUNTER
+#define TYPE_TCP_FLOW_COUNTER   14
+#endif
+
+#ifndef TYPE_DSM_COLOR_HDLC_POS
+#define TYPE_DSM_COLOR_HDLC_POS 15
+#endif
+
+#ifndef TYPE_DSM_COLOR_ETH
+#define TYPE_DSM_COLOR_ETH      16
+#endif
+
+#ifndef TYPE_COLOR_MC_HDLC_POS
+#define TYPE_COLOR_MC_HDLC_POS  17
+#endif
+
+#ifndef TYPE_AAL2
+#define TYPE_AAL2               18
+#endif
+
+#ifndef TYPE_COLOR_HASH_POS
+#define TYPE_COLOR_HASH_POS     19
+#endif
+
+#ifndef TYPE_COLOR_HASH_ETH
+#define TYPE_COLOR_HASH_ETH     20
+#endif
+
+#ifndef TYPE_INFINIBAND
+#define TYPE_INFINIBAND         21
+#endif
+
+#ifndef TYPE_IPV4
+#define TYPE_IPV4               22
+#endif
+
+#ifndef TYPE_IPV6
+#define TYPE_IPV6               23
+#endif
+
+
+
+#ifndef TYPE_PAD
+#define TYPE_PAD                48
+#endif
diff --git a/contrib/libpcap/pcap-dlpi.c b/contrib/libpcap/pcap-dlpi.c
index 8ea7850..695e48a 100644
--- a/contrib/libpcap/pcap-dlpi.c
+++ b/contrib/libpcap/pcap-dlpi.c
@@ -22,7 +22,7 @@
  * University College London, and subsequently modified by
  * Guy Harris (guy@alum.mit.edu), Mark Pizzolato
  * <List-tcpdump-workers@subscriptions.pizzolato.net>,
- * and Mark C. Brown (mbrown@hp.com).
+ * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
  */
 
 /*
@@ -70,7 +70,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.108.2.7 2006/04/04 05:33:02 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.116.2.11 2008-04-14 20:41:51 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -121,6 +121,7 @@ static const char rcsid[] _U_ =
 #endif
 
 #include "pcap-int.h"
+#include "dlpisubs.h"
 
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
@@ -136,33 +137,6 @@ static const char rcsid[] _U_ =
 
 #define	MAXDLBUF	8192
 
-#ifdef HAVE_SYS_BUFMOD_H
-
-/*
- * Size of a bufmod chunk to pass upstream; that appears to be the biggest
- * value to which you can set it, and setting it to that value (which
- * is bigger than what appears to be the Solaris default of 8192)
- * reduces the number of packet drops.
- */
-#define CHUNKSIZE	65536
-
-/*
- * Size of the buffer to allocate for packet data we read; it must be
- * large enough to hold a chunk.
- */
-#define PKTBUFSIZE	CHUNKSIZE
-
-#else /* HAVE_SYS_BUFMOD_H */
-
-/*
- * Size of the buffer to allocate for packet data we read; this is
- * what the value used to be - there's no particular reason why it
- * should be tied to MAXDLBUF, but we'll leave it as this for now.
- */
-#define PKTBUFSIZE	(MAXDLBUF * sizeof(bpf_u_int32))
-
-#endif
-
 /* Forwards */
 static char *split_dname(char *, int *, char *);
 static int dl_doattach(int, int, char *);
@@ -176,6 +150,11 @@ static int dlpromisconreq(int, bpf_u_int32, char *);
 static int dlokack(int, const char *, char *, char *);
 static int dlinforeq(int, char *);
 static int dlinfoack(int, char *, char *);
+
+#ifdef HAVE_DLPI_PASSIVE
+static void dlpassive(int, char *);
+#endif
+
 #ifdef DL_HP_RAWDLS
 static int dlrawdatareq(int, const u_char *, int);
 #endif
@@ -186,9 +165,6 @@ static char *dlprim(bpf_u_int32);
 static char *get_release(bpf_u_int32 *, bpf_u_int32 *, bpf_u_int32 *);
 #endif
 static int send_request(int, char *, int, char *, char *);
-#ifdef HAVE_SYS_BUFMOD_H
-static int strioctl(int, int, int, char *);
-#endif
 #ifdef HAVE_HPUX9
 static int dlpi_kread(int, off_t, void *, u_int, char *);
 #endif
@@ -196,42 +172,6 @@ static int dlpi_kread(int, off_t, void *, u_int, char *);
 static int get_dlpi_ppa(int, const char *, int, char *);
 #endif
 
-static int
-pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps)
-{
-
-	/*
-	 * "ps_recv" counts packets handed to the filter, not packets
-	 * that passed the filter.  As filtering is done in userland,
-	 * this would not include packets dropped because we ran out
-	 * of buffer space; in order to make this more like other
-	 * platforms (Linux 2.4 and later, BSDs with BPF), where the
-	 * "packets received" count includes packets received but dropped
-	 * due to running out of buffer space, and to keep from confusing
-	 * applications that, for example, compute packet drop percentages,
-	 * we also make it count packets dropped by "bufmod" (otherwise we
-	 * might run the risk of the packet drop count being bigger than
-	 * the received-packet count).
-	 *
-	 * "ps_drop" counts packets dropped by "bufmod" because of
-	 * flow control requirements or resource exhaustion; it doesn't
-	 * count packets dropped by the interface driver, or packets
-	 * dropped upstream.  As filtering is done in userland, it counts
-	 * packets regardless of whether they would've passed the filter.
-	 *
-	 * These statistics don't include packets not yet read from
-	 * the kernel by libpcap, but they may include packets not
-	 * yet read from libpcap by the application.
-	 */
-	*ps = p->md.stat;
-
-	/*
-	 * Add in the drop count, as per the above comment.
-	 */
-	ps->ps_recv += ps->ps_drop;
-	return (0);
-}
-
 /* XXX Needed by HP-UX (at least) */
 static bpf_u_int32 ctlbuf[MAXDLBUF];
 static struct strbuf ctl = {
@@ -243,18 +183,10 @@ static struct strbuf ctl = {
 static int
 pcap_read_dlpi(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 {
-	register int cc, n, caplen, origlen;
-	register u_char *bp, *ep, *pk;
-	register struct bpf_insn *fcode;
-#ifdef HAVE_SYS_BUFMOD_H
-	register struct sb_hdr *sbp;
-#ifdef LBL_ALIGN
-	struct sb_hdr sbhdr;
-#endif
-#endif
+	int cc;
+	u_char *bp;
 	int flags;
 	struct strbuf data;
-	struct pcap_pkthdr pkthdr;
 
 	flags = 0;
 	cc = p->cc;
@@ -302,74 +234,7 @@ pcap_read_dlpi(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 	} else
 		bp = p->bp;
 
-	/* Loop through packets */
-	fcode = p->fcode.bf_insns;
-	ep = bp + cc;
-	n = 0;
-#ifdef HAVE_SYS_BUFMOD_H
-	while (bp < ep) {
-		/*
-		 * Has "pcap_breakloop()" been called?
-		 * If so, return immediately - if we haven't read any
-		 * packets, clear the flag and return -2 to indicate
-		 * that we were told to break out of the loop, otherwise
-		 * leave the flag set, so that the *next* call will break
-		 * out of the loop without having read any packets, and
-		 * return the number of packets we've processed so far.
-		 */
-		if (p->break_loop) {
-			if (n == 0) {
-				p->break_loop = 0;
-				return (-2);
-			} else {
-				p->bp = bp;
-				p->cc = ep - bp;
-				return (n);
-			}
-		}
-#ifdef LBL_ALIGN
-		if ((long)bp & 3) {
-			sbp = &sbhdr;
-			memcpy(sbp, bp, sizeof(*sbp));
-		} else
-#endif
-			sbp = (struct sb_hdr *)bp;
-		p->md.stat.ps_drop = sbp->sbh_drops;
-		pk = bp + sizeof(*sbp);
-		bp += sbp->sbh_totlen;
-		origlen = sbp->sbh_origlen;
-		caplen = sbp->sbh_msglen;
-#else
-		origlen = cc;
-		caplen = min(p->snapshot, cc);
-		pk = bp;
-		bp += caplen;
-#endif
-		++p->md.stat.ps_recv;
-		if (bpf_filter(fcode, pk, origlen, caplen)) {
-#ifdef HAVE_SYS_BUFMOD_H
-			pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
-			pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
-#else
-			(void)gettimeofday(&pkthdr.ts, NULL);
-#endif
-			pkthdr.len = origlen;
-			pkthdr.caplen = caplen;
-			/* Insure caplen does not exceed snapshot */
-			if (pkthdr.caplen > p->snapshot)
-				pkthdr.caplen = p->snapshot;
-			(*callback)(user, &pkthdr, pk);
-			if (++n >= cnt && cnt >= 0) {
-				p->cc = ep - bp;
-				p->bp = bp;
-				return (n);
-			}
-		}
-#ifdef HAVE_SYS_BUFMOD_H
-	}
-#endif
-	p->cc = 0;
-	return (n);
+	return (pcap_process_pkts(p, callback, user, cnt, bp, cc));
 }
 
 static int
@@ -449,26 +314,26 @@ pcap_inject_dlpi(pcap_t *p, const void *buf, size_t size)
 #endif /* HAVE_SOLARIS */
 
 static void
-pcap_close_dlpi(pcap_t *p)
+pcap_cleanup_dlpi(pcap_t *p)
 {
-	pcap_close_common(p);
-	if (p->send_fd >= 0)
+	if (p->send_fd >= 0) {
 		close(p->send_fd);
+		p->send_fd = -1;
+	}
+	pcap_cleanup_live_common(p);
 }
 
-pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+static int
+pcap_activate_dlpi(pcap_t *p)
 {
 	register char *cp;
-	register pcap_t *p;
 	int ppa;
 #ifdef HAVE_SOLARIS
 	int isatm = 0;
 #endif
 	register dl_info_ack_t *infop;
 #ifdef HAVE_SYS_BUFMOD_H
-	bpf_u_int32 ss, chunksize;
+	bpf_u_int32 ss;
 #ifdef HAVE_SOLARIS
 	register char *release;
 	bpf_u_int32 osmajor, osminor, osmicro;
@@ -479,23 +344,15 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 #ifndef HAVE_DEV_DLPI
 	char dname2[100];
 #endif
-
-	p = (pcap_t *)malloc(sizeof(*p));
-	if (p == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
-		return (NULL);
-	}
-	memset(p, 0, sizeof(*p));
-	p->fd = -1;	/* indicate that it hasn't been opened yet */
-	p->send_fd = -1;
+	int status = PCAP_ERROR;
 
 #ifdef HAVE_DEV_DLPI
 	/*
 	** Remove any "/dev/" on the front of the device.
 	*/
-	cp = strrchr(device, '/');
+	cp = strrchr(p->opt.source, '/');
 	if (cp == NULL)
-		strlcpy(dname, device, sizeof(dname));
+		strlcpy(dname, p->opt.source, sizeof(dname));
 	else
 		strlcpy(dname, cp + 1, sizeof(dname));
 
@@ -503,9 +360,11 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * Split the device name into a device type name and a unit number;
 	 * chop off the unit number, so "dname" is just a device type name.
 	 */
-	cp = split_dname(dname, &ppa, ebuf);
-	if (cp == NULL)
+	cp = split_dname(dname, &ppa, p->errbuf);
+	if (cp == NULL) {
+		status = PCAP_ERROR_NO_SUCH_DEVICE;
 		goto bad;
+	}
 	*cp = '\0';
 
 	/*
@@ -521,7 +380,9 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 */
 	cp = "/dev/dlpi";
 	if ((p->fd = open(cp, O_RDWR)) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,
+		if (errno == EPERM || errno == EACCES)
+			status = PCAP_ERROR_PERM_DENIED;
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 		    "%s: %s", cp, pcap_strerror(errno));
 		goto bad;
 	}
@@ -545,9 +406,11 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * Get a table of all PPAs for that device, and search that
 	 * table for the specified device type name and unit number.
 	 */
-	ppa = get_dlpi_ppa(p->fd, dname, ppa, ebuf);
-	if (ppa < 0)
+	ppa = get_dlpi_ppa(p->fd, dname, ppa, p->errbuf);
+	if (ppa < 0) {
+		status = ppa;
 		goto bad;
+	}
 #else
 	/*
 	 * If the device name begins with "/", assume it begins with
@@ -555,19 +418,21 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * otherwise, concatenate the device directory name and the
 	 * device name.
 	 */
-	if (*device == '/')
-		strlcpy(dname, device, sizeof(dname));
+	if (*p->opt.source == '/')
+		strlcpy(dname, p->opt.source, sizeof(dname));
 	else
 		snprintf(dname, sizeof(dname), "%s/%s", PCAP_DEV_PREFIX,
-		    device);
+		    p->opt.source);
 
 	/*
 	 * Get the unit number, and a pointer to the end of the device
 	 * type name.
 	 */
-	cp = split_dname(dname, &ppa, ebuf);
-	if (cp == NULL)
+	cp = split_dname(dname, &ppa, p->errbuf);
+	if (cp == NULL) {
+		status = PCAP_ERROR_NO_SUCH_DEVICE;
 		goto bad;
+	}
 
 	/*
 	 * Make a copy of the device pathname, and then remove the unit
@@ -579,7 +444,9 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	/* Try device without unit number */
 	if ((p->fd = open(dname, O_RDWR)) < 0) {
 		if (errno != ENOENT) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s", dname,
+			if (errno == EACCES)
+				status = PCAP_ERROR_PERM_DENIED;
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s", dname,
 			    pcap_strerror(errno));
 			goto bad;
 		}
@@ -587,10 +454,18 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		/* Try again with unit number */
 		if ((p->fd = open(dname2, O_RDWR)) < 0) {
 			if (errno == ENOENT) {
+				status = PCAP_ERROR_NO_SUCH_DEVICE;
+
 				/*
-				 * We just report "No DLPI device found"
-				 * with the device name, so people don't
-				 * get confused and think, for example,
+				 * We provide an error message even
+				 * for this error, for diagnostic
+				 * purposes (so that, for example,
+				 * the app can show the message if the
+				 * user requests it).
+				 *
+				 * In it, we just report "No DLPI device
+				 * found" with the device name, so people
+				 * don't get confused and think, for example,
 				 * that if they can't capture on "lo0"
 				 * on Solaris the fix is to change libpcap
 				 * (or the application that uses it) to
@@ -602,10 +477,12 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 				 * for the loopback interface is just a
 				 * symptom of that inability.
 				 */
-				snprintf(ebuf, PCAP_ERRBUF_SIZE,
-				    "%s: No DLPI device found", device);
+				snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+				    "%s: No DLPI device found", p->opt.source);
 			} else {
-				snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s",
+				if (errno == EACCES)
+					status = PCAP_ERROR_PERM_DENIED;
+				snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
 				    dname2, pcap_strerror(errno));
 			}
 			goto bad;
@@ -615,13 +492,11 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	}
 #endif
 
-	p->snapshot = snaplen;
-
 	/*
 	** Attach if "style 2" provider
 	*/
-	if (dlinforeq(p->fd, ebuf) < 0 ||
-	    dlinfoack(p->fd, (char *)buf, ebuf) < 0)
+	if (dlinforeq(p->fd, p->errbuf) < 0 ||
+	    dlinfoack(p->fd, (char *)buf, p->errbuf) < 0)
 		goto bad;
 	infop = &((union DL_primitives *)buf)->info_ack;
 #ifdef HAVE_SOLARIS
@@ -629,16 +504,33 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		isatm = 1;
 #endif
 	if (infop->dl_provider_style == DL_STYLE2) {
-		if (dl_doattach(p->fd, ppa, ebuf) < 0)
+		status = dl_doattach(p->fd, ppa, p->errbuf);
+		if (status < 0)
 			goto bad;
 #ifdef DL_HP_RAWDLS
 		if (p->send_fd >= 0) {
-			if (dl_doattach(p->send_fd, ppa, ebuf) < 0)
+			if (dl_doattach(p->send_fd, ppa, p->errbuf) < 0)
 				goto bad;
 		}
 #endif
 	}
 
+	if (p->opt.rfmon) {
+		/*
+		 * This device exists, but we don't support monitor mode
+		 * any platforms that support DLPI.
+		 */
+		status = PCAP_ERROR_RFMON_NOTSUP;
+		goto bad;
+	}
+
+#ifdef HAVE_DLPI_PASSIVE
+	/*
+	 * Enable Passive mode to be able to capture on aggregated link.
+	 * Not supported in all Solaris versions.
+	 */
+	dlpassive(p->fd, p->errbuf);
+#endif
 	/*
 	** Bind (defer if using HP-UX 9 or HP-UX 10.20 or later, totally
 	** skip if using SINIX)
@@ -663,15 +555,15 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	** assume the SAP value in a DLPI bind is an LLC SAP for network
 	** types that use 802.2 LLC).
 	*/
-	if ((dlbindreq(p->fd, 1537, ebuf) < 0 &&
-	     dlbindreq(p->fd, 2, ebuf) < 0) ||
-	     dlbindack(p->fd, (char *)buf, ebuf, NULL) < 0)
+	if ((dlbindreq(p->fd, 1537, p->errbuf) < 0 &&
+	     dlbindreq(p->fd, 2, p->errbuf) < 0) ||
+	     dlbindack(p->fd, (char *)buf, p->errbuf, NULL) < 0)
 		goto bad;
 #elif defined(DL_HP_RAWDLS)
 	/*
 	** HP-UX 10.0x and 10.1x.
 	*/
-	if (dl_dohpuxbind(p->fd, ebuf) < 0)
+	if (dl_dohpuxbind(p->fd, p->errbuf) < 0)
 		goto bad;
 	if (p->send_fd >= 0) {
 		/*
@@ -679,7 +571,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		** set it to -1, so that you can't send but can
 		** still receive?
 		*/
-		if (dl_dohpuxbind(p->send_fd, ebuf) < 0)
+		if (dl_dohpuxbind(p->send_fd, p->errbuf) < 0)
 			goto bad;
 	}
 #else /* neither AIX nor HP-UX */
@@ -687,8 +579,8 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	** Not Sinix, and neither AIX nor HP-UX - Solaris, and any other
 	** OS using DLPI.
 	**/
-	if (dlbindreq(p->fd, 0, ebuf) < 0 ||
-	    dlbindack(p->fd, (char *)buf, ebuf, NULL) < 0)
+	if (dlbindreq(p->fd, 0, p->errbuf) < 0 ||
+	    dlbindack(p->fd, (char *)buf, p->errbuf, NULL) < 0)
 		goto bad;
 #endif /* AIX vs. HP-UX vs. other */
 #endif /* !HP-UX 9 and !HP-UX 10.20 or later and !SINIX */
@@ -702,18 +594,18 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		** help, and may break things.
 		*/
 		if (strioctl(p->fd, A_PROMISCON_REQ, 0, NULL) < 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "A_PROMISCON_REQ: %s",
-			    pcap_strerror(errno));
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+			    "A_PROMISCON_REQ: %s", pcap_strerror(errno));
 			goto bad;
 		}
 	} else
 #endif
-	if (promisc) {
+	if (p->opt.promisc) {
 		/*
 		** Enable promiscuous (not necessary on send FD)
 		*/
-		if (dlpromisconreq(p->fd, DL_PROMISC_PHYS, ebuf) < 0 ||
-		    dlokack(p->fd, "promisc_phys", (char *)buf, ebuf) < 0)
+		if (dlpromisconreq(p->fd, DL_PROMISC_PHYS, p->errbuf) < 0 ||
+		    dlokack(p->fd, "promisc_phys", (char *)buf, p->errbuf) < 0)
 			goto bad;
 
 		/*
@@ -722,10 +614,9 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		** HP-UX or SINIX) (Not necessary on send FD)
 		*/
 #if !defined(__hpux) && !defined(sinix)
-		if (dlpromisconreq(p->fd, DL_PROMISC_MULTI, ebuf) < 0 ||
-		    dlokack(p->fd, "promisc_multi", (char *)buf, ebuf) < 0)
-			fprintf(stderr,
-			    "WARNING: DL_PROMISC_MULTI failed (%s)\n", ebuf);
+		if (dlpromisconreq(p->fd, DL_PROMISC_MULTI, p->errbuf) < 0 ||
+		    dlokack(p->fd, "promisc_multi", (char *)buf, p->errbuf) < 0)
+			status = PCAP_WARNING;
 #endif
 	}
 	/*
@@ -736,17 +627,16 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 #ifndef sinix
 	if (
 #ifdef __hpux
-	    !promisc &&
+	    !p->opt.promisc &&
 #endif
 #ifdef HAVE_SOLARIS
 	    !isatm &&
 #endif
-	    (dlpromisconreq(p->fd, DL_PROMISC_SAP, ebuf) < 0 ||
-	    dlokack(p->fd, "promisc_sap", (char *)buf, ebuf) < 0)) {
+	    (dlpromisconreq(p->fd, DL_PROMISC_SAP, p->errbuf) < 0 ||
+	    dlokack(p->fd, "promisc_sap", (char *)buf, p->errbuf) < 0)) {
 		/* Not fatal if promisc since the DL_PROMISC_PHYS worked */
-		if (promisc)
-			fprintf(stderr,
-			    "WARNING: DL_PROMISC_SAP failed (%s)\n", ebuf);
+		if (p->opt.promisc)
+			status = PCAP_WARNING;
 		else
 			goto bad;
 	}
@@ -757,7 +647,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	** promiscuous options.
 	*/
 #if defined(HAVE_HPUX9) || defined(HAVE_HPUX10_20_OR_LATER)
-	if (dl_dohpuxbind(p->fd, ebuf) < 0)
+	if (dl_dohpuxbind(p->fd, p->errbuf) < 0)
 		goto bad;
 	/*
 	** We don't set promiscuous mode on the send FD, but we'll defer
@@ -770,7 +660,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		** set it to -1, so that you can't send but can
 		** still receive?
 		*/
-		if (dl_dohpuxbind(p->send_fd, ebuf) < 0)
+		if (dl_dohpuxbind(p->send_fd, p->errbuf) < 0)
 			goto bad;
 	}
 #endif
@@ -780,63 +670,13 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	** XXX - get SAP length and address length as well, for use
 	** when sending packets.
 	*/
-	if (dlinforeq(p->fd, ebuf) < 0 ||
-	    dlinfoack(p->fd, (char *)buf, ebuf) < 0)
+	if (dlinforeq(p->fd, p->errbuf) < 0 ||
+	    dlinfoack(p->fd, (char *)buf, p->errbuf) < 0)
 		goto bad;
 
 	infop = &((union DL_primitives *)buf)->info_ack;
-	switch (infop->dl_mac_type) {
-
-	case DL_CSMACD:
-	case DL_ETHER:
-		p->linktype = DLT_EN10MB;
-		p->offset = 2;
-		/*
-		 * This is (presumably) a real Ethernet capture; give it a
-		 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
-		 * that an application can let you choose it, in case you're
-		 * capturing DOCSIS traffic that a Cisco Cable Modem
-		 * Termination System is putting out onto an Ethernet (it
-		 * doesn't put an Ethernet header onto the wire, it puts raw
-		 * DOCSIS frames out on the wire inside the low-level
-		 * Ethernet framing).
-		 */
-		p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
-		/*
-		 * If that fails, just leave the list empty.
-		 */
-		if (p->dlt_list != NULL) {
-			p->dlt_list[0] = DLT_EN10MB;
-			p->dlt_list[1] = DLT_DOCSIS;
-			p->dlt_count = 2;
-		}
-		break;
-
-	case DL_FDDI:
-		p->linktype = DLT_FDDI;
-		p->offset = 3;
-		break;
-
-	case DL_TPR:
-		/*
-		 * XXX - what about DL_TPB?  Is that Token Bus?
-		 */	
-		p->linktype = DLT_IEEE802;
-		p->offset = 2;
-		break;
-
-#ifdef HAVE_SOLARIS
-	case DL_IPATM:
-		p->linktype = DLT_SUNATM;
-		p->offset = 0;	/* works for LANE and LLC encapsulation */
-		break;
-#endif
-
-	default:
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "unknown mac type %lu",
-		    (unsigned long)infop->dl_mac_type);
+	if (pcap_process_mactype(p, infop->dl_mac_type) != 0)
 		goto bad;
-	}
 
 #ifdef	DLIOCRAW
 	/*
@@ -844,93 +684,56 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	** header.
 	*/
 	if (strioctl(p->fd, DLIOCRAW, 0, NULL) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "DLIOCRAW: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "DLIOCRAW: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 #endif
 
-#ifdef HAVE_SYS_BUFMOD_H
-	/*
-	** Another non standard call to get the data nicely buffered
-	*/
-	if (ioctl(p->fd, I_PUSH, "bufmod") != 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "I_PUSH bufmod: %s",
-		    pcap_strerror(errno));
-		goto bad;
-	}
+	ss = p->snapshot;
 
 	/*
-	** Now that the bufmod is pushed lets configure it.
-	**
 	** There is a bug in bufmod(7). When dealing with messages of
 	** less than snaplen size it strips data from the beginning not
 	** the end.
 	**
-	** This bug is supposed to be fixed in 5.3.2. Also, there is a
-	** patch available. Ask for bugid 1149065.
+	** This bug is fixed in 5.3.2. Also, there is a patch available.
+	** Ask for bugid 1149065.
 	*/
-	ss = snaplen;
 #ifdef HAVE_SOLARIS
 	release = get_release(&osmajor, &osminor, &osmicro);
 	if (osmajor == 5 && (osminor <= 2 || (osminor == 3 && osmicro < 2)) &&
 	    getenv("BUFMOD_FIXED") == NULL) {
-		fprintf(stderr,
-		"WARNING: bufmod is broken in SunOS %s; ignoring snaplen.\n",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+		"WARNING: bufmod is broken in SunOS %s; ignoring snaplen.",
 		    release);
 		ss = 0;
+		status = PCAP_WARNING;
 	}
 #endif
-	if (ss > 0 &&
-	    strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "SBIOCSSNAP: %s",
-		    pcap_strerror(errno));
-		goto bad;
-	}
-
-	/*
-	** Set up the bufmod timeout
-	*/
-	if (to_ms != 0) {
-		struct timeval to;
 
-		to.tv_sec = to_ms / 1000;
-		to.tv_usec = (to_ms * 1000) % 1000000;
-		if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "SBIOCSTIME: %s",
-			    pcap_strerror(errno));
-			goto bad;
-		}
-	}
-
-	/*
-	** Set the chunk length.
-	*/
-	chunksize = CHUNKSIZE;
-	if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize)
-	    != 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "SBIOCSCHUNKP: %s",
-		    pcap_strerror(errno));
+#ifdef HAVE_SYS_BUFMOD_H
+	/* Push and configure bufmod. */
+	if (pcap_conf_bufmod(p, ss, p->md.timeout) != 0)
 		goto bad;
-	}
 #endif
 
 	/*
 	** As the last operation flush the read side.
 	*/
 	if (ioctl(p->fd, I_FLUSH, FLUSHR) != 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "FLUSHR: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "FLUSHR: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 
-	/* Allocate data buffer */
-	p->bufsize = PKTBUFSIZE;
-	p->buffer = (u_char *)malloc(p->bufsize + p->offset);
-	if (p->buffer == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
+	/* Allocate data buffer. */
+	if (pcap_alloc_databuf(p) != 0)
 		goto bad;
-	}
+
+	/* Success - but perhaps with a warning */
+	if (status < 0)
+		status = 0;
 
 	/*
 	 * "p->fd" is an FD for a STREAMS device, so "select()" and
@@ -946,21 +749,12 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->getnonblock_op = pcap_getnonblock_fd;
 	p->setnonblock_op = pcap_setnonblock_fd;
 	p->stats_op = pcap_stats_dlpi;
-	p->close_op = pcap_close_dlpi;
+	p->cleanup_op = pcap_cleanup_dlpi;
 
-	return (p);
+	return (status);
 bad:
-	if (p->fd >= 0)
-		close(p->fd);
-	if (p->send_fd >= 0)
-		close(p->send_fd);
-	/*
-	 * Get rid of any link-layer type list we allocated.
-	 */
-	if (p->dlt_list != NULL)
-		free(p->dlt_list);
-	free(p);
-	return (NULL);
+	pcap_cleanup_dlpi(p);
+	return (status);
 }
 
 /*
@@ -1016,10 +810,13 @@ static int
 dl_doattach(int fd, int ppa, char *ebuf)
 {
 	bpf_u_int32 buf[MAXDLBUF];
+	int err;
 
-	if (dlattachreq(fd, ppa, ebuf) < 0 ||
-	    dlokack(fd, "attach", (char *)buf, ebuf) < 0)
-		return (-1);
+	if (dlattachreq(fd, ppa, ebuf) < 0)
+		return (PCAP_ERROR);
+	err = dlokack(fd, "attach", (char *)buf, ebuf);
+	if (err < 0)
+		return (err);
 	return (0);
 }
 
@@ -1159,7 +956,7 @@ recv_ack(int fd, int size, const char *what, char *bufp, char *ebuf, int *uerror
 	if (getmsg(fd, &ctl, (struct strbuf*)NULL, &flags) < 0) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "recv_ack: %s getmsg: %s",
 		    what, pcap_strerror(errno));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	dlp = (union DL_primitives *) ctl.buf;
@@ -1183,27 +980,33 @@ recv_ack(int fd, int size, const char *what, char *bufp, char *ebuf, int *uerror
 			snprintf(ebuf, PCAP_ERRBUF_SIZE,
 			    "recv_ack: %s: UNIX error - %s",
 			    what, pcap_strerror(dlp->error_ack.dl_unix_errno));
+			if (dlp->error_ack.dl_unix_errno == EACCES)
+				return (PCAP_ERROR_PERM_DENIED);
 			break;
 
 		default:
 			snprintf(ebuf, PCAP_ERRBUF_SIZE, "recv_ack: %s: %s",
 			    what, dlstrerror(dlp->error_ack.dl_errno));
+			if (dlp->error_ack.dl_errno == DL_BADPPA)
+				return (PCAP_ERROR_NO_SUCH_DEVICE);
+			else if (dlp->error_ack.dl_errno == DL_ACCESS)
+				return (PCAP_ERROR_PERM_DENIED);
 			break;
 		}
-		return (-1);
+		return (PCAP_ERROR);
 
 	default:
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "recv_ack: %s: Unexpected primitive ack %s",
 		    what, dlprim(dlp->dl_primitive));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	if (ctl.len < size) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "recv_ack: %s: Ack too small (%d < %d)",
 		    what, ctl.len, size);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 	return (ctl.len);
 }
@@ -1486,6 +1289,24 @@ dlinfoack(int fd, char *bufp, char *ebuf)
 	return (recv_ack(fd, DL_INFO_ACK_SIZE, "info", bufp, ebuf, NULL));
 }
 
+#ifdef HAVE_DLPI_PASSIVE
+/*
+ * Enable DLPI passive mode. We do not care if this request fails, as this
+ * indicates the underlying DLPI device does not support link aggregation.
+ */
+static void
+dlpassive(int fd, char *ebuf)
+{
+	dl_passive_req_t req;
+	bpf_u_int32 buf[MAXDLBUF];
+
+	req.dl_primitive = DL_PASSIVE_REQ;
+
+	if (send_request(fd, (char *)&req, sizeof(req), "dlpassive", ebuf) == 0)
+	    (void) dlokack(fd, "dlpassive", (char *)buf, ebuf);
+}
+#endif
+
 #ifdef DL_HP_RAWDLS
 /*
  * There's an ack *if* there's an error.
@@ -1522,26 +1343,6 @@ dlrawdatareq(int fd, const u_char *datap, int datalen)
 }
 #endif /* DL_HP_RAWDLS */
 
-#ifdef HAVE_SYS_BUFMOD_H
-static int
-strioctl(int fd, int cmd, int len, char *dp)
-{
-	struct strioctl str;
-	int rc;
-
-	str.ic_cmd = cmd;
-	str.ic_timout = -1;
-	str.ic_len = len;
-	str.ic_dp = dp;
-	rc = ioctl(fd, I_STR, &str);
-
-	if (rc < 0)
-		return (rc);
-	else
-		return (str.ic_len);
-}
-#endif
-
 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
 static char *
 get_release(bpf_u_int32 *majorp, bpf_u_int32 *minorp, bpf_u_int32 *microp)
@@ -1631,7 +1432,7 @@ get_dlpi_ppa(register int fd, register const char *device, register int unit,
 
 	memset((char *)buf, 0, sizeof(buf));
 	if (send_request(fd, (char *)&req, sizeof(req), "hpppa", ebuf) < 0)
-		return (-1);
+		return (PCAP_ERROR);
 
 	ctl.maxlen = DL_HP_PPA_ACK_SIZE;
 	ctl.len = 0;
@@ -1654,7 +1455,7 @@ get_dlpi_ppa(register int fd, register const char *device, register int unit,
 	if (getmsg(fd, &ctl, (struct strbuf *)NULL, &flags) < 0) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "get_dlpi_ppa: hpppa getmsg: %s", pcap_strerror(errno));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	dlp = (dl_hp_ppa_ack_t *)ctl.buf;
@@ -1662,21 +1463,21 @@ get_dlpi_ppa(register int fd, register const char *device, register int unit,
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "get_dlpi_ppa: hpppa unexpected primitive ack 0x%x",
 		    (bpf_u_int32)dlp->dl_primitive);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	if (ctl.len < DL_HP_PPA_ACK_SIZE) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "get_dlpi_ppa: hpppa ack too small (%d < %lu)",
 		     ctl.len, (unsigned long)DL_HP_PPA_ACK_SIZE);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	/* allocate buffer */
 	if ((ppa_data_buf = (char *)malloc(dlp->dl_length)) == NULL) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "get_dlpi_ppa: hpppa malloc: %s", pcap_strerror(errno));
-		return (-1);
+		return (PCAP_ERROR);
 	}
 	ctl.maxlen = dlp->dl_length;
 	ctl.len = 0;
@@ -1686,14 +1487,14 @@ get_dlpi_ppa(register int fd, register const char *device, register int unit,
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "get_dlpi_ppa: hpppa getmsg: %s", pcap_strerror(errno));
 		free(ppa_data_buf);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 	if (ctl.len < dlp->dl_length) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "get_dlpi_ppa: hpppa ack too small (%d < %d)",
 		    ctl.len, dlp->dl_length);
 		free(ppa_data_buf);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 
 	ap = (dl_hp_ppa_ack_t *)buf;
@@ -1750,7 +1551,7 @@ get_dlpi_ppa(register int fd, register const char *device, register int unit,
 		if (stat(dname, &statbuf) < 0) {
 			snprintf(ebuf, PCAP_ERRBUF_SIZE, "stat: %s: %s",
 			    dname, pcap_strerror(errno));
-			return (-1);
+			return (PCAP_ERROR);
 		}
 		majdev = major(statbuf.st_rdev);
 
@@ -1767,13 +1568,13 @@ get_dlpi_ppa(register int fd, register const char *device, register int unit,
 	if (i == ap->dl_count) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "can't find /dev/dlpi PPA for %s%d", device, unit);
-		return (-1);
+		return (PCAP_ERROR_NO_SUCH_DEVICE);
 	}
 	if (ip->dl_hdw_state == HDW_DEAD) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 		    "%s%d: hardware state: DOWN\n", device, unit);
 		free(ppa_data_buf);
-		return (-1);
+		return (PCAP_ERROR);
 	}
 	ppa = ip->dl_ppa;
 	free(ppa_data_buf);
@@ -1871,3 +1672,18 @@ dlpi_kread(register int fd, register off_t addr,
 	return (cc);
 }
 #endif
+
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->send_fd = -1;	/* it hasn't been opened yet */
+
+	p->activate_op = pcap_activate_dlpi;
+	return (p);
+}
diff --git a/contrib/libpcap/pcap-dos.c b/contrib/libpcap/pcap-dos.c
index 0700d6b..7b3c4bd 100644
--- a/contrib/libpcap/pcap-dos.c
+++ b/contrib/libpcap/pcap-dos.c
@@ -1,11 +1,11 @@
 /*
  *  This file is part of DOS-libpcap
- *  Ported to DOS/DOSX by G. Vanem <giva@bgnett.no>
+ *  Ported to DOS/DOSX by G. Vanem <gvanem@broadpark.no>
  *
  *  pcap-dos.c: Interface to PKTDRVR, NDIS2 and 32-bit pmode
  *              network drivers.
  *
- * @(#) $Header: /tcpdump/master/libpcap/pcap-dos.c,v 1.1.2.1 2005/05/03 18:54:35 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-dos.c,v 1.2.2.5 2008-04-22 17:16:49 guy Exp $ (LBL)
  */
 
 #include <stdio.h>
@@ -97,9 +97,10 @@ static volatile BOOL exc_occured = 0;
 
 static struct device *handle_to_device [20];
 
+static int  pcap_activate_dos (pcap_t *p);
 static int  pcap_read_dos (pcap_t *p, int cnt, pcap_handler callback,
                            u_char *data);
-static void pcap_close_dos (pcap_t *p);
+static void pcap_cleanup_dos (pcap_t *p);
 static int  pcap_stats_dos (pcap_t *p, struct pcap_stat *ps);
 static int  pcap_sendpacket_dos (pcap_t *p, const void *buf, size_t len);
 static int  pcap_setfilter_dos (pcap_t *p, struct bpf_program *fp);
@@ -142,59 +143,64 @@ static struct device *get_device (int fd)
   return handle_to_device [fd-1];
 }
 
+pcap_t *pcap_create (const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_dos;
+	return (p);
+}
+
 /*
  * Open MAC-driver with name 'device_name' for live capture of
  * network packets.
  */
-pcap_t *pcap_open_live (const char *device_name, int snaplen, int promisc,
-                        int timeout_ms, char *errbuf)
+static int pcap_activate_dos (pcap_t *pcap)
 { 
-  struct pcap *pcap;
-
-  if (snaplen < ETH_MIN)
-      snaplen = ETH_MIN;
+  if (pcap->opt.rfmon) {
+    /*
+     * No monitor mode on DOS.
+     */
+    return (PCAP_ERROR_RFMON_NOTSUP);
+  }
 
-  if (snaplen > ETH_MAX)   /* silently accept and truncate large MTUs */
-      snaplen = ETH_MAX;
+  if (pcap->snapshot < ETH_MIN+8)
+      pcap->snapshot = ETH_MIN+8;
 
-  pcap = calloc (sizeof(*pcap), 1);
-  if (!pcap)
-  {
-    strcpy (errbuf, "Not enough memory (pcap)");
-    return (NULL);
-  }
+  if (pcap->snapshot > ETH_MAX)   /* silently accept and truncate large MTUs */
+      pcap->snapshot = ETH_MAX;
 
-  pcap->snapshot          = max (ETH_MIN+8, snaplen);
   pcap->linktype          = DLT_EN10MB;  /* !! */
-  pcap->inter_packet_wait = timeout_ms;
-  pcap->close_op          = pcap_close_dos;
+  pcap->cleanup_op        = pcap_cleanup_dos;
   pcap->read_op           = pcap_read_dos;
   pcap->stats_op          = pcap_stats_dos;
   pcap->inject_op         = pcap_sendpacket_dos;
   pcap->setfilter_op      = pcap_setfilter_dos;
-	pcap->setdirection_op   = NULL; /* Not implemented.*/
+  pcap->setdirection_op   = NULL; /* Not implemented.*/
   pcap->fd                = ++ref_count;
 
   if (pcap->fd == 1)  /* first time we're called */
   {
-    if (!init_watt32(pcap, device_name, errbuf) ||
-        !first_init(device_name, errbuf, promisc))
+    if (!init_watt32(pcap, pcap->opt.source, pcap->errbuf) ||
+        !first_init(pcap->opt.source, pcap->errbuf, pcap->opt.promisc))
     {
-      free (pcap);
-      return (NULL);
+      return (PCAP_ERROR);
     } 
     atexit (close_driver);
   }
-  else if (stricmp(active_dev->name,device_name))
+  else if (stricmp(active_dev->name,pcap->opt.source))
   {
-    snprintf (errbuf, PCAP_ERRBUF_SIZE,
+    snprintf (pcap->errbuf, PCAP_ERRBUF_SIZE,
               "Cannot use different devices simultaneously "
-              "(`%s' vs. `%s')", active_dev->name, device_name);
-    free (pcap);
-    pcap = NULL;
+              "(`%s' vs. `%s')", active_dev->name, pcap->opt.source);
+    return (PCAP_ERROR);
   }
   handle_to_device [pcap->fd-1] = active_dev;
-  return (pcap);
+  return (0);
 }
 
 /*
@@ -205,15 +211,14 @@ static int
 pcap_read_one (pcap_t *p, pcap_handler callback, u_char *data)
 {
   struct pcap_pkthdr pcap;
-  struct bpf_insn   *fcode = p->fcode.bf_insns;
   struct timeval     now, expiry;
   BYTE  *rx_buf;
   int    rx_len = 0;
 
-  if (p->inter_packet_wait > 0)
+  if (p->md.timeout > 0)
   {
     gettimeofday2 (&now, NULL);
-    expiry.tv_usec = now.tv_usec + 1000UL * p->inter_packet_wait;
+    expiry.tv_usec = now.tv_usec + 1000UL * p->md.timeout;
     expiry.tv_sec  = now.tv_sec;
     while (expiry.tv_usec >= 1000000L)
     {
@@ -258,7 +263,7 @@ pcap_read_one (pcap_t *p, pcap_handler callback, u_char *data)
       pcap.len    = rx_len;
 
       if (callback &&
-          (!fcode || bpf_filter(fcode, rx_buf, pcap.len, pcap.caplen)))
+          (!p->fcode.bf_insns || bpf_filter(p->fcode.bf_insns, rx_buf, pcap.len, pcap.caplen)))
       {
         filter_count++;
 
@@ -285,7 +290,7 @@ pcap_read_one (pcap_t *p, pcap_handler callback, u_char *data)
     /* If not to wait for a packet or pcap_close() called from
      * e.g. SIGINT handler, exit loop now.
      */
-    if (p->inter_packet_wait <= 0 || (volatile int)p->fd <= 0)
+    if (p->md.timeout <= 0 || (volatile int)p->fd <= 0)
        break;
 
     gettimeofday2 (&now, NULL);
@@ -421,7 +426,7 @@ u_long pcap_filter_packets (void)
 /*
  * Close pcap device. Not called for offline captures.
  */
-static void pcap_close_dos (pcap_t *p)
+static void pcap_cleanup_dos (pcap_t *p)
 {
   if (p && !exc_occured)
   {
@@ -477,7 +482,7 @@ int pcap_lookupnet (const char *device, bpf_u_int32 *localnet,
 {
   if (!_watt_is_init)
   {
-    strcpy (errbuf, "pcap_open_offline() or pcap_open_live() must be "
+    strcpy (errbuf, "pcap_open_offline() or pcap_activate() must be "
                     "called first");
     return (-1);
   }
@@ -588,7 +593,7 @@ void pcap_set_wait (pcap_t *p, void (*yield)(void), int wait)
   if (p)
   {
     p->wait_proc         = yield;
-    p->inter_packet_wait = wait;
+    p->md.timeout        = wait;
   }
 }
 
@@ -734,13 +739,13 @@ static void exc_handler (int sig)
          fprintf (stderr, "Catching signal %d.\n", sig);
   }
   exc_occured = 1;
-  pcap_close_dos (NULL);
+  pcap_cleanup_dos (NULL);
 }
 #endif  /* __DJGPP__ */
 
 
 /*
- * Open the pcap device for the first client calling pcap_open_live()
+ * Open the pcap device for the first client calling pcap_activate()
  */
 static int first_init (const char *name, char *ebuf, int promisc)
 {
@@ -991,7 +996,7 @@ int EISA_bus = 0;  /* Where is natural place for this? */
  * Application config hooks to set various driver parameters.
  */
 
-static struct config_table debug_tab[] = {
+static const struct config_table debug_tab[] = {
             { "PKT.DEBUG",       ARG_ATOI,   &pcap_pkt_debug    },
             { "PKT.VECTOR",      ARG_ATOX_W, NULL               },
             { "NDIS.DEBUG",      ARG_ATOI,   NULL               },
diff --git a/contrib/libpcap/pcap-enet.c b/contrib/libpcap/pcap-enet.c
index a484207..e5ea9aa 100644
--- a/contrib/libpcap/pcap-enet.c
+++ b/contrib/libpcap/pcap-enet.c
@@ -8,7 +8,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-enet.c,v 1.8 2003/11/15 23:24:02 guy Exp $";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-enet.c,v 1.9 2006/10/04 18:09:22 guy Exp $";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -22,7 +22,7 @@ static const char rcsid[] _U_ =
 #include <sys/socket.h>
 
 #include <net/if.h>
-#include <pcap-bpf.h>
+#include <pcap/bpf.h>
 #include <net/enet.h>
 
 #include <netinet/in.h>
diff --git a/contrib/libpcap/pcap-filter.manmisc b/contrib/libpcap/pcap-filter.manmisc
new file mode 100644
index 0000000..372bb98
--- /dev/null
+++ b/contrib/libpcap/pcap-filter.manmisc
@@ -0,0 +1,949 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap-filter.manmisc.in,v 1.1.2.2 2008-10-21 07:44:56 guy Exp $ (LBL)
+.\"
+.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP-FILTER 7 "6 January 2008"
+.SH NAME
+pcap-filter \- packet filter syntax
+.br
+.ad
+.SH DESCRIPTION
+.LP
+.B pcap_compile()
+is used to compile a string into a filter program.
+The resulting filter program can then be applied to
+some stream of packets to determine which packets will be supplied to
+.BR pcap_loop() ,
+.BR pcap_dispatch() ,
+.BR pcap_next() ,
+or
+.BR pcap_next_ex() .
+.LP
+The \fIfilter expression\fP consists of one or more
+.IR primitives .
+Primitives usually consist of an
+.I id
+(name or number) preceded by one or more qualifiers.
+There are three
+different kinds of qualifier:
+.IP \fItype\fP
+qualifiers say what kind of thing the id name or number refers to.
+Possible types are
+.BR host ,
+.B net ,
+.B port
+and
+.BR portrange .
+E.g., `host foo', `net 128.3', `port 20', `portrange 6000-6008'.
+If there is no type
+qualifier,
+.B host
+is assumed.
+.IP \fIdir\fP
+qualifiers specify a particular transfer direction to and/or from
+.IR id .
+Possible directions are
+.BR src ,
+.BR dst ,
+.BR "src or dst" ,
+.BR "src and dst" ,
+.BR addr1 ,
+.BR addr2 ,
+.BR addr3 ,
+and
+.BR addr4 .
+E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'.
+If
+there is no dir qualifier,
+.B "src or dst"
+is assumed.
+The
+.BR addr1 ,
+.BR addr2 ,
+.BR addr3 ,
+and
+.B addr4
+qualifiers are only valid for IEEE 802.11 Wireless LAN link layers.
+For some link layers, such as SLIP and the ``cooked'' Linux capture mode
+used for the ``any'' device and for some other device types, the
+.B inbound
+and
+.B outbound
+qualifiers can be used to specify a desired direction.
+.IP \fIproto\fP
+qualifiers restrict the match to a particular protocol.
+Possible
+protos are:
+.BR ether ,
+.BR fddi ,
+.BR tr ,
+.BR wlan ,
+.BR ip ,
+.BR ip6 ,
+.BR arp ,
+.BR rarp ,
+.BR decnet ,
+.B tcp
+and
+.BR udp .
+E.g., `ether src foo', `arp net 128.3', `tcp port 21', `udp portrange
+7000-7009', `wlan addr2 0:2:3:4:5:6'.
+If there is
+no proto qualifier, all protocols consistent with the type are
+assumed.
+E.g., `src foo' means `(ip or arp or rarp) src foo'
+(except the latter is not legal syntax), `net bar' means `(ip or
+arp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
+.LP
+[`fddi' is actually an alias for `ether'; the parser treats them
+identically as meaning ``the data link level used on the specified
+network interface.''  FDDI headers contain Ethernet-like source
+and destination addresses, and often contain Ethernet-like packet
+types, so you can filter on these FDDI fields just as with the
+analogous Ethernet fields.
+FDDI headers also contain other fields,
+but you cannot name them explicitly in a filter expression.
+.LP
+Similarly, `tr' and `wlan' are aliases for `ether'; the previous
+paragraph's statements about FDDI headers also apply to Token Ring
+and 802.11 wireless LAN headers.  For 802.11 headers, the destination
+address is the DA field and the source address is the SA field; the
+BSSID, RA, and TA fields aren't tested.]
+.LP
+In addition to the above, there are some special `primitive' keywords
+that don't follow the pattern:
+.BR gateway ,
+.BR broadcast ,
+.BR less ,
+.B greater
+and arithmetic expressions.
+All of these are described below.
+.LP
+More complex filter expressions are built up by using the words
+.BR and ,
+.B or
+and
+.B not
+to combine primitives.
+E.g., `host foo and not port ftp and not port ftp-data'.
+To save typing, identical qualifier lists can be omitted.
+E.g.,
+`tcp dst port ftp or ftp-data or domain' is exactly the same as
+`tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'.
+.LP
+Allowable primitives are:
+.IP "\fBdst host \fIhost\fR"
+True if the IPv4/v6 destination field of the packet is \fIhost\fP,
+which may be either an address or a name.
+.IP "\fBsrc host \fIhost\fR"
+True if the IPv4/v6 source field of the packet is \fIhost\fP.
+.IP "\fBhost \fIhost\fP
+True if either the IPv4/v6 source or destination of the packet is \fIhost\fP.
+.IP
+Any of the above host expressions can be prepended with the keywords,
+\fBip\fP, \fBarp\fP, \fBrarp\fP, or \fBip6\fP as in:
+.in +.5i
+.nf
+\fBip host \fIhost\fR
+.fi
+.in -.5i
+which is equivalent to:
+.in +.5i
+.nf
+\fBether proto \fI\\ip\fB and host \fIhost\fR
+.fi
+.in -.5i
+If \fIhost\fR is a name with multiple IP addresses, each address will
+be checked for a match.
+.IP "\fBether dst \fIehost\fP
+True if the Ethernet destination address is \fIehost\fP.
+\fIEhost\fP
+may be either a name from /etc/ethers or a number (see
+.IR ethers (3N)
+for numeric format).
+.IP "\fBether src \fIehost\fP
+True if the Ethernet source address is \fIehost\fP.
+.IP "\fBether host \fIehost\fP
+True if either the Ethernet source or destination address is \fIehost\fP.
+.IP "\fBgateway\fP \fIhost\fP
+True if the packet used \fIhost\fP as a gateway.
+I.e., the Ethernet
+source or destination address was \fIhost\fP but neither the IP source
+nor the IP destination was \fIhost\fP.
+\fIHost\fP must be a name and
+must be found both by the machine's host-name-to-IP-address resolution
+mechanisms (host name file, DNS, NIS, etc.) and by the machine's
+host-name-to-Ethernet-address resolution mechanism (/etc/ethers, etc.).
+(An equivalent expression is
+.in +.5i
+.nf
+\fBether host \fIehost \fBand not host \fIhost\fR
+.fi
+.in -.5i
+which can be used with either names or numbers for \fIhost / ehost\fP.)
+This syntax does not work in IPv6-enabled configuration at this moment.
+.IP "\fBdst net \fInet\fR"
+True if the IPv4/v6 destination address of the packet has a network
+number of \fInet\fP.
+\fINet\fP may be either a name from the networks database
+(/etc/networks, etc.) or a network number.
+An IPv4 network number can be written as a dotted quad (e.g., 192.168.1.0),
+dotted triple (e.g., 192.168.1), dotted pair (e.g, 172.16), or single
+number (e.g., 10); the netmask is 255.255.255.255 for a dotted quad
+(which means that it's really a host match), 255.255.255.0 for a dotted
+triple, 255.255.0.0 for a dotted pair, or 255.0.0.0 for a single number.
+An IPv6 network number must be written out fully; the netmask is
+ff:ff:ff:ff:ff:ff:ff:ff, so IPv6 "network" matches are really always
+host matches, and a network match requires a netmask length.
+.IP "\fBsrc net \fInet\fR"
+True if the IPv4/v6 source address of the packet has a network
+number of \fInet\fP.
+.IP "\fBnet \fInet\fR"
+True if either the IPv4/v6 source or destination address of the packet has a network
+number of \fInet\fP.
+.IP "\fBnet \fInet\fR \fBmask \fInetmask\fR"
+True if the IPv4 address matches \fInet\fR with the specific \fInetmask\fR.
+May be qualified with \fBsrc\fR or \fBdst\fR.
+Note that this syntax is not valid for IPv6 \fInet\fR.
+.IP "\fBnet \fInet\fR/\fIlen\fR"
+True if the IPv4/v6 address matches \fInet\fR with a netmask \fIlen\fR
+bits wide.
+May be qualified with \fBsrc\fR or \fBdst\fR.
+.IP "\fBdst port \fIport\fR"
+True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a
+destination port value of \fIport\fP.
+The \fIport\fP can be a number or a name used in /etc/services (see
+.IR tcp (4P)
+and
+.IR udp (4P)).
+If a name is used, both the port
+number and protocol are checked.
+If a number or ambiguous name is used,
+only the port number is checked (e.g., \fBdst port 513\fR will print both
+tcp/login traffic and udp/who traffic, and \fBport domain\fR will print
+both tcp/domain and udp/domain traffic).
+.IP "\fBsrc port \fIport\fR"
+True if the packet has a source port value of \fIport\fP.
+.IP "\fBport \fIport\fR"
+True if either the source or destination port of the packet is \fIport\fP.
+.IP "\fBdst portrange \fIport1\fB-\fIport2\fR"
+True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a
+destination port value between \fIport1\fP and \fIport2\fP.
+.I port1
+and
+.I port2
+are interpreted in the same fashion as the
+.I port
+parameter for
+.BR port .
+.IP "\fBsrc portrange \fIport1\fB-\fIport2\fR"
+True if the packet has a source port value between \fIport1\fP and
+\fIport2\fP.
+.IP "\fBportrange \fIport1\fB-\fIport2\fR"
+True if either the source or destination port of the packet is between
+\fIport1\fP and \fIport2\fP.
+.IP
+Any of the above port or port range expressions can be prepended with
+the keywords, \fBtcp\fP or \fBudp\fP, as in:
+.in +.5i
+.nf
+\fBtcp src port \fIport\fR
+.fi
+.in -.5i
+which matches only tcp packets whose source port is \fIport\fP.
+.IP "\fBless \fIlength\fR"
+True if the packet has a length less than or equal to \fIlength\fP.
+This is equivalent to:
+.in +.5i
+.nf
+\fBlen <= \fIlength\fP.
+.fi
+.in -.5i
+.IP "\fBgreater \fIlength\fR"
+True if the packet has a length greater than or equal to \fIlength\fP.
+This is equivalent to:
+.in +.5i
+.nf
+\fBlen >= \fIlength\fP.
+.fi
+.in -.5i
+.IP "\fBip proto \fIprotocol\fR"
+True if the packet is an IPv4 packet (see
+.IR ip (4P))
+of protocol type \fIprotocol\fP.
+\fIProtocol\fP can be a number or one of the names
+\fBicmp\fP, \fBicmp6\fP, \fBigmp\fP, \fBigrp\fP, \fBpim\fP, \fBah\fP,
+\fBesp\fP, \fBvrrp\fP, \fBudp\fP, or \fBtcp\fP.
+Note that the identifiers \fBtcp\fP, \fBudp\fP, and \fBicmp\fP are also
+keywords and must be escaped via backslash (\\), which is \\\\ in the C-shell.
+Note that this primitive does not chase the protocol header chain.
+.IP "\fBip6 proto \fIprotocol\fR"
+True if the packet is an IPv6 packet of protocol type \fIprotocol\fP.
+Note that this primitive does not chase the protocol header chain.
+.IP "\fBip6 protochain \fIprotocol\fR"
+True if the packet is IPv6 packet,
+and contains protocol header with type \fIprotocol\fR
+in its protocol header chain.
+For example,
+.in +.5i
+.nf
+\fBip6 protochain 6\fR
+.fi
+.in -.5i
+matches any IPv6 packet with TCP protocol header in the protocol header chain.
+The packet may contain, for example,
+authentication header, routing header, or hop-by-hop option header,
+between IPv6 header and TCP header.
+The BPF code emitted by this primitive is complex and
+cannot be optimized by the BPF optimizer code, so this can be somewhat
+slow.
+.IP "\fBip protochain \fIprotocol\fR"
+Equivalent to \fBip6 protochain \fIprotocol\fR, but this is for IPv4.
+.IP "\fBether broadcast\fR"
+True if the packet is an Ethernet broadcast packet.
+The \fIether\fP
+keyword is optional.
+.IP "\fBip broadcast\fR"
+True if the packet is an IPv4 broadcast packet.
+It checks for both the all-zeroes and all-ones broadcast conventions,
+and looks up the subnet mask on the interface on which the capture is
+being done.
+.IP
+If the subnet mask of the interface on which the capture is being done
+is not available, either because the interface on which capture is being
+done has no netmask or because the capture is being done on the Linux
+"any" interface, which can capture on more than one interface, this
+check will not work correctly.
+.IP "\fBether multicast\fR"
+True if the packet is an Ethernet multicast packet.
+The \fBether\fP
+keyword is optional.
+This is shorthand for `\fBether[0] & 1 != 0\fP'.
+.IP "\fBip multicast\fR"
+True if the packet is an IPv4 multicast packet.
+.IP "\fBip6 multicast\fR"
+True if the packet is an IPv6 multicast packet.
+.IP  "\fBether proto \fIprotocol\fR"
+True if the packet is of ether type \fIprotocol\fR.
+\fIProtocol\fP can be a number or one of the names
+\fBip\fP, \fBip6\fP, \fBarp\fP, \fBrarp\fP, \fBatalk\fP, \fBaarp\fP,
+\fBdecnet\fP, \fBsca\fP, \fBlat\fP, \fBmopdl\fP, \fBmoprc\fP,
+\fBiso\fP, \fBstp\fP, \fBipx\fP, or \fBnetbeui\fP.
+Note these identifiers are also keywords
+and must be escaped via backslash (\\).
+.IP
+[In the case of FDDI (e.g., `\fBfddi protocol arp\fR'), Token Ring
+(e.g., `\fBtr protocol arp\fR'), and IEEE 802.11 wireless LANS (e.g.,
+`\fBwlan protocol arp\fR'), for most of those protocols, the
+protocol identification comes from the 802.2 Logical Link Control (LLC)
+header, which is usually layered on top of the FDDI, Token Ring, or
+802.11 header.
+.IP
+When filtering for most protocol identifiers on FDDI, Token Ring, or
+802.11, the filter checks only the protocol ID field of an LLC header
+in so-called SNAP format with an Organizational Unit Identifier (OUI) of
+0x000000, for encapsulated Ethernet; it doesn't check whether the packet
+is in SNAP format with an OUI of 0x000000.
+The exceptions are:
+.RS
+.TP
+\fBiso\fP
+the filter checks the DSAP (Destination Service Access Point) and
+SSAP (Source Service Access Point) fields of the LLC header;
+.TP
+\fBstp\fP and \fBnetbeui\fP
+the filter checks the DSAP of the LLC header;
+.TP
+\fBatalk\fP
+the filter checks for a SNAP-format packet with an OUI of 0x080007
+and the AppleTalk etype.
+.RE
+.IP
+In the case of Ethernet, the filter checks the Ethernet type field
+for most of those protocols.  The exceptions are:
+.RS
+.TP
+\fBiso\fP, \fBstp\fP, and \fBnetbeui\fP
+the filter checks for an 802.3 frame and then checks the LLC header as
+it does for FDDI, Token Ring, and 802.11;
+.TP
+\fBatalk\fP
+the filter checks both for the AppleTalk etype in an Ethernet frame and
+for a SNAP-format packet as it does for FDDI, Token Ring, and 802.11;
+.TP
+\fBaarp\fP
+the filter checks for the AppleTalk ARP etype in either an Ethernet
+frame or an 802.2 SNAP frame with an OUI of 0x000000;
+.TP
+\fBipx\fP
+the filter checks for the IPX etype in an Ethernet frame, the IPX
+DSAP in the LLC header, the 802.3-with-no-LLC-header encapsulation of
+IPX, and the IPX etype in a SNAP frame.
+.RE
+.IP "\fBdecnet src \fIhost\fR"
+True if the DECNET source address is
+.IR host ,
+which may be an address of the form ``10.123'', or a DECNET host
+name.
+[DECNET host name support is only available on ULTRIX systems
+that are configured to run DECNET.]
+.IP "\fBdecnet dst \fIhost\fR"
+True if the DECNET destination address is
+.IR host .
+.IP "\fBdecnet host \fIhost\fR"
+True if either the DECNET source or destination address is
+.IR host .
+.IP "\fBifname \fIinterface\fR"
+True if the packet was logged as coming from the specified interface (applies
+only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBon \fIinterface\fR"
+Synonymous with the
+.B ifname
+modifier.
+.IP "\fBrnr \fInum\fR"
+True if the packet was logged as matching the specified PF rule number
+(applies only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBrulenum \fInum\fR"
+Synonymous with the
+.B rnr
+modifier.
+.IP "\fBreason \fIcode\fR"
+True if the packet was logged with the specified PF reason code.  The known
+codes are:
+.BR match ,
+.BR bad-offset ,
+.BR fragment ,
+.BR short ,
+.BR normalize ,
+and
+.B memory
+(applies only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBrset \fIname\fR"
+True if the packet was logged as matching the specified PF ruleset
+name of an anchored ruleset (applies only to packets logged by OpenBSD's
+or FreeBSD's
+.BR pf (4)).
+.IP "\fBruleset \fIname\fR"
+Synonomous with the
+.B rset
+modifier.
+.IP "\fBsrnr \fInum\fR"
+True if the packet was logged as matching the specified PF rule number
+of an anchored ruleset (applies only to packets logged by OpenBSD's or
+FreeBSD's
+.BR pf (4)).
+.IP "\fBsubrulenum \fInum\fR"
+Synonomous with the
+.B srnr
+modifier.
+.IP "\fBaction \fIact\fR"
+True if PF took the specified action when the packet was logged.  Known actions
+are:
+.B pass
+and
+.B block
+and, with later versions of
+.BR pf (4)),
+.BR nat ,
+.BR rdr ,
+.B binat
+and
+.B scrub
+(applies only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBwlan addr1 \fIehost\fR"
+True if the first IEEE 802.11 address is
+.IR ehost .
+.IP "\fBwlan addr2 \fIehost\fR"
+True if the second IEEE 802.11 address, if present, is
+.IR ehost .
+The second address field is used in all frames except for CTS (Clear To
+Send) and ACK (Acknowledgment) control frames.
+.IP "\fBwlan addr3 \fIehost\fR"
+True if the third IEEE 802.11 address, if present, is
+.IR ehost .
+The third address field is used in management and data frames, but not
+in control frames.
+.IP "\fBwlan addr4 \fIehost\fR"
+True if the fourth IEEE 802.11 address, if present, is
+.IR ehost .
+The fourth address field is only used for
+WDS (Wireless Distribution System) frames.
+.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fInetbeui\fP"
+Abbreviations for:
+.in +.5i
+.nf
+\fBether proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBether proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+Note that not all applications using
+.BR pcap (3)
+currently know how to parse these protocols.
+.IP "\fBtype \fIwlan_type\fR"
+True if the IEEE 802.11 frame type matches the specified \fIwlan_type\fR.
+Valid \fIwlan_type\fRs are:
+\fBmgt\fP,
+\fBctl\fP
+and \fBdata\fP.
+.IP "\fBtype \fIwlan_type \fBsubtype \fIwlan_subtype\fR"
+True if the IEEE 802.11 frame type matches the specified \fIwlan_type\fR
+and frame subtype matches the specified \fIwlan_subtype\fR.
+.IP
+If the specified \fIwlan_type\fR is \fBmgt\fP,
+then valid \fIwlan_subtype\fRs are:
+\fBassoc-req\fP,
+\fBassoc-resp\fP,
+\fBreassoc-req\fP,
+\fBreassoc-resp\fP,
+\fBprobe-req\fP,
+\fBprobe-resp\fP,
+\fBbeacon\fP,
+\fBatim\fP,
+\fBdisassoc\fP,
+\fBauth\fP and
+\fBdeauth\fP.
+.IP
+If the specified \fIwlan_type\fR is \fBctl\fP,
+then valid \fIwlan_subtype\fRs are:
+\fBps-poll\fP,
+\fBrts\fP,
+\fBcts\fP,
+\fBack\fP,
+\fBcf-end\fP and
+\fBcf-end-ack\fP.
+.IP
+If the specified \fIwlan_type\fR is \fBdata\fP,
+then valid \fIwlan_subtype\fRs are:
+\fBdata\fP,
+\fBdata-cf-ack\fP,
+\fBdata-cf-poll\fP,
+\fBdata-cf-ack-poll\fP,
+\fBnull\fP,
+\fBcf-ack\fP,
+\fBcf-poll\fP,
+\fBcf-ack-poll\fP,
+\fBqos-data\fP,
+\fBqos-data-cf-ack\fP,
+\fBqos-data-cf-poll\fP,
+\fBqos-data-cf-ack-poll\fP,
+\fBqos\fP,
+\fBqos-cf-poll\fP and
+\fBqos-cf-ack-poll\fP.
+.IP "\fBsubtype \fIwlan_subtype\fR"
+True if the IEEE 802.11 frame subtype matches the specified \fIwlan_subtype\fR
+and frame has the type to which the specified \fIwlan_subtype\fR belongs.
+.IP "\fBdir \fIdir\fR"
+True if the IEEE 802.11 frame direction matches the specified
+.IR dir .
+Valid directions are:
+.BR nods ,
+.BR tods ,
+.BR fromds ,
+.BR dstods ,
+or a numeric value.
+.IP "\fBvlan \fI[vlan_id]\fR"
+True if the packet is an IEEE 802.1Q VLAN packet.
+If \fI[vlan_id]\fR is specified, only true if the packet has the specified
+\fIvlan_id\fR.
+Note that the first \fBvlan\fR keyword encountered in \fIexpression\fR
+changes the decoding offsets for the remainder of \fIexpression\fR on
+the assumption that the packet is a VLAN packet.  The \fBvlan
+\fI[vlan_id]\fR expression may be used more than once, to filter on VLAN
+hierarchies.  Each use of that expression increments the filter offsets
+by 4.
+.IP
+For example:
+.in +.5i
+.nf
+\fBvlan 100 && vlan 200\fR
+.fi
+.in -.5i
+filters on VLAN 200 encapsulated within VLAN 100, and
+.in +.5i
+.nf
+\fBvlan && vlan 300 && ip\fR
+.fi
+.in -.5i
+filters IPv4 protocols encapsulated in VLAN 300 encapsulated within any
+higher order VLAN.
+.IP "\fBmpls \fI[label_num]\fR"
+True if the packet is an MPLS packet.
+If \fI[label_num]\fR is specified, only true is the packet has the specified
+\fIlabel_num\fR.
+Note that the first \fBmpls\fR keyword encountered in \fIexpression\fR
+changes the decoding offsets for the remainder of \fIexpression\fR on
+the assumption that the packet is a MPLS-encapsulated IP packet.  The
+\fBmpls \fI[label_num]\fR expression may be used more than once, to
+filter on MPLS hierarchies.  Each use of that expression increments the
+filter offsets by 4. 
+.IP
+For example:
+.in +.5i
+.nf
+\fBmpls 100000 && mpls 1024\fR
+.fi
+.in -.5i
+filters packets with an outer label of 100000 and an inner label of
+1024, and
+.in +.5i
+.nf
+\fBmpls && mpls 1024 && host 192.9.200.1\fR
+.fi
+.in -.5i
+filters packets to or from 192.9.200.1 with an inner label of 1024 and
+any outer label.
+.IP \fBpppoed\fP
+True if the packet is a PPP-over-Ethernet Discovery packet (Ethernet
+type 0x8863).
+.IP \fBpppoes\fP
+True if the packet is a PPP-over-Ethernet Session packet (Ethernet
+type 0x8864).
+Note that the first \fBpppoes\fR keyword encountered in \fIexpression\fR
+changes the decoding offsets for the remainder of \fIexpression\fR on
+the assumption that the packet is a PPPoE session packet.
+.IP
+For example:
+.in +.5i
+.nf
+\fBpppoes && ip\fR
+.fi
+.in -.5i
+filters IPv4 protocols encapsulated in PPPoE.
+.IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBip proto \fIp\fR\fB or ip6 proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP "\fBiso proto \fIprotocol\fR"
+True if the packet is an OSI packet of protocol type \fIprotocol\fP.
+\fIProtocol\fP can be a number or one of the names
+\fBclnp\fP, \fBesis\fP, or \fBisis\fP.
+.IP "\fBclnp\fR, \fBesis\fR, \fBisis\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBiso proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP "\fBl1\fR, \fBl2\fR, \fBiih\fR, \fBlsp\fR, \fBsnp\fR, \fBcsnp\fR, \fBpsnp\fR"
+Abbreviations for IS-IS PDU types.
+.IP "\fBvpi\fP \fIn\fR
+True if the packet is an ATM packet, for SunATM on Solaris, with a
+virtual path identifier of
+.IR n .
+.IP "\fBvci\fP \fIn\fR
+True if the packet is an ATM packet, for SunATM on Solaris, with a
+virtual channel identifier of
+.IR n .
+.IP \fBlane\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+an ATM LANE packet.
+Note that the first \fBlane\fR keyword encountered in \fIexpression\fR
+changes the tests done in the remainder of \fIexpression\fR
+on the assumption that the packet is either a LANE emulated Ethernet
+packet or a LANE LE Control packet.  If \fBlane\fR isn't specified, the
+tests are done under the assumption that the packet is an
+LLC-encapsulated packet.
+.IP \fBllc\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+an LLC-encapsulated packet.
+.IP \fBoamf4s\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+a segment OAM F4 flow cell (VPI=0 & VCI=3).
+.IP \fBoamf4e\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+an end-to-end OAM F4 flow cell (VPI=0 & VCI=4).
+.IP \fBoamf4\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+a segment or end-to-end OAM F4 flow cell (VPI=0 & (VCI=3 | VCI=4)).
+.IP \fBoam\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+a segment or end-to-end OAM F4 flow cell (VPI=0 & (VCI=3 | VCI=4)).
+.IP \fBmetac\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a meta signaling circuit (VPI=0 & VCI=1).
+.IP \fBbcc\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a broadcast signaling circuit (VPI=0 & VCI=2).
+.IP \fBsc\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a signaling circuit (VPI=0 & VCI=5).
+.IP \fBilmic\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on an ILMI circuit (VPI=0 & VCI=16).
+.IP \fBconnectmsg\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect,
+Connect Ack, Release, or Release Done message.
+.IP \fBmetaconnect\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a meta signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect,
+Release, or Release Done message.
+.IP  "\fIexpr relop expr\fR"
+True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =,
+!=, and \fIexpr\fR is an arithmetic expression composed of integer
+constants (expressed in standard C syntax), the normal binary operators
+[+, -, *, /, &, |, <<, >>], a length operator, and special packet data
+accessors.  Note that all comparisons are unsigned, so that, for example,
+0x80000000 and 0xffffffff are > 0.
+To access
+data inside the packet, use the following syntax:
+.in +.5i
+.nf
+\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
+.fi
+.in -.5i
+\fIProto\fR is one of \fBether, fddi, tr, wlan, ppp, slip, link,
+ip, arp, rarp, tcp, udp, icmp, ip6\fR or \fBradio\fR, and
+indicates the protocol layer for the index operation.
+(\fBether, fddi, wlan, tr, ppp, slip\fR and \fBlink\fR all refer to the
+link layer. \fBradio\fR refers to the "radio header" added to some
+802.11 captures.)
+Note that \fItcp, udp\fR and other upper-layer protocol types only
+apply to IPv4, not IPv6 (this will be fixed in the future).
+The byte offset, relative to the indicated protocol layer, is
+given by \fIexpr\fR.
+\fISize\fR is optional and indicates the number of bytes in the
+field of interest; it can be either one, two, or four, and defaults to one.
+The length operator, indicated by the keyword \fBlen\fP, gives the
+length of the packet.
+
+For example, `\fBether[0] & 1 != 0\fP' catches all multicast traffic.
+The expression `\fBip[0] & 0xf != 5\fP'
+catches all IPv4 packets with options.
+The expression
+`\fBip[6:2] & 0x1fff = 0\fP'
+catches only unfragmented IPv4 datagrams and frag zero of fragmented
+IPv4 datagrams.
+This check is implicitly applied to the \fBtcp\fP and \fBudp\fP
+index operations.
+For instance, \fBtcp[0]\fP always means the first
+byte of the TCP \fIheader\fP, and never means the first byte of an
+intervening fragment.
+
+Some offsets and field values may be expressed as names rather than
+as numeric values.
+The following protocol header field offsets are
+available: \fBicmptype\fP (ICMP type field), \fBicmpcode\fP (ICMP
+code field), and \fBtcpflags\fP (TCP flags field).
+
+The following ICMP type field values are available: \fBicmp-echoreply\fP,
+\fBicmp-unreach\fP, \fBicmp-sourcequench\fP, \fBicmp-redirect\fP,
+\fBicmp-echo\fP, \fBicmp-routeradvert\fP, \fBicmp-routersolicit\fP,
+\fBicmp-timxceed\fP, \fBicmp-paramprob\fP, \fBicmp-tstamp\fP,
+\fBicmp-tstampreply\fP, \fBicmp-ireq\fP, \fBicmp-ireqreply\fP,
+\fBicmp-maskreq\fP, \fBicmp-maskreply\fP.
+
+The following TCP flags field values are available: \fBtcp-fin\fP,
+\fBtcp-syn\fP, \fBtcp-rst\fP, \fBtcp-push\fP,
+\fBtcp-ack\fP, \fBtcp-urg\fP.
+.LP
+Primitives may be combined using:
+.IP
+A parenthesized group of primitives and operators
+(parentheses are special to the Shell and must be escaped).
+.IP
+Negation (`\fB!\fP' or `\fBnot\fP').
+.IP
+Concatenation (`\fB&&\fP' or `\fBand\fP').
+.IP
+Alternation (`\fB||\fP' or `\fBor\fP').
+.LP
+Negation has highest precedence.
+Alternation and concatenation have equal precedence and associate
+left to right.
+Note that explicit \fBand\fR tokens, not juxtaposition,
+are now required for concatenation.
+.LP
+If an identifier is given without a keyword, the most recent keyword
+is assumed.
+For example,
+.in +.5i
+.nf
+\fBnot host vs and ace\fR
+.fi
+.in -.5i
+is short for
+.in +.5i
+.nf
+\fBnot host vs and host ace\fR
+.fi
+.in -.5i
+which should not be confused with
+.in +.5i
+.nf
+\fBnot ( host vs or ace )\fR
+.fi
+.in -.5i
+.SH EXAMPLES
+.LP
+To select all packets arriving at or departing from \fIsundown\fP:
+.RS
+.nf
+\fBhost sundown\fP
+.fi
+.RE
+.LP
+To select traffic between \fIhelios\fR and either \fIhot\fR or \fIace\fR:
+.RS
+.nf
+\fBhost helios and \\( hot or ace \\)\fP
+.fi
+.RE
+.LP
+To select all IP packets between \fIace\fR and any host except \fIhelios\fR:
+.RS
+.nf
+\fBip host ace and not helios\fP
+.fi
+.RE
+.LP
+To select all traffic between local hosts and hosts at Berkeley:
+.RS
+.nf
+.B
+net ucb-ether
+.fi
+.RE
+.LP
+To select all ftp traffic through internet gateway \fIsnup\fP:
+.RS
+.nf
+.B
+gateway snup and (port ftp or ftp-data)
+.fi
+.RE
+.LP
+To select traffic neither sourced from nor destined for local hosts
+(if you gateway to one other net, this stuff should never make it
+onto your local net).
+.RS
+.nf
+.B
+ip and not net \fIlocalnet\fP
+.fi
+.RE
+.LP
+To select the start and end packets (the SYN and FIN packets) of each
+TCP conversation that involves a non-local host.
+.RS
+.nf
+.B
+tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net \fIlocalnet\fP
+.fi
+.RE
+.LP
+To select all IPv4 HTTP packets to and from port 80, i.e. print only
+packets that contain data, not, for example, SYN and FIN packets and
+ACK-only packets.  (IPv6 is left as an exercise for the reader.)
+.RS
+.nf
+.B
+tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)
+.fi
+.RE
+.LP
+To select IP packets longer than 576 bytes sent through gateway \fIsnup\fP:
+.RS
+.nf
+.B
+gateway snup and ip[2:2] > 576
+.fi
+.RE
+.LP
+To select IP broadcast or multicast packets that were
+.I not
+sent via Ethernet broadcast or multicast:
+.RS
+.nf
+.B
+ether[0] & 1 = 0 and ip[16] >= 224
+.fi
+.RE
+.LP
+To select all ICMP packets that are not echo requests/replies (i.e., not
+ping packets):
+.RS
+.nf
+.B
+icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply
+.fi
+.RE
+.SH "SEE ALSO"
+pcap(3PCAP)
+.SH AUTHORS
+The original authors are:
+.LP
+Van Jacobson,
+Craig Leres and
+Steven McCanne, all of the
+Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
+.LP
+It is currently being maintained by tcpdump.org.
+.LP
+The current version of libpcap is available via http:
+.LP
+.RS
+.I http://www.tcpdump.org/
+.RE
+.LP
+The original distribution is available via anonymous ftp:
+.LP
+.RS
+.I ftp://ftp.ee.lbl.gov/tcpdump.tar.Z
+.RE
+.SH BUGS
+Please send problems, bugs, questions, desirable enhancements, etc. to:
+.LP
+.RS
+tcpdump-workers@lists.tcpdump.org
+.RE
+.LP
+Filter expressions on fields other than those in Token Ring headers will
+not correctly handle source-routed Token Ring packets.
+.LP
+Filter expressions on fields other than those in 802.11 headers will not
+correctly handle 802.11 data packets with both To DS and From DS set.
+.LP
+.BR "ip6 proto"
+should chase header chain, but at this moment it does not.
+.BR "ip6 protochain"
+is supplied for this behavior.
+.LP
+Arithmetic expression against transport layer headers, like \fBtcp[0]\fP,
+does not work against IPv6 packets.
+It only looks at IPv4 packets.
diff --git a/contrib/libpcap/pcap-filter.manmisc.in b/contrib/libpcap/pcap-filter.manmisc.in
new file mode 100644
index 0000000..3beec58
--- /dev/null
+++ b/contrib/libpcap/pcap-filter.manmisc.in
@@ -0,0 +1,949 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap-filter.manmisc.in,v 1.1.2.2 2008-10-21 07:44:56 guy Exp $ (LBL)
+.\"
+.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP-FILTER @MAN_MISC_INFO@ "6 January 2008"
+.SH NAME
+pcap-filter \- packet filter syntax
+.br
+.ad
+.SH DESCRIPTION
+.LP
+.B pcap_compile()
+is used to compile a string into a filter program.
+The resulting filter program can then be applied to
+some stream of packets to determine which packets will be supplied to
+.BR pcap_loop() ,
+.BR pcap_dispatch() ,
+.BR pcap_next() ,
+or
+.BR pcap_next_ex() .
+.LP
+The \fIfilter expression\fP consists of one or more
+.IR primitives .
+Primitives usually consist of an
+.I id
+(name or number) preceded by one or more qualifiers.
+There are three
+different kinds of qualifier:
+.IP \fItype\fP
+qualifiers say what kind of thing the id name or number refers to.
+Possible types are
+.BR host ,
+.B net ,
+.B port
+and
+.BR portrange .
+E.g., `host foo', `net 128.3', `port 20', `portrange 6000-6008'.
+If there is no type
+qualifier,
+.B host
+is assumed.
+.IP \fIdir\fP
+qualifiers specify a particular transfer direction to and/or from
+.IR id .
+Possible directions are
+.BR src ,
+.BR dst ,
+.BR "src or dst" ,
+.BR "src and dst" ,
+.BR addr1 ,
+.BR addr2 ,
+.BR addr3 ,
+and
+.BR addr4 .
+E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'.
+If
+there is no dir qualifier,
+.B "src or dst"
+is assumed.
+The
+.BR addr1 ,
+.BR addr2 ,
+.BR addr3 ,
+and
+.B addr4
+qualifiers are only valid for IEEE 802.11 Wireless LAN link layers.
+For some link layers, such as SLIP and the ``cooked'' Linux capture mode
+used for the ``any'' device and for some other device types, the
+.B inbound
+and
+.B outbound
+qualifiers can be used to specify a desired direction.
+.IP \fIproto\fP
+qualifiers restrict the match to a particular protocol.
+Possible
+protos are:
+.BR ether ,
+.BR fddi ,
+.BR tr ,
+.BR wlan ,
+.BR ip ,
+.BR ip6 ,
+.BR arp ,
+.BR rarp ,
+.BR decnet ,
+.B tcp
+and
+.BR udp .
+E.g., `ether src foo', `arp net 128.3', `tcp port 21', `udp portrange
+7000-7009', `wlan addr2 0:2:3:4:5:6'.
+If there is
+no proto qualifier, all protocols consistent with the type are
+assumed.
+E.g., `src foo' means `(ip or arp or rarp) src foo'
+(except the latter is not legal syntax), `net bar' means `(ip or
+arp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
+.LP
+[`fddi' is actually an alias for `ether'; the parser treats them
+identically as meaning ``the data link level used on the specified
+network interface.''  FDDI headers contain Ethernet-like source
+and destination addresses, and often contain Ethernet-like packet
+types, so you can filter on these FDDI fields just as with the
+analogous Ethernet fields.
+FDDI headers also contain other fields,
+but you cannot name them explicitly in a filter expression.
+.LP
+Similarly, `tr' and `wlan' are aliases for `ether'; the previous
+paragraph's statements about FDDI headers also apply to Token Ring
+and 802.11 wireless LAN headers.  For 802.11 headers, the destination
+address is the DA field and the source address is the SA field; the
+BSSID, RA, and TA fields aren't tested.]
+.LP
+In addition to the above, there are some special `primitive' keywords
+that don't follow the pattern:
+.BR gateway ,
+.BR broadcast ,
+.BR less ,
+.B greater
+and arithmetic expressions.
+All of these are described below.
+.LP
+More complex filter expressions are built up by using the words
+.BR and ,
+.B or
+and
+.B not
+to combine primitives.
+E.g., `host foo and not port ftp and not port ftp-data'.
+To save typing, identical qualifier lists can be omitted.
+E.g.,
+`tcp dst port ftp or ftp-data or domain' is exactly the same as
+`tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'.
+.LP
+Allowable primitives are:
+.IP "\fBdst host \fIhost\fR"
+True if the IPv4/v6 destination field of the packet is \fIhost\fP,
+which may be either an address or a name.
+.IP "\fBsrc host \fIhost\fR"
+True if the IPv4/v6 source field of the packet is \fIhost\fP.
+.IP "\fBhost \fIhost\fP
+True if either the IPv4/v6 source or destination of the packet is \fIhost\fP.
+.IP
+Any of the above host expressions can be prepended with the keywords,
+\fBip\fP, \fBarp\fP, \fBrarp\fP, or \fBip6\fP as in:
+.in +.5i
+.nf
+\fBip host \fIhost\fR
+.fi
+.in -.5i
+which is equivalent to:
+.in +.5i
+.nf
+\fBether proto \fI\\ip\fB and host \fIhost\fR
+.fi
+.in -.5i
+If \fIhost\fR is a name with multiple IP addresses, each address will
+be checked for a match.
+.IP "\fBether dst \fIehost\fP
+True if the Ethernet destination address is \fIehost\fP.
+\fIEhost\fP
+may be either a name from /etc/ethers or a number (see
+.IR ethers (3N)
+for numeric format).
+.IP "\fBether src \fIehost\fP
+True if the Ethernet source address is \fIehost\fP.
+.IP "\fBether host \fIehost\fP
+True if either the Ethernet source or destination address is \fIehost\fP.
+.IP "\fBgateway\fP \fIhost\fP
+True if the packet used \fIhost\fP as a gateway.
+I.e., the Ethernet
+source or destination address was \fIhost\fP but neither the IP source
+nor the IP destination was \fIhost\fP.
+\fIHost\fP must be a name and
+must be found both by the machine's host-name-to-IP-address resolution
+mechanisms (host name file, DNS, NIS, etc.) and by the machine's
+host-name-to-Ethernet-address resolution mechanism (/etc/ethers, etc.).
+(An equivalent expression is
+.in +.5i
+.nf
+\fBether host \fIehost \fBand not host \fIhost\fR
+.fi
+.in -.5i
+which can be used with either names or numbers for \fIhost / ehost\fP.)
+This syntax does not work in IPv6-enabled configuration at this moment.
+.IP "\fBdst net \fInet\fR"
+True if the IPv4/v6 destination address of the packet has a network
+number of \fInet\fP.
+\fINet\fP may be either a name from the networks database
+(/etc/networks, etc.) or a network number.
+An IPv4 network number can be written as a dotted quad (e.g., 192.168.1.0),
+dotted triple (e.g., 192.168.1), dotted pair (e.g, 172.16), or single
+number (e.g., 10); the netmask is 255.255.255.255 for a dotted quad
+(which means that it's really a host match), 255.255.255.0 for a dotted
+triple, 255.255.0.0 for a dotted pair, or 255.0.0.0 for a single number.
+An IPv6 network number must be written out fully; the netmask is
+ff:ff:ff:ff:ff:ff:ff:ff, so IPv6 "network" matches are really always
+host matches, and a network match requires a netmask length.
+.IP "\fBsrc net \fInet\fR"
+True if the IPv4/v6 source address of the packet has a network
+number of \fInet\fP.
+.IP "\fBnet \fInet\fR"
+True if either the IPv4/v6 source or destination address of the packet has a network
+number of \fInet\fP.
+.IP "\fBnet \fInet\fR \fBmask \fInetmask\fR"
+True if the IPv4 address matches \fInet\fR with the specific \fInetmask\fR.
+May be qualified with \fBsrc\fR or \fBdst\fR.
+Note that this syntax is not valid for IPv6 \fInet\fR.
+.IP "\fBnet \fInet\fR/\fIlen\fR"
+True if the IPv4/v6 address matches \fInet\fR with a netmask \fIlen\fR
+bits wide.
+May be qualified with \fBsrc\fR or \fBdst\fR.
+.IP "\fBdst port \fIport\fR"
+True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a
+destination port value of \fIport\fP.
+The \fIport\fP can be a number or a name used in /etc/services (see
+.IR tcp (4P)
+and
+.IR udp (4P)).
+If a name is used, both the port
+number and protocol are checked.
+If a number or ambiguous name is used,
+only the port number is checked (e.g., \fBdst port 513\fR will print both
+tcp/login traffic and udp/who traffic, and \fBport domain\fR will print
+both tcp/domain and udp/domain traffic).
+.IP "\fBsrc port \fIport\fR"
+True if the packet has a source port value of \fIport\fP.
+.IP "\fBport \fIport\fR"
+True if either the source or destination port of the packet is \fIport\fP.
+.IP "\fBdst portrange \fIport1\fB-\fIport2\fR"
+True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a
+destination port value between \fIport1\fP and \fIport2\fP.
+.I port1
+and
+.I port2
+are interpreted in the same fashion as the
+.I port
+parameter for
+.BR port .
+.IP "\fBsrc portrange \fIport1\fB-\fIport2\fR"
+True if the packet has a source port value between \fIport1\fP and
+\fIport2\fP.
+.IP "\fBportrange \fIport1\fB-\fIport2\fR"
+True if either the source or destination port of the packet is between
+\fIport1\fP and \fIport2\fP.
+.IP
+Any of the above port or port range expressions can be prepended with
+the keywords, \fBtcp\fP or \fBudp\fP, as in:
+.in +.5i
+.nf
+\fBtcp src port \fIport\fR
+.fi
+.in -.5i
+which matches only tcp packets whose source port is \fIport\fP.
+.IP "\fBless \fIlength\fR"
+True if the packet has a length less than or equal to \fIlength\fP.
+This is equivalent to:
+.in +.5i
+.nf
+\fBlen <= \fIlength\fP.
+.fi
+.in -.5i
+.IP "\fBgreater \fIlength\fR"
+True if the packet has a length greater than or equal to \fIlength\fP.
+This is equivalent to:
+.in +.5i
+.nf
+\fBlen >= \fIlength\fP.
+.fi
+.in -.5i
+.IP "\fBip proto \fIprotocol\fR"
+True if the packet is an IPv4 packet (see
+.IR ip (4P))
+of protocol type \fIprotocol\fP.
+\fIProtocol\fP can be a number or one of the names
+\fBicmp\fP, \fBicmp6\fP, \fBigmp\fP, \fBigrp\fP, \fBpim\fP, \fBah\fP,
+\fBesp\fP, \fBvrrp\fP, \fBudp\fP, or \fBtcp\fP.
+Note that the identifiers \fBtcp\fP, \fBudp\fP, and \fBicmp\fP are also
+keywords and must be escaped via backslash (\\), which is \\\\ in the C-shell.
+Note that this primitive does not chase the protocol header chain.
+.IP "\fBip6 proto \fIprotocol\fR"
+True if the packet is an IPv6 packet of protocol type \fIprotocol\fP.
+Note that this primitive does not chase the protocol header chain.
+.IP "\fBip6 protochain \fIprotocol\fR"
+True if the packet is IPv6 packet,
+and contains protocol header with type \fIprotocol\fR
+in its protocol header chain.
+For example,
+.in +.5i
+.nf
+\fBip6 protochain 6\fR
+.fi
+.in -.5i
+matches any IPv6 packet with TCP protocol header in the protocol header chain.
+The packet may contain, for example,
+authentication header, routing header, or hop-by-hop option header,
+between IPv6 header and TCP header.
+The BPF code emitted by this primitive is complex and
+cannot be optimized by the BPF optimizer code, so this can be somewhat
+slow.
+.IP "\fBip protochain \fIprotocol\fR"
+Equivalent to \fBip6 protochain \fIprotocol\fR, but this is for IPv4.
+.IP "\fBether broadcast\fR"
+True if the packet is an Ethernet broadcast packet.
+The \fIether\fP
+keyword is optional.
+.IP "\fBip broadcast\fR"
+True if the packet is an IPv4 broadcast packet.
+It checks for both the all-zeroes and all-ones broadcast conventions,
+and looks up the subnet mask on the interface on which the capture is
+being done.
+.IP
+If the subnet mask of the interface on which the capture is being done
+is not available, either because the interface on which capture is being
+done has no netmask or because the capture is being done on the Linux
+"any" interface, which can capture on more than one interface, this
+check will not work correctly.
+.IP "\fBether multicast\fR"
+True if the packet is an Ethernet multicast packet.
+The \fBether\fP
+keyword is optional.
+This is shorthand for `\fBether[0] & 1 != 0\fP'.
+.IP "\fBip multicast\fR"
+True if the packet is an IPv4 multicast packet.
+.IP "\fBip6 multicast\fR"
+True if the packet is an IPv6 multicast packet.
+.IP  "\fBether proto \fIprotocol\fR"
+True if the packet is of ether type \fIprotocol\fR.
+\fIProtocol\fP can be a number or one of the names
+\fBip\fP, \fBip6\fP, \fBarp\fP, \fBrarp\fP, \fBatalk\fP, \fBaarp\fP,
+\fBdecnet\fP, \fBsca\fP, \fBlat\fP, \fBmopdl\fP, \fBmoprc\fP,
+\fBiso\fP, \fBstp\fP, \fBipx\fP, or \fBnetbeui\fP.
+Note these identifiers are also keywords
+and must be escaped via backslash (\\).
+.IP
+[In the case of FDDI (e.g., `\fBfddi protocol arp\fR'), Token Ring
+(e.g., `\fBtr protocol arp\fR'), and IEEE 802.11 wireless LANS (e.g.,
+`\fBwlan protocol arp\fR'), for most of those protocols, the
+protocol identification comes from the 802.2 Logical Link Control (LLC)
+header, which is usually layered on top of the FDDI, Token Ring, or
+802.11 header.
+.IP
+When filtering for most protocol identifiers on FDDI, Token Ring, or
+802.11, the filter checks only the protocol ID field of an LLC header
+in so-called SNAP format with an Organizational Unit Identifier (OUI) of
+0x000000, for encapsulated Ethernet; it doesn't check whether the packet
+is in SNAP format with an OUI of 0x000000.
+The exceptions are:
+.RS
+.TP
+\fBiso\fP
+the filter checks the DSAP (Destination Service Access Point) and
+SSAP (Source Service Access Point) fields of the LLC header;
+.TP
+\fBstp\fP and \fBnetbeui\fP
+the filter checks the DSAP of the LLC header;
+.TP
+\fBatalk\fP
+the filter checks for a SNAP-format packet with an OUI of 0x080007
+and the AppleTalk etype.
+.RE
+.IP
+In the case of Ethernet, the filter checks the Ethernet type field
+for most of those protocols.  The exceptions are:
+.RS
+.TP
+\fBiso\fP, \fBstp\fP, and \fBnetbeui\fP
+the filter checks for an 802.3 frame and then checks the LLC header as
+it does for FDDI, Token Ring, and 802.11;
+.TP
+\fBatalk\fP
+the filter checks both for the AppleTalk etype in an Ethernet frame and
+for a SNAP-format packet as it does for FDDI, Token Ring, and 802.11;
+.TP
+\fBaarp\fP
+the filter checks for the AppleTalk ARP etype in either an Ethernet
+frame or an 802.2 SNAP frame with an OUI of 0x000000;
+.TP
+\fBipx\fP
+the filter checks for the IPX etype in an Ethernet frame, the IPX
+DSAP in the LLC header, the 802.3-with-no-LLC-header encapsulation of
+IPX, and the IPX etype in a SNAP frame.
+.RE
+.IP "\fBdecnet src \fIhost\fR"
+True if the DECNET source address is
+.IR host ,
+which may be an address of the form ``10.123'', or a DECNET host
+name.
+[DECNET host name support is only available on ULTRIX systems
+that are configured to run DECNET.]
+.IP "\fBdecnet dst \fIhost\fR"
+True if the DECNET destination address is
+.IR host .
+.IP "\fBdecnet host \fIhost\fR"
+True if either the DECNET source or destination address is
+.IR host .
+.IP "\fBifname \fIinterface\fR"
+True if the packet was logged as coming from the specified interface (applies
+only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBon \fIinterface\fR"
+Synonymous with the
+.B ifname
+modifier.
+.IP "\fBrnr \fInum\fR"
+True if the packet was logged as matching the specified PF rule number
+(applies only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBrulenum \fInum\fR"
+Synonymous with the
+.B rnr
+modifier.
+.IP "\fBreason \fIcode\fR"
+True if the packet was logged with the specified PF reason code.  The known
+codes are:
+.BR match ,
+.BR bad-offset ,
+.BR fragment ,
+.BR short ,
+.BR normalize ,
+and
+.B memory
+(applies only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBrset \fIname\fR"
+True if the packet was logged as matching the specified PF ruleset
+name of an anchored ruleset (applies only to packets logged by OpenBSD's
+or FreeBSD's
+.BR pf (4)).
+.IP "\fBruleset \fIname\fR"
+Synonomous with the
+.B rset
+modifier.
+.IP "\fBsrnr \fInum\fR"
+True if the packet was logged as matching the specified PF rule number
+of an anchored ruleset (applies only to packets logged by OpenBSD's or
+FreeBSD's
+.BR pf (4)).
+.IP "\fBsubrulenum \fInum\fR"
+Synonomous with the
+.B srnr
+modifier.
+.IP "\fBaction \fIact\fR"
+True if PF took the specified action when the packet was logged.  Known actions
+are:
+.B pass
+and
+.B block
+and, with later versions of
+.BR pf (4)),
+.BR nat ,
+.BR rdr ,
+.B binat
+and
+.B scrub
+(applies only to packets logged by OpenBSD's or FreeBSD's
+.BR pf (4)).
+.IP "\fBwlan addr1 \fIehost\fR"
+True if the first IEEE 802.11 address is
+.IR ehost .
+.IP "\fBwlan addr2 \fIehost\fR"
+True if the second IEEE 802.11 address, if present, is
+.IR ehost .
+The second address field is used in all frames except for CTS (Clear To
+Send) and ACK (Acknowledgment) control frames.
+.IP "\fBwlan addr3 \fIehost\fR"
+True if the third IEEE 802.11 address, if present, is
+.IR ehost .
+The third address field is used in management and data frames, but not
+in control frames.
+.IP "\fBwlan addr4 \fIehost\fR"
+True if the fourth IEEE 802.11 address, if present, is
+.IR ehost .
+The fourth address field is only used for
+WDS (Wireless Distribution System) frames.
+.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fInetbeui\fP"
+Abbreviations for:
+.in +.5i
+.nf
+\fBether proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBether proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+Note that not all applications using
+.BR pcap (3)
+currently know how to parse these protocols.
+.IP "\fBtype \fIwlan_type\fR"
+True if the IEEE 802.11 frame type matches the specified \fIwlan_type\fR.
+Valid \fIwlan_type\fRs are:
+\fBmgt\fP,
+\fBctl\fP
+and \fBdata\fP.
+.IP "\fBtype \fIwlan_type \fBsubtype \fIwlan_subtype\fR"
+True if the IEEE 802.11 frame type matches the specified \fIwlan_type\fR
+and frame subtype matches the specified \fIwlan_subtype\fR.
+.IP
+If the specified \fIwlan_type\fR is \fBmgt\fP,
+then valid \fIwlan_subtype\fRs are:
+\fBassoc-req\fP,
+\fBassoc-resp\fP,
+\fBreassoc-req\fP,
+\fBreassoc-resp\fP,
+\fBprobe-req\fP,
+\fBprobe-resp\fP,
+\fBbeacon\fP,
+\fBatim\fP,
+\fBdisassoc\fP,
+\fBauth\fP and
+\fBdeauth\fP.
+.IP
+If the specified \fIwlan_type\fR is \fBctl\fP,
+then valid \fIwlan_subtype\fRs are:
+\fBps-poll\fP,
+\fBrts\fP,
+\fBcts\fP,
+\fBack\fP,
+\fBcf-end\fP and
+\fBcf-end-ack\fP.
+.IP
+If the specified \fIwlan_type\fR is \fBdata\fP,
+then valid \fIwlan_subtype\fRs are:
+\fBdata\fP,
+\fBdata-cf-ack\fP,
+\fBdata-cf-poll\fP,
+\fBdata-cf-ack-poll\fP,
+\fBnull\fP,
+\fBcf-ack\fP,
+\fBcf-poll\fP,
+\fBcf-ack-poll\fP,
+\fBqos-data\fP,
+\fBqos-data-cf-ack\fP,
+\fBqos-data-cf-poll\fP,
+\fBqos-data-cf-ack-poll\fP,
+\fBqos\fP,
+\fBqos-cf-poll\fP and
+\fBqos-cf-ack-poll\fP.
+.IP "\fBsubtype \fIwlan_subtype\fR"
+True if the IEEE 802.11 frame subtype matches the specified \fIwlan_subtype\fR
+and frame has the type to which the specified \fIwlan_subtype\fR belongs.
+.IP "\fBdir \fIdir\fR"
+True if the IEEE 802.11 frame direction matches the specified
+.IR dir .
+Valid directions are:
+.BR nods ,
+.BR tods ,
+.BR fromds ,
+.BR dstods ,
+or a numeric value.
+.IP "\fBvlan \fI[vlan_id]\fR"
+True if the packet is an IEEE 802.1Q VLAN packet.
+If \fI[vlan_id]\fR is specified, only true if the packet has the specified
+\fIvlan_id\fR.
+Note that the first \fBvlan\fR keyword encountered in \fIexpression\fR
+changes the decoding offsets for the remainder of \fIexpression\fR on
+the assumption that the packet is a VLAN packet.  The \fBvlan
+\fI[vlan_id]\fR expression may be used more than once, to filter on VLAN
+hierarchies.  Each use of that expression increments the filter offsets
+by 4.
+.IP
+For example:
+.in +.5i
+.nf
+\fBvlan 100 && vlan 200\fR
+.fi
+.in -.5i
+filters on VLAN 200 encapsulated within VLAN 100, and
+.in +.5i
+.nf
+\fBvlan && vlan 300 && ip\fR
+.fi
+.in -.5i
+filters IPv4 protocols encapsulated in VLAN 300 encapsulated within any
+higher order VLAN.
+.IP "\fBmpls \fI[label_num]\fR"
+True if the packet is an MPLS packet.
+If \fI[label_num]\fR is specified, only true is the packet has the specified
+\fIlabel_num\fR.
+Note that the first \fBmpls\fR keyword encountered in \fIexpression\fR
+changes the decoding offsets for the remainder of \fIexpression\fR on
+the assumption that the packet is a MPLS-encapsulated IP packet.  The
+\fBmpls \fI[label_num]\fR expression may be used more than once, to
+filter on MPLS hierarchies.  Each use of that expression increments the
+filter offsets by 4. 
+.IP
+For example:
+.in +.5i
+.nf
+\fBmpls 100000 && mpls 1024\fR
+.fi
+.in -.5i
+filters packets with an outer label of 100000 and an inner label of
+1024, and
+.in +.5i
+.nf
+\fBmpls && mpls 1024 && host 192.9.200.1\fR
+.fi
+.in -.5i
+filters packets to or from 192.9.200.1 with an inner label of 1024 and
+any outer label.
+.IP \fBpppoed\fP
+True if the packet is a PPP-over-Ethernet Discovery packet (Ethernet
+type 0x8863).
+.IP \fBpppoes\fP
+True if the packet is a PPP-over-Ethernet Session packet (Ethernet
+type 0x8864).
+Note that the first \fBpppoes\fR keyword encountered in \fIexpression\fR
+changes the decoding offsets for the remainder of \fIexpression\fR on
+the assumption that the packet is a PPPoE session packet.
+.IP
+For example:
+.in +.5i
+.nf
+\fBpppoes && ip\fR
+.fi
+.in -.5i
+filters IPv4 protocols encapsulated in PPPoE.
+.IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBip proto \fIp\fR\fB or ip6 proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP "\fBiso proto \fIprotocol\fR"
+True if the packet is an OSI packet of protocol type \fIprotocol\fP.
+\fIProtocol\fP can be a number or one of the names
+\fBclnp\fP, \fBesis\fP, or \fBisis\fP.
+.IP "\fBclnp\fR, \fBesis\fR, \fBisis\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBiso proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP "\fBl1\fR, \fBl2\fR, \fBiih\fR, \fBlsp\fR, \fBsnp\fR, \fBcsnp\fR, \fBpsnp\fR"
+Abbreviations for IS-IS PDU types.
+.IP "\fBvpi\fP \fIn\fR
+True if the packet is an ATM packet, for SunATM on Solaris, with a
+virtual path identifier of
+.IR n .
+.IP "\fBvci\fP \fIn\fR
+True if the packet is an ATM packet, for SunATM on Solaris, with a
+virtual channel identifier of
+.IR n .
+.IP \fBlane\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+an ATM LANE packet.
+Note that the first \fBlane\fR keyword encountered in \fIexpression\fR
+changes the tests done in the remainder of \fIexpression\fR
+on the assumption that the packet is either a LANE emulated Ethernet
+packet or a LANE LE Control packet.  If \fBlane\fR isn't specified, the
+tests are done under the assumption that the packet is an
+LLC-encapsulated packet.
+.IP \fBllc\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+an LLC-encapsulated packet.
+.IP \fBoamf4s\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+a segment OAM F4 flow cell (VPI=0 & VCI=3).
+.IP \fBoamf4e\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+an end-to-end OAM F4 flow cell (VPI=0 & VCI=4).
+.IP \fBoamf4\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+a segment or end-to-end OAM F4 flow cell (VPI=0 & (VCI=3 | VCI=4)).
+.IP \fBoam\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+a segment or end-to-end OAM F4 flow cell (VPI=0 & (VCI=3 | VCI=4)).
+.IP \fBmetac\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a meta signaling circuit (VPI=0 & VCI=1).
+.IP \fBbcc\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a broadcast signaling circuit (VPI=0 & VCI=2).
+.IP \fBsc\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a signaling circuit (VPI=0 & VCI=5).
+.IP \fBilmic\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on an ILMI circuit (VPI=0 & VCI=16).
+.IP \fBconnectmsg\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect,
+Connect Ack, Release, or Release Done message.
+.IP \fBmetaconnect\fP
+True if the packet is an ATM packet, for SunATM on Solaris, and is
+on a meta signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect,
+Release, or Release Done message.
+.IP  "\fIexpr relop expr\fR"
+True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =,
+!=, and \fIexpr\fR is an arithmetic expression composed of integer
+constants (expressed in standard C syntax), the normal binary operators
+[+, -, *, /, &, |, <<, >>], a length operator, and special packet data
+accessors.  Note that all comparisons are unsigned, so that, for example,
+0x80000000 and 0xffffffff are > 0.
+To access
+data inside the packet, use the following syntax:
+.in +.5i
+.nf
+\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
+.fi
+.in -.5i
+\fIProto\fR is one of \fBether, fddi, tr, wlan, ppp, slip, link,
+ip, arp, rarp, tcp, udp, icmp, ip6\fR or \fBradio\fR, and
+indicates the protocol layer for the index operation.
+(\fBether, fddi, wlan, tr, ppp, slip\fR and \fBlink\fR all refer to the
+link layer. \fBradio\fR refers to the "radio header" added to some
+802.11 captures.)
+Note that \fItcp, udp\fR and other upper-layer protocol types only
+apply to IPv4, not IPv6 (this will be fixed in the future).
+The byte offset, relative to the indicated protocol layer, is
+given by \fIexpr\fR.
+\fISize\fR is optional and indicates the number of bytes in the
+field of interest; it can be either one, two, or four, and defaults to one.
+The length operator, indicated by the keyword \fBlen\fP, gives the
+length of the packet.
+
+For example, `\fBether[0] & 1 != 0\fP' catches all multicast traffic.
+The expression `\fBip[0] & 0xf != 5\fP'
+catches all IPv4 packets with options.
+The expression
+`\fBip[6:2] & 0x1fff = 0\fP'
+catches only unfragmented IPv4 datagrams and frag zero of fragmented
+IPv4 datagrams.
+This check is implicitly applied to the \fBtcp\fP and \fBudp\fP
+index operations.
+For instance, \fBtcp[0]\fP always means the first
+byte of the TCP \fIheader\fP, and never means the first byte of an
+intervening fragment.
+
+Some offsets and field values may be expressed as names rather than
+as numeric values.
+The following protocol header field offsets are
+available: \fBicmptype\fP (ICMP type field), \fBicmpcode\fP (ICMP
+code field), and \fBtcpflags\fP (TCP flags field).
+
+The following ICMP type field values are available: \fBicmp-echoreply\fP,
+\fBicmp-unreach\fP, \fBicmp-sourcequench\fP, \fBicmp-redirect\fP,
+\fBicmp-echo\fP, \fBicmp-routeradvert\fP, \fBicmp-routersolicit\fP,
+\fBicmp-timxceed\fP, \fBicmp-paramprob\fP, \fBicmp-tstamp\fP,
+\fBicmp-tstampreply\fP, \fBicmp-ireq\fP, \fBicmp-ireqreply\fP,
+\fBicmp-maskreq\fP, \fBicmp-maskreply\fP.
+
+The following TCP flags field values are available: \fBtcp-fin\fP,
+\fBtcp-syn\fP, \fBtcp-rst\fP, \fBtcp-push\fP,
+\fBtcp-ack\fP, \fBtcp-urg\fP.
+.LP
+Primitives may be combined using:
+.IP
+A parenthesized group of primitives and operators
+(parentheses are special to the Shell and must be escaped).
+.IP
+Negation (`\fB!\fP' or `\fBnot\fP').
+.IP
+Concatenation (`\fB&&\fP' or `\fBand\fP').
+.IP
+Alternation (`\fB||\fP' or `\fBor\fP').
+.LP
+Negation has highest precedence.
+Alternation and concatenation have equal precedence and associate
+left to right.
+Note that explicit \fBand\fR tokens, not juxtaposition,
+are now required for concatenation.
+.LP
+If an identifier is given without a keyword, the most recent keyword
+is assumed.
+For example,
+.in +.5i
+.nf
+\fBnot host vs and ace\fR
+.fi
+.in -.5i
+is short for
+.in +.5i
+.nf
+\fBnot host vs and host ace\fR
+.fi
+.in -.5i
+which should not be confused with
+.in +.5i
+.nf
+\fBnot ( host vs or ace )\fR
+.fi
+.in -.5i
+.SH EXAMPLES
+.LP
+To select all packets arriving at or departing from \fIsundown\fP:
+.RS
+.nf
+\fBhost sundown\fP
+.fi
+.RE
+.LP
+To select traffic between \fIhelios\fR and either \fIhot\fR or \fIace\fR:
+.RS
+.nf
+\fBhost helios and \\( hot or ace \\)\fP
+.fi
+.RE
+.LP
+To select all IP packets between \fIace\fR and any host except \fIhelios\fR:
+.RS
+.nf
+\fBip host ace and not helios\fP
+.fi
+.RE
+.LP
+To select all traffic between local hosts and hosts at Berkeley:
+.RS
+.nf
+.B
+net ucb-ether
+.fi
+.RE
+.LP
+To select all ftp traffic through internet gateway \fIsnup\fP:
+.RS
+.nf
+.B
+gateway snup and (port ftp or ftp-data)
+.fi
+.RE
+.LP
+To select traffic neither sourced from nor destined for local hosts
+(if you gateway to one other net, this stuff should never make it
+onto your local net).
+.RS
+.nf
+.B
+ip and not net \fIlocalnet\fP
+.fi
+.RE
+.LP
+To select the start and end packets (the SYN and FIN packets) of each
+TCP conversation that involves a non-local host.
+.RS
+.nf
+.B
+tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net \fIlocalnet\fP
+.fi
+.RE
+.LP
+To select all IPv4 HTTP packets to and from port 80, i.e. print only
+packets that contain data, not, for example, SYN and FIN packets and
+ACK-only packets.  (IPv6 is left as an exercise for the reader.)
+.RS
+.nf
+.B
+tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)
+.fi
+.RE
+.LP
+To select IP packets longer than 576 bytes sent through gateway \fIsnup\fP:
+.RS
+.nf
+.B
+gateway snup and ip[2:2] > 576
+.fi
+.RE
+.LP
+To select IP broadcast or multicast packets that were
+.I not
+sent via Ethernet broadcast or multicast:
+.RS
+.nf
+.B
+ether[0] & 1 = 0 and ip[16] >= 224
+.fi
+.RE
+.LP
+To select all ICMP packets that are not echo requests/replies (i.e., not
+ping packets):
+.RS
+.nf
+.B
+icmp[icmptype] != icmp-echo and icmp[icmptype] != icmp-echoreply
+.fi
+.RE
+.SH "SEE ALSO"
+pcap(3PCAP)
+.SH AUTHORS
+The original authors are:
+.LP
+Van Jacobson,
+Craig Leres and
+Steven McCanne, all of the
+Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
+.LP
+It is currently being maintained by tcpdump.org.
+.LP
+The current version of libpcap is available via http:
+.LP
+.RS
+.I http://www.tcpdump.org/
+.RE
+.LP
+The original distribution is available via anonymous ftp:
+.LP
+.RS
+.I ftp://ftp.ee.lbl.gov/tcpdump.tar.Z
+.RE
+.SH BUGS
+Please send problems, bugs, questions, desirable enhancements, etc. to:
+.LP
+.RS
+tcpdump-workers@lists.tcpdump.org
+.RE
+.LP
+Filter expressions on fields other than those in Token Ring headers will
+not correctly handle source-routed Token Ring packets.
+.LP
+Filter expressions on fields other than those in 802.11 headers will not
+correctly handle 802.11 data packets with both To DS and From DS set.
+.LP
+.BR "ip6 proto"
+should chase header chain, but at this moment it does not.
+.BR "ip6 protochain"
+is supplied for this behavior.
+.LP
+Arithmetic expression against transport layer headers, like \fBtcp[0]\fP,
+does not work against IPv6 packets.
+It only looks at IPv4 packets.
diff --git a/contrib/libpcap/pcap-int.h b/contrib/libpcap/pcap-int.h
index aad7369..3a50406 100644
--- a/contrib/libpcap/pcap-int.h
+++ b/contrib/libpcap/pcap-int.h
@@ -31,17 +31,21 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD$
- * @(#) $Header: /tcpdump/master/libpcap/pcap-int.h,v 1.68.2.11 2007/06/22 06:43:58 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-int.h,v 1.85.2.9 2008-09-16 00:21:08 guy Exp $ (LBL)
  */
 
 #ifndef pcap_int_h
-#define pcap_int_h
+#define	pcap_int_h
+
+#include <pcap/pcap.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
-#include <pcap.h>
+#ifdef HAVE_LIBDLPI
+#include <libdlpi.h>
+#endif
 
 #ifdef WIN32
 #include <Packet32.h>
@@ -52,6 +56,23 @@ extern "C" {
 #include <io.h>
 #endif
 
+#if (defined(_MSC_VER) && (_MSC_VER <= 1200)) /* we are compiling with Visual Studio 6, that doesn't support the LL suffix*/
+
+/*
+ * Swap byte ordering of unsigned long long timestamp on a big endian
+ * machine.
+ */
+#define SWAPLL(ull)  ((ull & 0xff00000000000000) >> 56) | \
+                      ((ull & 0x00ff000000000000) >> 40) | \
+                      ((ull & 0x0000ff0000000000) >> 24) | \
+                      ((ull & 0x000000ff00000000) >> 8)  | \
+                      ((ull & 0x00000000ff000000) << 8)  | \
+                      ((ull & 0x0000000000ff0000) << 24) | \
+                      ((ull & 0x000000000000ff00) << 40) | \
+                      ((ull & 0x00000000000000ff) << 56)
+
+#else /* A recent Visual studio compiler or not VC */
+
 /*
  * Swap byte ordering of unsigned long long timestamp on a big endian
  * machine.
@@ -65,6 +86,8 @@ extern "C" {
                       ((ull & 0x000000000000ff00LL) << 40) | \
                       ((ull & 0x00000000000000ffLL) << 56)
 
+#endif /* _MSC_VER */
+
 /*
  * Savefile
  */
@@ -74,16 +97,22 @@ typedef enum {
 	MAYBE_SWAPPED
 } swapped_type_t;
 
+/*
+ * Used when reading a savefile.
+ */
 struct pcap_sf {
 	FILE *rfile;
 	int swapped;
-	int hdrsize;
+	size_t hdrsize;
 	swapped_type_t lengths_swapped;
 	int version_major;
 	int version_minor;
 	u_char *base;
 };
 
+/*
+ * Used when doing a live capture.
+ */
 struct pcap_md {
 	struct pcap_stat stat;
 	/*XXX*/
@@ -94,22 +123,25 @@ struct pcap_md {
 	long	TotMissed;	/* missed by i/f during this run */
 	long	OrigMissed;	/* missed by i/f before this run */
 	char	*device;	/* device name */
+	int	timeout;	/* timeout for buffering */
+	int	must_clear;	/* stuff we must clear when we close */
+	struct pcap *next;	/* list of open pcaps that need stuff cleared on close */
 #ifdef linux
 	int	sock_packet;	/* using Linux 2.0 compatible interface */
-	int	timeout;	/* timeout specified to pcap_open_live */
-	int	clear_promisc;	/* must clear promiscuous mode when we close */
 	int	cooked;		/* using SOCK_DGRAM rather than SOCK_RAW */
 	int	ifindex;	/* interface index of device we're bound to */
 	int	lo_ifindex;	/* interface index of the loopback device */
-	struct pcap *next;	/* list of open promiscuous sock_packet pcaps */
 	u_int	packets_read;	/* count of packets read with recvfrom() */
-#endif
+	bpf_u_int32 oldmode;	/* mode to restore when turning monitor mode off */
+	u_int	tp_version;	/* version of tpacket_hdr for mmaped ring */
+	u_int	tp_hdrlen;	/* hdrlen of tpacket_hdr for mmaped ring */
+#endif /* linux */
 
 #ifdef HAVE_DAG_API
 #ifdef HAVE_DAG_STREAMS_API
 	u_char	*dag_mem_bottom;	/* DAG card current memory bottom pointer */
 	u_char	*dag_mem_top;	/* DAG card current memory top pointer */
-#else
+#else /* HAVE_DAG_STREAMS_API */
 	void	*dag_mem_base;	/* DAG card memory base address */
 	u_int	dag_mem_bottom;	/* DAG card current memory bottom offset */
 	u_int	dag_mem_top;	/* DAG card current memory top offset */
@@ -121,6 +153,41 @@ struct pcap_md {
 				 * Same as in linux above, introduce
 				 * generally? */
 #endif /* HAVE_DAG_API */
+#ifdef HAVE_ZEROCOPY_BPF
+       /*
+        * Zero-copy read buffer -- for zero-copy BPF.  'buffer' above will
+        * alternative between these two actual mmap'd buffers as required.
+        * As there is a header on the front size of the mmap'd buffer, only
+        * some of the buffer is exposed to libpcap as a whole via bufsize;
+        * zbufsize is the true size.  zbuffer tracks the current zbuf
+        * assocated with buffer so that it can be used to decide which the
+        * next buffer to read will be.
+        */
+       u_char *zbuf1, *zbuf2, *zbuffer;
+       u_int zbufsize;
+       u_int zerocopy;
+       u_int interrupted;
+       struct timespec firstsel;
+       /*
+        * If there's currently a buffer being actively processed, then it is
+        * referenced here; 'buffer' is also pointed at it, but offset by the
+        * size of the header.
+        */
+       struct bpf_zbuf_header *bzh;
+#endif /* HAVE_ZEROCOPY_BPF */
+};
+
+/*
+ * Stuff to clear when we close.
+ */
+#define MUST_CLEAR_PROMISC	0x00000001	/* promiscuous mode */
+#define MUST_CLEAR_RFMON	0x00000002	/* rfmon (monitor) mode */
+
+struct pcap_opt {
+	int	buffer_size;
+	char	*source;
+	int	promisc;
+	int	rfmon;
 };
 
 /*
@@ -136,21 +203,44 @@ struct pcap_md {
 #define       PCAP_FDDIPAD 3
 #endif
 
+typedef int	(*activate_op_t)(pcap_t *);
+typedef int	(*can_set_rfmon_op_t)(pcap_t *);
+typedef int	(*read_op_t)(pcap_t *, int cnt, pcap_handler, u_char *);
+typedef int	(*inject_op_t)(pcap_t *, const void *, size_t);
+typedef int	(*setfilter_op_t)(pcap_t *, struct bpf_program *);
+typedef int	(*setdirection_op_t)(pcap_t *, pcap_direction_t);
+typedef int	(*set_datalink_op_t)(pcap_t *, int);
+typedef int	(*getnonblock_op_t)(pcap_t *, char *);
+typedef int	(*setnonblock_op_t)(pcap_t *, int, char *);
+typedef int	(*stats_op_t)(pcap_t *, struct pcap_stat *);
+#ifdef WIN32
+typedef int	(*setbuff_op_t)(pcap_t *, int);
+typedef int	(*setmode_op_t)(pcap_t *, int);
+typedef int	(*setmintocopy_op_t)(pcap_t *, int);
+#endif
+typedef void	(*cleanup_op_t)(pcap_t *);
+
 struct pcap {
 #ifdef WIN32
 	ADAPTER *adapter;
 	LPPACKET Packet;
-	int timeout;
 	int nonblock;
 #else
 	int fd;
 	int selectable_fd;
 	int send_fd;
 #endif /* WIN32 */
+
+#ifdef HAVE_LIBDLPI
+	dlpi_handle_t dlpi_hd;
+#endif
 	int snapshot;
-	int linktype;
+	int linktype;		/* Network linktype */
+	int linktype_ext;       /* Extended information stored in the linktype field of a file */
 	int tzoff;		/* timezone offset */
 	int offset;		/* offset for proper alignment */
+	int activated;		/* true if the capture is really started */
+	int oldstyle;		/* if we're opening with pcap_open_live() */
 
 	int break_loop;		/* flag set to force break from packet-reading loop */
 
@@ -159,12 +249,12 @@ struct pcap {
 #endif
 
 #ifdef MSDOS
-        int inter_packet_wait;   /* offline: wait between packets */
         void (*wait_proc)(void); /*          call proc while waiting */
 #endif
 
 	struct pcap_sf sf;
 	struct pcap_md md;
+	struct pcap_opt opt;
 
 	/*
 	 * Read buffer -- for file descriptor read buffer model.
@@ -209,15 +299,27 @@ struct pcap {
 	/*
 	 * Methods.
 	 */
-	int	(*read_op)(pcap_t *, int cnt, pcap_handler, u_char *);
-	int	(*inject_op)(pcap_t *, const void *, size_t);
-	int	(*setfilter_op)(pcap_t *, struct bpf_program *);
-	int	(*setdirection_op)(pcap_t *, pcap_direction_t);
-	int	(*set_datalink_op)(pcap_t *, int);
-	int	(*getnonblock_op)(pcap_t *, char *);
-	int	(*setnonblock_op)(pcap_t *, int, char *);
-	int	(*stats_op)(pcap_t *, struct pcap_stat *);
-	void	(*close_op)(pcap_t *);
+	activate_op_t activate_op;
+	can_set_rfmon_op_t can_set_rfmon_op;
+	read_op_t read_op;
+	inject_op_t inject_op;
+	setfilter_op_t setfilter_op;
+	setdirection_op_t setdirection_op;
+	set_datalink_op_t set_datalink_op;
+	getnonblock_op_t getnonblock_op;
+	setnonblock_op_t setnonblock_op;
+	stats_op_t stats_op;
+
+#ifdef WIN32
+	/*
+	 * These are, at least currently, specific to the Win32 NPF
+	 * driver.
+	 */
+	setbuff_op_t setbuff_op;
+	setmode_op_t setmode_op;
+	setmintocopy_op_t setmintocopy_op;
+#endif
+	cleanup_op_t cleanup_op;
 
 	/*
 	 * Placeholder for filter code if bpf not in kernel.
@@ -256,8 +358,8 @@ struct pcap_timeval {
  *
  *	introduce a new structure for the new format;
  *
- *	send mail to "tcpdump-workers@tcpdump.org", requesting a new
- *	magic number for your new capture file format, and, when
+ *	send mail to "tcpdump-workers@lists.tcpdump.org", requesting
+ *	a new magic number for your new capture file format, and, when
  *	you get the new magic number, put it in "savefile.c";
  *
  *	use that magic number for save files with the changed record
@@ -267,9 +369,12 @@ struct pcap_timeval {
  *	the old record header as well as files with the new record header
  *	(using the magic number to determine the header format).
  *
- * Then supply the changes to "patches@tcpdump.org", so that future
- * versions of libpcap and programs that use it (such as tcpdump) will
- * be able to read your new capture file format.
+ * Then supply the changes as a patch at
+ *
+ *	http://sourceforge.net/projects/libpcap/
+ *
+ * so that future versions of libpcap and programs that use it (such as
+ * tcpdump) will be able to read your new capture file format.
  */
 
 struct pcap_sf_pkthdr {
@@ -324,7 +429,13 @@ int	pcap_getnonblock_fd(pcap_t *, char *);
 int	pcap_setnonblock_fd(pcap_t *p, int, char *);
 #endif
 
-void	pcap_close_common(pcap_t *);
+pcap_t	*pcap_create_common(const char *, char *);
+int	pcap_do_addexit(pcap_t *);
+void	pcap_add_to_pcaps_to_close(pcap_t *);
+void	pcap_remove_from_pcaps_to_close(pcap_t *);
+void	pcap_cleanup_live_common(pcap_t *);
+int	pcap_not_initialized(pcap_t *);
+int	pcap_check_activated(pcap_t *);
 
 /*
  * Internal interfaces for "pcap_findalldevs()".
diff --git a/contrib/libpcap/pcap-libdlpi.c b/contrib/libpcap/pcap-libdlpi.c
new file mode 100644
index 0000000..b61e8ec
--- /dev/null
+++ b/contrib/libpcap/pcap-libdlpi.c
@@ -0,0 +1,370 @@
+/*
+ * Copyright (c) 1993, 1994, 1995, 1996, 1997
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * This code contributed by Sagun Shakya (sagun.shakya@sun.com)
+ */
+/*
+ * Packet capture routines for DLPI using libdlpi under SunOS 5.11.
+ */
+
+#ifndef lint
+static const char rcsid[] _U_ =
+	"@(#) $Header: /tcpdump/master/libpcap/pcap-libdlpi.c,v 1.1.2.6 2008-04-14 20:41:52 guy Exp $ (LBL)";
+#endif
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <sys/time.h>
+#include <sys/bufmod.h>
+#include <sys/stream.h>
+#include <libdlpi.h>
+#include <errno.h>
+#include <memory.h>
+#include <stropts.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "pcap-int.h"
+#include "dlpisubs.h"
+
+/* Forwards. */
+static int pcap_read_libdlpi(pcap_t *, int, pcap_handler, u_char *);
+static int pcap_inject_libdlpi(pcap_t *, const void *, size_t);
+static void pcap_close_libdlpi(pcap_t *);
+static void pcap_libdlpi_err(const char *, const char *, int, char *);
+
+/*
+ * list_interfaces() will list all the network links that are
+ * available on a system.
+ */
+static boolean_t list_interfaces(const char *, void *);
+
+typedef struct linknamelist {
+	char	linkname[DLPI_LINKNAME_MAX];
+	struct linknamelist *lnl_next;
+} linknamelist_t;
+
+typedef struct linkwalk {
+	linknamelist_t	*lw_list;
+	int		lw_err;
+} linkwalk_t;
+
+/*
+ * The caller of this function should free the memory allocated
+ * for each linknamelist_t "entry" allocated.
+ */
+static boolean_t
+list_interfaces(const char *linkname, void *arg)
+{
+	linkwalk_t	*lwp = arg;
+	linknamelist_t	*entry;
+
+	if ((entry = calloc(1, sizeof(linknamelist_t))) == NULL) {
+		lwp->lw_err = ENOMEM;
+		return (B_TRUE);
+	}
+	(void) strlcpy(entry->linkname, linkname, DLPI_LINKNAME_MAX);
+
+	if (lwp->lw_list == NULL) {
+		lwp->lw_list = entry;
+	} else {
+		entry->lnl_next = lwp->lw_list;
+		lwp->lw_list = entry;
+	}
+
+	return (B_FALSE);
+}
+
+static int
+pcap_activate_libdlpi(pcap_t *p)
+{
+	int retv;
+	dlpi_handle_t dh;
+	dlpi_info_t dlinfo;
+	int err = PCAP_ERROR;
+
+	/*
+	 * Enable Solaris raw and passive DLPI extensions;
+	 * dlpi_open() will not fail if the underlying link does not support
+	 * passive mode. See dlpi(7P) for details.
+	 */
+	retv = dlpi_open(p->opt.source, &dh, DLPI_RAW|DLPI_PASSIVE);
+	if (retv != DLPI_SUCCESS) {
+		if (retv == DLPI_ELINKNAMEINVAL || retv == DLPI_ENOLINK)
+			err = PCAP_ERROR_NO_SUCH_DEVICE;
+		else if (retv == DLPI_SYSERR && errno == EACCES)
+			err = PCAP_ERROR_PERM_DENIED;
+		pcap_libdlpi_err(p->opt.source, "dlpi_open", retv,
+		    p->errbuf);
+		return (err);
+	}
+	p->dlpi_hd = dh;
+
+	if (p->opt.rfmon) {
+		/*
+		 * This device exists, but we don't support monitor mode
+		 * any platforms that support DLPI.
+		 */
+		err = PCAP_ERROR_RFMON_NOTSUP;
+		goto bad;
+	}
+
+	/* Bind with DLPI_ANY_SAP. */
+	if ((retv = dlpi_bind(p->dlpi_hd, DLPI_ANY_SAP, 0)) != DLPI_SUCCESS) {
+		pcap_libdlpi_err(p->opt.source, "dlpi_bind", retv, p->errbuf);
+		goto bad;
+	}
+
+	/* Enable promiscuous mode. */
+	if (p->opt.promisc) {
+		retv = dlpi_promiscon(p->dlpi_hd, DL_PROMISC_PHYS);
+		if (retv != DLPI_SUCCESS) {
+			pcap_libdlpi_err(p->opt.source,
+			    "dlpi_promisc(PHYSICAL)", retv, p->errbuf);
+			goto bad;
+		}
+	} else {
+		/* Try to enable multicast. */
+		retv = dlpi_promiscon(p->dlpi_hd, DL_PROMISC_MULTI);
+		if (retv != DLPI_SUCCESS) {
+			pcap_libdlpi_err(p->opt.source, "dlpi_promisc(MULTI)",
+			    retv, p->errbuf);
+			goto bad;
+		}
+	}
+
+	/* Try to enable SAP promiscuity. */
+	if ((retv = dlpi_promiscon(p->dlpi_hd, DL_PROMISC_SAP)) != DLPI_SUCCESS) {
+		if (!promisc) {
+			pcap_libdlpi_err(p->opt.source, "dlpi_promisc(SAP)",
+			    retv, p->errbuf);
+			goto bad;
+		}
+
+		/* Not fatal, since the DL_PROMISC_PHYS mode worked. */
+		fprintf(stderr, "WARNING: dlpi_promisc(SAP) failed on"
+		    " %s:(%s)\n", p->opt.source, dlpi_strerror(retv));
+	}
+
+	/* Determine link type.  */
+	if ((retv = dlpi_info(p->dlpi_hd, &dlinfo, 0)) != DLPI_SUCCESS) {
+		pcap_libdlpi_err(p->opt.source, "dlpi_info", retv, p->errbuf);
+		goto bad;
+	}
+
+	if (pcap_process_mactype(p, dlinfo.di_mactype) != 0)
+		goto bad;
+
+	p->fd = dlpi_fd(p->dlpi_hd);
+
+	/* Push and configure bufmod. */
+	if (pcap_conf_bufmod(p, snaplen, p->md.timeout) != 0)
+		goto bad;
+
+	/*
+	 * Flush the read side.
+	 */
+	if (ioctl(p->fd, I_FLUSH, FLUSHR) != 0) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "FLUSHR: %s",
+		    pcap_strerror(errno));
+		goto bad;
+	}
+
+	/* Allocate data buffer. */
+	if (pcap_alloc_databuf(p) != 0)
+		goto bad;
+
+	/*
+	 * "p->fd" is a FD for a STREAMS device, so "select()" and
+	 * "poll()" should work on it.
+	 */
+	p->selectable_fd = p->fd;
+
+	p->read_op = pcap_read_libdlpi;
+	p->inject_op = pcap_inject_libdlpi;
+	p->setfilter_op = install_bpf_program;	/* No kernel filtering */
+	p->setdirection_op = NULL;	/* Not implemented */
+	p->set_datalink_op = NULL;	/* Can't change data link type */
+	p->getnonblock_op = pcap_getnonblock_fd;
+	p->setnonblock_op = pcap_setnonblock_fd;
+	p->stats_op = pcap_stats_dlpi;
+	p->cleanup_op = pcap_cleanup_libdlpi;
+
+	return (0);
+bad:
+	pcap_cleanup_libdlpi(p);
+	return (err);
+}
+
+/*
+ * In Solaris, the "standard" mechanism" i.e SIOCGLIFCONF will only find
+ * network links that are plumbed and are up. dlpi_walk(3DLPI) will find
+ * additional network links present in the system.
+ */
+int
+pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
+{
+	int retv = 0;
+
+	linknamelist_t	*entry, *next;
+	linkwalk_t	lw = {NULL, 0};
+	int 		save_errno;
+
+	/* dlpi_walk() for loopback will be added here. */
+
+	dlpi_walk(list_interfaces, &lw, 0);
+
+	if (lw.lw_err != 0) {
+		snprintf(errbuf, PCAP_ERRBUF_SIZE,
+		    "dlpi_walk: %s", pcap_strerror(lw.lw_err));
+		retv = -1;
+		goto done;
+	}
+
+	/* Add linkname if it does not exist on the list. */
+	for (entry = lw.lw_list; entry != NULL; entry = entry->lnl_next) {
+		if (pcap_add_if(alldevsp, entry->linkname, 0, NULL, errbuf) < 0)
+			retv = -1;
+	}
+done:
+	save_errno = errno;
+	for (entry = lw.lw_list; entry != NULL; entry = next) {
+		next = entry->lnl_next;
+		free(entry);
+	}
+	errno = save_errno;
+
+	return (retv);
+}
+
+/*
+ * Read data received on DLPI handle. Returns -2 if told to terminate, else
+ * returns the number of packets read.
+ */
+static int
+pcap_read_libdlpi(pcap_t *p, int count, pcap_handler callback, u_char *user)
+{
+	int len;
+	u_char *bufp;
+	size_t msglen;
+	int retv;
+
+	len = p->cc;
+	if (len != 0) {
+		bufp = p->bp;
+		goto process_pkts;
+	}
+	do {
+		/* Has "pcap_breakloop()" been called? */
+		if (p->break_loop) {
+			/*
+			 * Yes - clear the flag that indicates that it has,
+			 * and return -2 to indicate that we were told to
+			 * break out of the loop.
+			 */
+			p->break_loop = 0;
+			return (-2);
+		}
+
+		msglen = p->bufsize;
+		bufp = p->buffer + p->offset;
+
+		retv = dlpi_recv(p->dlpi_hd, NULL, NULL, bufp,
+		    &msglen, -1, NULL);
+		if (retv != DLPI_SUCCESS) {
+			/*
+			 * This is most likely a call to terminate out of the
+			 * loop. So, do not return an error message, instead
+			 * check if "pcap_breakloop()" has been called above.
+			 */
+			if (retv == DL_SYSERR && errno == EINTR) {
+				len = 0;
+				continue;
+			}
+			pcap_libdlpi_err(dlpi_linkname(p->dlpi_hd),
+			    "dlpi_recv", retv, p->errbuf);
+			return (-1);
+		}
+		len = msglen;
+	} while (len == 0);
+
+process_pkts:
+	return (pcap_process_pkts(p, callback, user, count, bufp, len));
+}
+
+static int
+pcap_inject_libdlpi(pcap_t *p, const void *buf, size_t size)
+{
+	int retv;
+
+	retv = dlpi_send(p->dlpi_hd, NULL, 0, buf, size, NULL);
+	if (retv != DLPI_SUCCESS) {
+		pcap_libdlpi_err(dlpi_linkname(p->dlpi_hd), "dlpi_send", retv,
+		    p->errbuf);
+		return (-1);
+	}
+	/*
+	 * dlpi_send(3DLPI) does not provide a way to return the number of
+	 * bytes sent on the wire. Based on the fact that DLPI_SUCCESS was
+	 * returned we are assuming 'size' bytes were sent.
+	 */
+	return (size);
+}
+
+/*
+ * Close dlpi handle.
+ */
+static void
+pcap_cleanup_libdlpi(pcap_t *p)
+{
+	if (p->dlpi_hd != NULL) {
+		dlpi_close(p->dlpi_hd);
+		p->dlpi_hd = NULL;
+		p->fd = -1;
+	}
+	pcap_cleanup_live_common(p);
+}
+
+/*
+ * Write error message to buffer.
+ */
+static void
+pcap_libdlpi_err(const char *linkname, const char *func, int err, char *errbuf)
+{
+	snprintf(errbuf, PCAP_ERRBUF_SIZE, "libpcap: %s failed on %s: %s",
+	    func, linkname, dlpi_strerror(err));
+}
+
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_libdlpi;
+	return (p);
+}
diff --git a/contrib/libpcap/pcap-linktype.manmisc b/contrib/libpcap/pcap-linktype.manmisc
new file mode 100644
index 0000000..ed9dba4
--- /dev/null
+++ b/contrib/libpcap/pcap-linktype.manmisc
@@ -0,0 +1,282 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap-linktype.manmisc.in,v 1.1.2.4 2008-10-27 22:52:05 guy Exp $
+.\"
+.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP-LINKTYPE 7 "23 October 2008"
+.SH NAME
+pcap-linktype \- link-layer header types supported by libpcap
+.SH DESCRIPTION
+For a live capture or ``savefile'', libpcap supplies, as the return
+value of the
+.BR pcap_datalink (3PCAP)
+routine, a value that indicates the type of link-layer header at the
+beginning of the packets it provides.  This is not necessarily the type
+of link-layer header that the packets being captured have on the network
+from which they're being captured; for example, packets from an IEEE
+802.11 network might be provided by libpcap with Ethernet headers that
+the network adapter or the network adapter driver generates from the
+802.11 headers.  The names for those values begin with
+.BR DLT_ ,
+so they are sometimes called "DLT_ values".
+.PP
+The values stored in the link-layer header type field in the savefile
+header are, in most but not all cases, the same as the values returned
+by
+.BR pcap_datalink() .
+The names for those values begin with
+.BR LINKTYPE_ .
+.PP
+The link-layer header types supported by libpcap are listed here.  The
+value corresponding to
+.B LINKTYPE_
+names are given; the value corresponding to
+.B DLT_
+values are, in some cases, platform dependent, and are not given;
+applications should check for particular
+.B DLT_
+values by name.
+.RS 5
+.TP 5
+.BR DLT_NULL "; " LINKTYPE_NULL = 0
+BSD loopback encapsulation; the link layer header is a 4-byte field, in
+.I host
+byte order, containing a PF_ value from
+.B socket.h
+for the network-layer protocol of the packet.
+.IP
+Note that ``host byte order'' is the byte order of the machine on which
+the packets are captured, and the PF_ values are for the OS of the
+machine on which the packets are captured; if a live capture is being
+done, ``host byte order'' is the byte order of the machine capturing the
+packets, and the PF_ values are those of the OS of the machine capturing
+the packets, but if a ``savefile'' is being read, the byte order and PF_
+values are
+.I not
+necessarily those of the machine reading the capture file.
+.TP 5
+.BR DLT_EN10MB "; " LINKTYPE_ETHERNET = 1
+Ethernet (10Mb, 100Mb, 1000Mb, and up); the
+.B 10MB
+in the
+.B DLT_
+name is historical.
+.TP 5
+.BR DLT_IEEE802 "; " LINKTYPE_TOKEN_RING = 6
+IEEE 802.5 Token Ring; the
+.B IEEE802
+in the
+.B DLT_
+name is historical.
+.TP 5
+.BR DLT_ARCNET "; " LINKTYPE_ARCNET = 7
+ARCNET
+.TP 5
+.BR DLT_SLIP "; " LINKTYPE_SLIP = 8
+SLIP; the link layer header contains, in order:
+.RS 10
+.LP
+a 1-byte flag, which is 0 for packets received by the machine and 1 for
+packets sent by the machine;
+.LP
+a 1-byte field, the upper 4 bits of which indicate the type of packet,
+as per RFC 1144:
+.RS 5
+.TP 5
+0x40
+an unmodified IP datagram (TYPE_IP);
+.TP 5
+0x70
+an uncompressed-TCP IP datagram (UNCOMPRESSED_TCP), with that byte being
+the first byte of the raw IP header on the wire, containing the
+connection number in the protocol field;
+.TP 5
+0x80
+a compressed-TCP IP datagram (COMPRESSED_TCP), with that byte being the
+first byte of the compressed TCP/IP datagram header;
+.RE
+.LP
+for UNCOMPRESSED_TCP, the rest of the modified IP header, and for
+COMPRESSED_TCP, the compressed TCP/IP datagram header;
+.RE
+.RS 5
+.LP
+for a total of 16 bytes; the uncompressed IP datagram follows the header.
+.RE
+.TP 5
+.BR DLT_PPP "; " LINKTYPE_PPP = 9
+PPP; if the first 2 bytes are 0xff and 0x03, it's PPP in HDLC-like
+framing, with the PPP header following those two bytes, otherwise it's
+PPP without framing, and the packet begins with the PPP header.
+.TP 5
+.BR DLT_FDDI "; " LINKTYPE_FDDI = 10
+FDDI
+.TP 5
+.BR DLT_ATM_RFC1483 "; " LINKTYPE_ATM_RFC1483 = 100
+RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an IEEE 802.2
+LLC header.
+.TP 5
+.BR DLT_RAW "; " LINKTYPE_RAW = 101
+raw IP; the packet begins with an IP header.
+.TP 5
+.BR DLT_PPP_SERIAL "; " LINKTYPE_PPP_HDLC = 50
+PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC
+framing, as per section 4.3.1 of RFC 1547; the first byte will be 0xFF
+for PPP in HDLC-like framing, and will be 0x0F or 0x8F for Cisco PPP
+with HDLC framing.
+.TP 5
+.BR DLT_PPP_ETHER "; " LINKTYPE_PPP_ETHER = 51
+PPPoE; the packet begins with a PPPoE header, as per RFC 2516.
+.TP 5
+.BR DLT_C_HDLC "; " LINKTYPE_C_HDLC = 104
+Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.
+.TP 5
+.BR DLT_IEEE802_11 "; " LINKTYPE_IEEE802_11 = 105
+IEEE 802.11 wireless LAN
+.TP 5
+.BR DLT_FRELAY "; " LINKTYPE_FRELAY = 107
+Frame Relay
+.TP 5
+.BR DLT_LOOP "; " LINKTYPE_LOOP = 108
+OpenBSD loopback encapsulation; the link layer header is a 4-byte field, in
+.I network
+byte order, containing a PF_ value from OpenBSD's
+.B socket.h
+for the network-layer protocol of the packet.
+.IP
+Note that, if a ``savefile'' is being read, those PF_ values are
+.I not
+necessarily those of the machine reading the capture file.
+.TP 5
+.BR DLT_LINUX_SLL "; " LINKTYPE_LINUX_SLL = 113
+Linux "cooked" capture encapsulation; the link layer header contains, in
+order:
+.RS 10
+.LP
+a 2-byte "packet type", in network byte order, which is one of:
+.RS 5
+.TP 5
+0
+packet was sent to us by somebody else
+.TP 5
+1
+packet was broadcast by somebody else
+.TP 5
+2
+packet was multicast, but not broadcast, by somebody else
+.TP 5
+3
+packet was sent by somebody else to somebody else
+.TP 5
+4
+packet was sent by us
+.RE
+.LP
+a 2-byte field, in network byte order, containing a Linux ARPHRD_ value
+for the link layer device type;
+.LP
+a 2-byte field, in network byte order, containing the length of the
+link layer address of the sender of the packet (which could be 0);
+.LP
+an 8-byte field containing that number of bytes of the link layer header
+(if there are more than 8 bytes, only the first 8 are present);
+.LP
+a 2-byte field containing an Ethernet protocol type, in network byte
+order, or containing 1 for Novell 802.3 frames without an 802.2 LLC
+header or 4 for frames beginning with an 802.2 LLC header.
+.RE
+.TP 5
+.BR DLT_LTALK "; " LINKTYPE_LTALK = 104
+Apple LocalTalk; the packet begins with an AppleTalk LLAP header.
+.TP 5
+.BR DLT_PFLOG "; " LINKTYPE_PFLOG = 117
+OpenBSD pflog; the link layer header contains a
+.B "struct pfloghdr"
+structure, as defined by the host on which the file was saved.  (This
+differs from operating system to operating system and release to
+release; there is nothing in the file to indicate what the layout of
+that structure is.)
+.TP 5
+.BR DLT_PRISM_HEADER "; " LINKTYPE_PRISM_HEADER = 119
+Prism monitor mode information followed by an 802.11 header.
+.TP 5
+.BR DLT_IP_OVER_FC "; " LINKTYPE_IP_OVER_FC = 122
+RFC 2625 IP-over-Fibre Channel, with the link-layer header being the
+Network_Header as described in that RFC.
+.TP 5
+.BR DLT_SUNATM "; " LINKTYPE_SUNATM = 123
+SunATM devices; the link layer header contains, in order:
+.RS 10
+.LP
+a 1-byte flag field, containing a direction flag in the uppermost bit,
+which is set for packets transmitted by the machine and clear for
+packets received by the machine, and a 4-byte traffic type in the
+low-order 4 bits, which is one of:
+.RS 5
+.TP 5
+0
+raw traffic
+.TP 5
+1
+LANE traffic
+.TP 5
+2
+LLC-encapsulated traffic
+.TP 5
+3
+MARS traffic
+.TP 5
+4
+IFMP traffic
+.TP 5
+5
+ILMI traffic
+.TP 5
+6
+Q.2931 traffic
+.RE
+.LP
+a 1-byte VPI value;
+.LP
+a 2-byte VCI field, in network byte order.
+.RE
+.TP 5
+.BR DLT_IEEE802_11_RADIO "; " LINKTYPE_IEEE802_11_RADIO = 127
+link-layer information followed by an 802.11 header - see
+http://www.shaftnet.org/~pizza/software/capturefrm.txt for a description
+of the link-layer information.
+.TP 5
+.BR DLT_ARCNET_LINUX "; " LINKTYPE_ARCNET_LINUX = 129
+ARCNET, with no exception frames, reassembled packets rather than raw
+frames, and an extra 16-bit offset field between the destination host
+and type bytes.
+.TP 5
+.BR DLT_LINUX_IRDA "; " LINKTYPE_LINUX_IRDA = 144
+Linux-IrDA packets, with a
+.B DLT_LINUX_SLL
+header followed by the IrLAP header.
+.TP 5
+.BR DLT_LINUX_LAPD "; " LINKTYPE_LINUX_LAPD = 177
+LAPD (Q.921) frames, with a
+.B DLT_LINUX_SLL
+header captured via vISDN.
+.RE
+.SH SEE ALSO
+pcap_datalink(3PCAP)
diff --git a/contrib/libpcap/pcap-linktype.manmisc.in b/contrib/libpcap/pcap-linktype.manmisc.in
new file mode 100644
index 0000000..7d33b7f
--- /dev/null
+++ b/contrib/libpcap/pcap-linktype.manmisc.in
@@ -0,0 +1,282 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap-linktype.manmisc.in,v 1.1.2.4 2008-10-27 22:52:05 guy Exp $
+.\"
+.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP-LINKTYPE @MAN_MISC_INFO@ "23 October 2008"
+.SH NAME
+pcap-linktype \- link-layer header types supported by libpcap
+.SH DESCRIPTION
+For a live capture or ``savefile'', libpcap supplies, as the return
+value of the
+.BR pcap_datalink (3PCAP)
+routine, a value that indicates the type of link-layer header at the
+beginning of the packets it provides.  This is not necessarily the type
+of link-layer header that the packets being captured have on the network
+from which they're being captured; for example, packets from an IEEE
+802.11 network might be provided by libpcap with Ethernet headers that
+the network adapter or the network adapter driver generates from the
+802.11 headers.  The names for those values begin with
+.BR DLT_ ,
+so they are sometimes called "DLT_ values".
+.PP
+The values stored in the link-layer header type field in the savefile
+header are, in most but not all cases, the same as the values returned
+by
+.BR pcap_datalink() .
+The names for those values begin with
+.BR LINKTYPE_ .
+.PP
+The link-layer header types supported by libpcap are listed here.  The
+value corresponding to
+.B LINKTYPE_
+names are given; the value corresponding to
+.B DLT_
+values are, in some cases, platform dependent, and are not given;
+applications should check for particular
+.B DLT_
+values by name.
+.RS 5
+.TP 5
+.BR DLT_NULL "; " LINKTYPE_NULL = 0
+BSD loopback encapsulation; the link layer header is a 4-byte field, in
+.I host
+byte order, containing a PF_ value from
+.B socket.h
+for the network-layer protocol of the packet.
+.IP
+Note that ``host byte order'' is the byte order of the machine on which
+the packets are captured, and the PF_ values are for the OS of the
+machine on which the packets are captured; if a live capture is being
+done, ``host byte order'' is the byte order of the machine capturing the
+packets, and the PF_ values are those of the OS of the machine capturing
+the packets, but if a ``savefile'' is being read, the byte order and PF_
+values are
+.I not
+necessarily those of the machine reading the capture file.
+.TP 5
+.BR DLT_EN10MB "; " LINKTYPE_ETHERNET = 1
+Ethernet (10Mb, 100Mb, 1000Mb, and up); the
+.B 10MB
+in the
+.B DLT_
+name is historical.
+.TP 5
+.BR DLT_IEEE802 "; " LINKTYPE_TOKEN_RING = 6
+IEEE 802.5 Token Ring; the
+.B IEEE802
+in the
+.B DLT_
+name is historical.
+.TP 5
+.BR DLT_ARCNET "; " LINKTYPE_ARCNET = 7
+ARCNET
+.TP 5
+.BR DLT_SLIP "; " LINKTYPE_SLIP = 8
+SLIP; the link layer header contains, in order:
+.RS 10
+.LP
+a 1-byte flag, which is 0 for packets received by the machine and 1 for
+packets sent by the machine;
+.LP
+a 1-byte field, the upper 4 bits of which indicate the type of packet,
+as per RFC 1144:
+.RS 5
+.TP 5
+0x40
+an unmodified IP datagram (TYPE_IP);
+.TP 5
+0x70
+an uncompressed-TCP IP datagram (UNCOMPRESSED_TCP), with that byte being
+the first byte of the raw IP header on the wire, containing the
+connection number in the protocol field;
+.TP 5
+0x80
+a compressed-TCP IP datagram (COMPRESSED_TCP), with that byte being the
+first byte of the compressed TCP/IP datagram header;
+.RE
+.LP
+for UNCOMPRESSED_TCP, the rest of the modified IP header, and for
+COMPRESSED_TCP, the compressed TCP/IP datagram header;
+.RE
+.RS 5
+.LP
+for a total of 16 bytes; the uncompressed IP datagram follows the header.
+.RE
+.TP 5
+.BR DLT_PPP "; " LINKTYPE_PPP = 9
+PPP; if the first 2 bytes are 0xff and 0x03, it's PPP in HDLC-like
+framing, with the PPP header following those two bytes, otherwise it's
+PPP without framing, and the packet begins with the PPP header.
+.TP 5
+.BR DLT_FDDI "; " LINKTYPE_FDDI = 10
+FDDI
+.TP 5
+.BR DLT_ATM_RFC1483 "; " LINKTYPE_ATM_RFC1483 = 100
+RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an IEEE 802.2
+LLC header.
+.TP 5
+.BR DLT_RAW "; " LINKTYPE_RAW = 101
+raw IP; the packet begins with an IP header.
+.TP 5
+.BR DLT_PPP_SERIAL "; " LINKTYPE_PPP_HDLC = 50
+PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC
+framing, as per section 4.3.1 of RFC 1547; the first byte will be 0xFF
+for PPP in HDLC-like framing, and will be 0x0F or 0x8F for Cisco PPP
+with HDLC framing.
+.TP 5
+.BR DLT_PPP_ETHER "; " LINKTYPE_PPP_ETHER = 51
+PPPoE; the packet begins with a PPPoE header, as per RFC 2516.
+.TP 5
+.BR DLT_C_HDLC "; " LINKTYPE_C_HDLC = 104
+Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.
+.TP 5
+.BR DLT_IEEE802_11 "; " LINKTYPE_IEEE802_11 = 105
+IEEE 802.11 wireless LAN
+.TP 5
+.BR DLT_FRELAY "; " LINKTYPE_FRELAY = 107
+Frame Relay
+.TP 5
+.BR DLT_LOOP "; " LINKTYPE_LOOP = 108
+OpenBSD loopback encapsulation; the link layer header is a 4-byte field, in
+.I network
+byte order, containing a PF_ value from OpenBSD's
+.B socket.h
+for the network-layer protocol of the packet.
+.IP
+Note that, if a ``savefile'' is being read, those PF_ values are
+.I not
+necessarily those of the machine reading the capture file.
+.TP 5
+.BR DLT_LINUX_SLL "; " LINKTYPE_LINUX_SLL = 113
+Linux "cooked" capture encapsulation; the link layer header contains, in
+order:
+.RS 10
+.LP
+a 2-byte "packet type", in network byte order, which is one of:
+.RS 5
+.TP 5
+0
+packet was sent to us by somebody else
+.TP 5
+1
+packet was broadcast by somebody else
+.TP 5
+2
+packet was multicast, but not broadcast, by somebody else
+.TP 5
+3
+packet was sent by somebody else to somebody else
+.TP 5
+4
+packet was sent by us
+.RE
+.LP
+a 2-byte field, in network byte order, containing a Linux ARPHRD_ value
+for the link layer device type;
+.LP
+a 2-byte field, in network byte order, containing the length of the
+link layer address of the sender of the packet (which could be 0);
+.LP
+an 8-byte field containing that number of bytes of the link layer header
+(if there are more than 8 bytes, only the first 8 are present);
+.LP
+a 2-byte field containing an Ethernet protocol type, in network byte
+order, or containing 1 for Novell 802.3 frames without an 802.2 LLC
+header or 4 for frames beginning with an 802.2 LLC header.
+.RE
+.TP 5
+.BR DLT_LTALK "; " LINKTYPE_LTALK = 104
+Apple LocalTalk; the packet begins with an AppleTalk LLAP header.
+.TP 5
+.BR DLT_PFLOG "; " LINKTYPE_PFLOG = 117
+OpenBSD pflog; the link layer header contains a
+.B "struct pfloghdr"
+structure, as defined by the host on which the file was saved.  (This
+differs from operating system to operating system and release to
+release; there is nothing in the file to indicate what the layout of
+that structure is.)
+.TP 5
+.BR DLT_PRISM_HEADER "; " LINKTYPE_PRISM_HEADER = 119
+Prism monitor mode information followed by an 802.11 header.
+.TP 5
+.BR DLT_IP_OVER_FC "; " LINKTYPE_IP_OVER_FC = 122
+RFC 2625 IP-over-Fibre Channel, with the link-layer header being the
+Network_Header as described in that RFC.
+.TP 5
+.BR DLT_SUNATM "; " LINKTYPE_SUNATM = 123
+SunATM devices; the link layer header contains, in order:
+.RS 10
+.LP
+a 1-byte flag field, containing a direction flag in the uppermost bit,
+which is set for packets transmitted by the machine and clear for
+packets received by the machine, and a 4-byte traffic type in the
+low-order 4 bits, which is one of:
+.RS 5
+.TP 5
+0
+raw traffic
+.TP 5
+1
+LANE traffic
+.TP 5
+2
+LLC-encapsulated traffic
+.TP 5
+3
+MARS traffic
+.TP 5
+4
+IFMP traffic
+.TP 5
+5
+ILMI traffic
+.TP 5
+6
+Q.2931 traffic
+.RE
+.LP
+a 1-byte VPI value;
+.LP
+a 2-byte VCI field, in network byte order.
+.RE
+.TP 5
+.BR DLT_IEEE802_11_RADIO "; " LINKTYPE_IEEE802_11_RADIO = 127
+link-layer information followed by an 802.11 header - see
+http://www.shaftnet.org/~pizza/software/capturefrm.txt for a description
+of the link-layer information.
+.TP 5
+.BR DLT_ARCNET_LINUX "; " LINKTYPE_ARCNET_LINUX = 129
+ARCNET, with no exception frames, reassembled packets rather than raw
+frames, and an extra 16-bit offset field between the destination host
+and type bytes.
+.TP 5
+.BR DLT_LINUX_IRDA "; " LINKTYPE_LINUX_IRDA = 144
+Linux-IrDA packets, with a
+.B DLT_LINUX_SLL
+header followed by the IrLAP header.
+.TP 5
+.BR DLT_LINUX_LAPD "; " LINKTYPE_LINUX_LAPD = 177
+LAPD (Q.921) frames, with a
+.B DLT_LINUX_SLL
+header captured via vISDN.
+.RE
+.SH SEE ALSO
+pcap_datalink(3PCAP)
diff --git a/contrib/libpcap/pcap-linux.c b/contrib/libpcap/pcap-linux.c
index e9db010..8161af0 100644
--- a/contrib/libpcap/pcap-linux.c
+++ b/contrib/libpcap/pcap-linux.c
@@ -23,11 +23,18 @@
  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
  *  IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  *  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ *  Modifications:     Added PACKET_MMAP support
+ *                     Paolo Abeni <paolo.abeni@email.it> 
+ *                     
+ *                     based on previous works of:
+ *                     Simon Patarin <patarin@cs.unibo.it>
+ *                     Phil Wood <cpw@lanl.gov>
  */
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110.2.14 2006/10/12 17:26:58 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.129.2.29 2008-10-28 00:50:39 guy Exp $ (LBL)";
 #endif
 
 /*
@@ -77,17 +84,6 @@ static const char rcsid[] _U_ =
 #include "config.h"
 #endif
 
-#include "pcap-int.h"
-#include "sll.h"
-
-#ifdef HAVE_DAG_API
-#include "pcap-dag.h"
-#endif /* HAVE_DAG_API */
-
-#ifdef HAVE_SEPTEL_API
-#include "pcap-septel.h"
-#endif /* HAVE_SEPTEL_API */
-	  
 #include <errno.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -96,10 +92,39 @@ static const char rcsid[] _U_ =
 #include <sys/socket.h>
 #include <sys/ioctl.h>
 #include <sys/utsname.h>
+#include <sys/mman.h>
 #include <net/if.h>
 #include <netinet/in.h>
 #include <linux/if_ether.h>
 #include <net/if_arp.h>
+#include <poll.h>
+
+/*
+ * Got Wireless Extensions?
+ */
+#ifdef HAVE_LINUX_WIRELESS_H
+#include <linux/wireless.h>
+#endif
+
+#include "pcap-int.h"
+#include "pcap/sll.h"
+#include "pcap/vlan.h"
+
+#ifdef HAVE_DAG_API
+#include "pcap-dag.h"
+#endif /* HAVE_DAG_API */
+
+#ifdef HAVE_SEPTEL_API
+#include "pcap-septel.h"
+#endif /* HAVE_SEPTEL_API */
+
+#ifdef PCAP_SUPPORT_USB
+#include "pcap-usb-linux.h"
+#endif
+
+#ifdef PCAP_SUPPORT_BT
+#include "pcap-bt-linux.h"
+#endif
 
 /*
  * If PF_PACKET is defined, we can use {SOCK_RAW,SOCK_DGRAM}/PF_PACKET
@@ -141,7 +166,23 @@ static const char rcsid[] _U_ =
   */
 # ifdef PACKET_HOST
 #  define HAVE_PF_PACKET_SOCKETS
+#  ifdef PACKET_AUXDATA
+#   define HAVE_PACKET_AUXDATA
+#  endif /* PACKET_AUXDATA */
 # endif /* PACKET_HOST */
+
+
+ /* check for memory mapped access avaibility. We assume every needed 
+  * struct is defined if the macro TPACKET_HDRLEN is defined, because it
+  * uses many ring related structs and macros */
+# ifdef TPACKET_HDRLEN
+#  define HAVE_PACKET_RING
+#  ifdef TPACKET2_HDRLEN
+#   define HAVE_TPACKET2
+#  else
+#   define TPACKET_V1	0
+#  endif /* TPACKET2_HDRLEN */
+# endif /* TPACKET_HDRLEN */
 #endif /* PF_PACKET */
 
 #ifdef SO_ATTACH_FILTER
@@ -149,7 +190,7 @@ static const char rcsid[] _U_ =
 #include <linux/filter.h>
 #endif
 
-#ifndef __GLIBC__
+#ifndef HAVE_SOCKLEN_T
 typedef int		socklen_t;
 #endif
 
@@ -185,18 +226,43 @@ typedef int		socklen_t;
 #define BIGGER_THAN_ALL_MTUS	(64*1024)
 
 /*
- * Prototypes for internal functions
+ * Prototypes for internal functions and methods.
  */
 static void map_arphrd_to_dlt(pcap_t *, int, int);
-static int live_open_old(pcap_t *, const char *, int, int, char *);
-static int live_open_new(pcap_t *, const char *, int, int, char *);
+#ifdef HAVE_PF_PACKET_SOCKETS
+static short int map_packet_type_to_sll_type(short int);
+#endif
+static int pcap_activate_linux(pcap_t *);
+static int activate_old(pcap_t *);
+static int activate_new(pcap_t *);
+static int activate_mmap(pcap_t *);
+static int pcap_can_set_rfmon_linux(pcap_t *);
 static int pcap_read_linux(pcap_t *, int, pcap_handler, u_char *);
 static int pcap_read_packet(pcap_t *, pcap_handler, u_char *);
 static int pcap_inject_linux(pcap_t *, const void *, size_t);
 static int pcap_stats_linux(pcap_t *, struct pcap_stat *);
 static int pcap_setfilter_linux(pcap_t *, struct bpf_program *);
 static int pcap_setdirection_linux(pcap_t *, pcap_direction_t);
-static void pcap_close_linux(pcap_t *);
+static void pcap_cleanup_linux(pcap_t *);
+
+union thdr {
+	struct tpacket_hdr	*h1;
+	struct tpacket2_hdr	*h2;
+	void			*raw;
+};
+
+#ifdef HAVE_PACKET_RING
+#define RING_GET_FRAME(h) (((union thdr **)h->buffer)[h->offset])
+
+static void destroy_ring(pcap_t *handle);
+static int create_ring(pcap_t *handle);
+static int prepare_tpacket_socket(pcap_t *handle);
+static void pcap_cleanup_linux_mmap(pcap_t *);
+static int pcap_read_linux_mmap(pcap_t *, int, pcap_handler , u_char *);
+static int pcap_setfilter_linux_mmap(pcap_t *, struct bpf_program *);
+static int pcap_setnonblock_mmap(pcap_t *p, int nonblock, char *errbuf);
+static int pcap_getnonblock_mmap(pcap_t *p, char *errbuf);
+#endif
 
 /*
  * Wrap some ioctl calls
@@ -208,6 +274,9 @@ static int	iface_get_mtu(int fd, const char *device, char *ebuf);
 static int 	iface_get_arptype(int fd, const char *device, char *ebuf);
 #ifdef HAVE_PF_PACKET_SOCKETS
 static int 	iface_bind(int fd, int ifindex, char *ebuf);
+static int	has_wext(int sock_fd, const char *device, char *ebuf);
+static int	enter_rfmon_mode_wext(pcap_t *handle, int sock_fd,
+    const char *device);
 #endif
 static int 	iface_bind_old(int fd, const char *device, char *ebuf);
 
@@ -223,52 +292,230 @@ static struct sock_fprog	total_fcode
 	= { 1, &total_insn };
 #endif
 
-/*
- *  Get a handle for a live capture from the given device. You can
- *  pass NULL as device to get all packages (without link level
- *  information of course). If you pass 1 as promisc the interface
- *  will be set to promiscous mode (XXX: I think this usage should
- *  be deprecated and functions be added to select that later allow
- *  modification of that values -- Torsten).
- *
- *  See also pcap(3).
- */
 pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+pcap_create(const char *device, char *ebuf)
 {
-	pcap_t		*handle;
-	int		mtu;
-	int		err;
-	int		live_open_ok = 0;
-	struct utsname	utsname;
+	pcap_t *handle;
 
 #ifdef HAVE_DAG_API
 	if (strstr(device, "dag")) {
-		return dag_open_live(device, snaplen, promisc, to_ms, ebuf);
+		return dag_create(device, ebuf);
 	}
 #endif /* HAVE_DAG_API */
 
 #ifdef HAVE_SEPTEL_API
 	if (strstr(device, "septel")) {
-		return septel_open_live(device, snaplen, promisc, to_ms, ebuf);
+		return septel_create(device, ebuf);
 	}
 #endif /* HAVE_SEPTEL_API */
 
-	/* Allocate a handle for this session. */
+#ifdef PCAP_SUPPORT_BT
+	if (strstr(device, "bluetooth")) {
+		return bt_create(device, ebuf);
+	}
+#endif
 
-	handle = malloc(sizeof(*handle));
-	if (handle == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
-			 pcap_strerror(errno));
+#ifdef PCAP_SUPPORT_USB
+	if (strstr(device, "usb")) {
+		return usb_create(device, ebuf);
+	}
+#endif
+
+	handle = pcap_create_common(device, ebuf);
+	if (handle == NULL)
 		return NULL;
+
+	handle->activate_op = pcap_activate_linux;
+	handle->can_set_rfmon_op = pcap_can_set_rfmon_linux;
+	return handle;
+}
+
+static int
+pcap_can_set_rfmon_linux(pcap_t *p)
+{
+#ifdef IW_MODE_MONITOR
+	int sock_fd;
+	struct iwreq ireq;
+#endif
+
+	if (p->opt.source == NULL) {
+		/*
+		 * This is equivalent to the "any" device, and we don't
+		 * support monitor mode on it.
+		 */
+		return 0;
 	}
 
-	/* Initialize some components of the pcap structure. */
+#ifdef IW_MODE_MONITOR
+	/*
+	 * Bleah.  There doesn't appear to be an ioctl to use to ask
+	 * whether a device supports monitor mode; we'll just do
+	 * SIOCGIWMODE and, if it succeeds, assume the device supports
+	 * monitor mode.
+	 *
+	 * Open a socket on which to attempt to get the mode.
+	 * (We assume that if we have Wireless Extensions support
+	 * we also have PF_PACKET support.)
+	 */
+	sock_fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
+	if (sock_fd == -1) {
+		(void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+		    "socket: %s", pcap_strerror(errno));
+		return PCAP_ERROR;
+	}
 
-	memset(handle, 0, sizeof(*handle));
-	handle->snapshot	= snaplen;
-	handle->md.timeout	= to_ms;
+	/*
+	 * Attempt to get the current mode.
+	 */
+	strncpy(ireq.ifr_ifrn.ifrn_name, p->opt.source,
+	    sizeof ireq.ifr_ifrn.ifrn_name);
+	ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+	if (ioctl(sock_fd, SIOCGIWMODE, &ireq) != -1) {
+		/*
+		 * Well, we got the mode; assume we can set it.
+		 */
+		close(sock_fd);
+		return 1;
+	}
+	if (errno == ENODEV) {
+		/* The device doesn't even exist. */
+		close(sock_fd);
+		return PCAP_ERROR_NO_SUCH_DEVICE;
+	}
+	close(sock_fd);
+#endif
+	return 0;
+}
+
+/*
+ * With older kernels promiscuous mode is kind of interesting because we
+ * have to reset the interface before exiting. The problem can't really
+ * be solved without some daemon taking care of managing usage counts.
+ * If we put the interface into promiscuous mode, we set a flag indicating
+ * that we must take it out of that mode when the interface is closed,
+ * and, when closing the interface, if that flag is set we take it out
+ * of promiscuous mode.
+ *
+ * Even with newer kernels, we have the same issue with rfmon mode.
+ */
+
+static void	pcap_cleanup_linux( pcap_t *handle )
+{
+	struct ifreq	ifr;
+#ifdef IW_MODE_MONITOR
+	struct iwreq ireq;
+#endif
+
+	if (handle->md.must_clear != 0) {
+		/*
+		 * There's something we have to do when closing this
+		 * pcap_t.
+		 */
+		if (handle->md.must_clear & MUST_CLEAR_PROMISC) {
+			/*
+			 * We put the interface into promiscuous mode;
+			 * take it out of promiscuous mode.
+			 *
+			 * XXX - if somebody else wants it in promiscuous
+			 * mode, this code cannot know that, so it'll take
+			 * it out of promiscuous mode.  That's not fixable
+			 * in 2.0[.x] kernels.
+			 */
+			memset(&ifr, 0, sizeof(ifr));
+			strncpy(ifr.ifr_name, handle->md.device,
+			    sizeof(ifr.ifr_name));
+			if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
+				fprintf(stderr,
+				    "Can't restore interface flags (SIOCGIFFLAGS failed: %s).\n"
+				    "Please adjust manually.\n"
+				    "Hint: This can't happen with Linux >= 2.2.0.\n",
+				    strerror(errno));
+			} else {
+				if (ifr.ifr_flags & IFF_PROMISC) {
+					/*
+					 * Promiscuous mode is currently on;
+					 * turn it off.
+					 */
+					ifr.ifr_flags &= ~IFF_PROMISC;
+					if (ioctl(handle->fd, SIOCSIFFLAGS,
+					    &ifr) == -1) {
+						fprintf(stderr,
+						    "Can't restore interface flags (SIOCSIFFLAGS failed: %s).\n"
+						    "Please adjust manually.\n"
+						    "Hint: This can't happen with Linux >= 2.2.0.\n",
+						    strerror(errno));
+					}
+				}
+			}
+		}
+
+#ifdef IW_MODE_MONITOR
+		if (handle->md.must_clear & MUST_CLEAR_RFMON) {
+			/*
+			 * We put the interface into rfmon mode;
+			 * take it out of rfmon mode.
+			 *
+			 * XXX - if somebody else wants it in rfmon
+			 * mode, this code cannot know that, so it'll take
+			 * it out of rfmon mode.
+			 */
+			strncpy(ireq.ifr_ifrn.ifrn_name, handle->md.device,
+			    sizeof ireq.ifr_ifrn.ifrn_name);
+			ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1]
+			    = 0;
+			ireq.u.mode = handle->md.oldmode;
+			if (ioctl(handle->fd, SIOCSIWMODE, &ireq) == -1) {
+				/*
+				 * Scientist, you've failed.
+				 */
+				fprintf(stderr,
+				    "Can't restore interface wireless mode (SIOCSIWMODE failed: %s).\n"
+				    "Please adjust manually.\n",
+				    strerror(errno));
+			}
+		}
+#endif
+
+		/*
+		 * Take this pcap out of the list of pcaps for which we
+		 * have to take the interface out of some mode.
+		 */
+		pcap_remove_from_pcaps_to_close(handle);
+	}
+
+	if (handle->md.device != NULL) {
+		free(handle->md.device);
+		handle->md.device = NULL;
+	}
+	pcap_cleanup_live_common(handle);
+}
+
+/*
+ *  Get a handle for a live capture from the given device. You can
+ *  pass NULL as device to get all packages (without link level
+ *  information of course). If you pass 1 as promisc the interface
+ *  will be set to promiscous mode (XXX: I think this usage should
+ *  be deprecated and functions be added to select that later allow
+ *  modification of that values -- Torsten).
+ */
+static int
+pcap_activate_linux(pcap_t *handle)
+{
+	const char	*device;
+	int		status = 0;
+	int		activate_ok = 0;
+
+	device = handle->opt.source;
+
+	handle->inject_op = pcap_inject_linux;
+	handle->setfilter_op = pcap_setfilter_linux;
+	handle->setdirection_op = pcap_setdirection_linux;
+	handle->set_datalink_op = NULL;	/* can't change data link type */
+	handle->getnonblock_op = pcap_getnonblock_fd;
+	handle->setnonblock_op = pcap_setnonblock_fd;
+	handle->cleanup_op = pcap_cleanup_linux;
+	handle->read_op = pcap_read_linux;
+	handle->stats_op = pcap_stats_linux;
 
 	/*
 	 * NULL and "any" are special devices which give us the hint to
@@ -277,21 +524,21 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	if (!device || strcmp(device, "any") == 0) {
 		device			= NULL;
 		handle->md.device	= strdup("any");
-		if (promisc) {
-			promisc = 0;
+		if (handle->opt.promisc) {
+			handle->opt.promisc = 0;
 			/* Just a warning. */
-			snprintf(ebuf, PCAP_ERRBUF_SIZE,
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 			    "Promiscuous mode not supported on the \"any\" device");
+			status = PCAP_WARNING_PROMISC_NOTSUP;
 		}
 
 	} else
 		handle->md.device	= strdup(device);
 
 	if (handle->md.device == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "strdup: %s",
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
 			 pcap_strerror(errno) );
-		free(handle);
-		return NULL;
+		return PCAP_ERROR;
 	}
 
 	/*
@@ -304,118 +551,50 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * trying both methods with the newer method preferred.
 	 */
 
-	if ((err = live_open_new(handle, device, promisc, to_ms, ebuf)) == 1)
-		live_open_ok = 1;
-	else if (err == 0) {
+	if ((status = activate_new(handle)) == 1) {
+		activate_ok = 1;
+		/*
+		 * Try to use memory-mapped access.
+		 */
+		if (activate_mmap(handle) == 1)
+			return 0;	/* we succeeded; nothing more to do */
+	}
+	else if (status == 0) {
 		/* Non-fatal error; try old way */
-		if (live_open_old(handle, device, promisc, to_ms, ebuf))
-			live_open_ok = 1;
+		if ((status = activate_old(handle)) == 1)
+			activate_ok = 1;
 	}
-	if (!live_open_ok) {
+	if (!activate_ok) {
 		/*
 		 * Both methods to open the packet socket failed. Tidy
 		 * up and report our failure (ebuf is expected to be
 		 * set by the functions above).
 		 */
-
-		if (handle->md.device != NULL)
-			free(handle->md.device);
-		free(handle);
-		return NULL;
+		goto fail;
 	}
 
-	/*
-	 * Compute the buffer size.
-	 *
-	 * If we're using SOCK_PACKET, this might be a 2.0[.x] kernel,
-	 * and might require special handling - check.
-	 */
-	if (handle->md.sock_packet && (uname(&utsname) < 0 ||
-	    strncmp(utsname.release, "2.0", 3) == 0)) {
+	if (handle->opt.buffer_size != 0) {
 		/*
-		 * We're using a SOCK_PACKET structure, and either
-		 * we couldn't find out what kernel release this is,
-		 * or it's a 2.0[.x] kernel.
-		 *
-		 * In the 2.0[.x] kernel, a "recvfrom()" on
-		 * a SOCK_PACKET socket, with MSG_TRUNC set, will
-		 * return the number of bytes read, so if we pass
-		 * a length based on the snapshot length, it'll
-		 * return the number of bytes from the packet
-		 * copied to userland, not the actual length
-		 * of the packet.
-		 *
-		 * This means that, for example, the IP dissector
-		 * in tcpdump will get handed a packet length less
-		 * than the length in the IP header, and will
-		 * complain about "truncated-ip".
-		 *
-		 * So we don't bother trying to copy from the
-		 * kernel only the bytes in which we're interested,
-		 * but instead copy them all, just as the older
-		 * versions of libpcap for Linux did.
-		 *
-		 * The buffer therefore needs to be big enough to
-		 * hold the largest packet we can get from this
-		 * device.  Unfortunately, we can't get the MRU
-		 * of the network; we can only get the MTU.  The
-		 * MTU may be too small, in which case a packet larger
-		 * than the buffer size will be truncated *and* we
-		 * won't get the actual packet size.
-		 *
-		 * However, if the snapshot length is larger than
-		 * the buffer size based on the MTU, we use the
-		 * snapshot length as the buffer size, instead;
-		 * this means that with a sufficiently large snapshot
-		 * length we won't artificially truncate packets
-		 * to the MTU-based size.
-		 *
-		 * This mess just one of many problems with packet
-		 * capture on 2.0[.x] kernels; you really want a
-		 * 2.2[.x] or later kernel if you want packet capture
-		 * to work well.
+		 * Set the socket buffer size to the specified value.
 		 */
-		mtu = iface_get_mtu(handle->fd, device, ebuf);
-		if (mtu == -1) {
-			pcap_close_linux(handle);
-			free(handle);
-			return NULL;
-		}
-		handle->bufsize = MAX_LINKHEADER_SIZE + mtu;
-		if (handle->bufsize < handle->snapshot)
-			handle->bufsize = handle->snapshot;
-	} else {
-		/*
-		 * This is a 2.2[.x] or later kernel (we know that
-		 * either because we're not using a SOCK_PACKET
-		 * socket - PF_PACKET is supported only in 2.2
-		 * and later kernels - or because we checked the
-		 * kernel version).
-		 *
-		 * We can safely pass "recvfrom()" a byte count
-		 * based on the snapshot length.
-		 *
-		 * If we're in cooked mode, make the snapshot length
-		 * large enough to hold a "cooked mode" header plus
-		 * 1 byte of packet data (so we don't pass a byte
-		 * count of 0 to "recvfrom()").
-		 */
-		if (handle->md.cooked) {
-			if (handle->snapshot < SLL_HDR_LEN + 1)
-				handle->snapshot = SLL_HDR_LEN + 1;
+		if (setsockopt(handle->fd, SOL_SOCKET, SO_RCVBUF,
+		    &handle->opt.buffer_size,
+		    sizeof(handle->opt.buffer_size)) == -1) {
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				 "SO_RCVBUF: %s", pcap_strerror(errno));
+			status = PCAP_ERROR;
+			goto fail;
 		}
-		handle->bufsize = handle->snapshot;
 	}
 
 	/* Allocate the buffer */
 
 	handle->buffer	 = malloc(handle->bufsize + handle->offset);
 	if (!handle->buffer) {
-	        snprintf(ebuf, PCAP_ERRBUF_SIZE,
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 			 "malloc: %s", pcap_strerror(errno));
-		pcap_close_linux(handle);
-		free(handle);
-		return NULL;
+		status = PCAP_ERROR;
+		goto fail;
 	}
 
 	/*
@@ -424,17 +603,11 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 */
 	handle->selectable_fd = handle->fd;
 
-	handle->read_op = pcap_read_linux;
-	handle->inject_op = pcap_inject_linux;
-	handle->setfilter_op = pcap_setfilter_linux;
-	handle->setdirection_op = pcap_setdirection_linux;
-	handle->set_datalink_op = NULL;	/* can't change data link type */
-	handle->getnonblock_op = pcap_getnonblock_fd;
-	handle->setnonblock_op = pcap_setnonblock_fd;
-	handle->stats_op = pcap_stats_linux;
-	handle->close_op = pcap_close_linux;
+	return status;
 
-	return handle;
+fail:
+	pcap_cleanup_linux(handle);
+	return status;
 }
 
 /*
@@ -468,7 +641,17 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 #else
 	struct sockaddr		from;
 #endif
+#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
+	struct iovec		iov;
+	struct msghdr		msg;
+	struct cmsghdr		*cmsg;
+	union {
+		struct cmsghdr	cmsg;
+		char		buf[CMSG_SPACE(sizeof(struct tpacket_auxdata))];
+	} cmsg_buf;
+#else /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
 	socklen_t		fromlen;
+#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
 	int			packet_len, caplen;
 	struct pcap_pkthdr	pcap_header;
 
@@ -489,9 +672,36 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 	offset = 0;
 #endif
 
-	/* Receive a single packet from the kernel */
-
+	/*
+	 * Receive a single packet from the kernel.
+	 * We ignore EINTR, as that might just be due to a signal
+	 * being delivered - if the signal should interrupt the
+	 * loop, the signal handler should call pcap_breakloop()
+	 * to set handle->break_loop (we ignore it on other
+	 * platforms as well).
+	 * We also ignore ENETDOWN, so that we can continue to
+	 * capture traffic if the interface goes down and comes
+	 * back up again; comments in the kernel indicate that
+	 * we'll just block waiting for packets if we try to
+	 * receive from a socket that delivered ENETDOWN, and,
+	 * if we're using a memory-mapped buffer, we won't even
+	 * get notified of "network down" events.
+	 */
 	bp = handle->buffer + handle->offset;
+
+#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
+	msg.msg_name		= &from;
+	msg.msg_namelen		= sizeof(from);
+	msg.msg_iov		= &iov;
+	msg.msg_iovlen		= 1;
+	msg.msg_control		= &cmsg_buf;
+	msg.msg_controllen	= sizeof(cmsg_buf);
+	msg.msg_flags		= 0;
+
+	iov.iov_len		= handle->bufsize - offset;
+	iov.iov_base		= bp + offset;
+#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
+
 	do {
 		/*
 		 * Has "pcap_breakloop()" been called?
@@ -505,12 +715,17 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 			handle->break_loop = 0;
 			return -2;
 		}
+
+#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
+		packet_len = recvmsg(handle->fd, &msg, MSG_TRUNC);
+#else /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
 		fromlen = sizeof(from);
 		packet_len = recvfrom(
 			handle->fd, bp + offset,
 			handle->bufsize - offset, MSG_TRUNC,
 			(struct sockaddr *) &from, &fromlen);
-	} while (packet_len == -1 && errno == EINTR);
+#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
+	} while (packet_len == -1 && (errno == EINTR || errno == ENETDOWN));
 
 	/* Check if an error occured */
 
@@ -518,7 +733,7 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 		if (errno == EAGAIN)
 			return 0;	/* no packet there */
 		else {
-			snprintf(handle->errbuf, sizeof(handle->errbuf),
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 				 "recvfrom: %s", pcap_strerror(errno));
 			return -1;
 		}
@@ -586,51 +801,46 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 		packet_len += SLL_HDR_LEN;
 
 		hdrp = (struct sll_header *)bp;
+		hdrp->sll_pkttype = map_packet_type_to_sll_type(from.sll_pkttype);
+		hdrp->sll_hatype = htons(from.sll_hatype);
+		hdrp->sll_halen = htons(from.sll_halen);
+		memcpy(hdrp->sll_addr, from.sll_addr,
+		    (from.sll_halen > SLL_ADDRLEN) ?
+		      SLL_ADDRLEN :
+		      from.sll_halen);
+		hdrp->sll_protocol = from.sll_protocol;
+	}
 
-		/*
-		 * Map the PACKET_ value to a LINUX_SLL_ value; we
-		 * want the same numerical value to be used in
-		 * the link-layer header even if the numerical values
-		 * for the PACKET_ #defines change, so that programs
-		 * that look at the packet type field will always be
-		 * able to handle DLT_LINUX_SLL captures.
-		 */
-		switch (from.sll_pkttype) {
+#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
+	for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+		struct tpacket_auxdata *aux;
+		unsigned int len;
+		struct vlan_tag *tag;
 
-		case PACKET_HOST:
-			hdrp->sll_pkttype = htons(LINUX_SLL_HOST);
-			break;
+		if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct tpacket_auxdata)) ||
+		    cmsg->cmsg_level != SOL_PACKET ||
+		    cmsg->cmsg_type != PACKET_AUXDATA)
+			continue;
 
-		case PACKET_BROADCAST:
-			hdrp->sll_pkttype = htons(LINUX_SLL_BROADCAST);
-			break;
+		aux = (struct tpacket_auxdata *)CMSG_DATA(cmsg);
+		if (aux->tp_vlan_tci == 0)
+			continue;
 
-		case PACKET_MULTICAST:
-			hdrp->sll_pkttype = htons(LINUX_SLL_MULTICAST);
+		len = packet_len > iov.iov_len ? iov.iov_len : packet_len;
+		if (len < 2 * ETH_ALEN)
 			break;
 
-		case PACKET_OTHERHOST:
-			hdrp->sll_pkttype = htons(LINUX_SLL_OTHERHOST);
-			break;
+		bp -= VLAN_TAG_LEN;
+		memmove(bp, bp + VLAN_TAG_LEN, 2 * ETH_ALEN);
 
-		case PACKET_OUTGOING:
-			hdrp->sll_pkttype = htons(LINUX_SLL_OUTGOING);
-			break;
+		tag = (struct vlan_tag *)(bp + 2 * ETH_ALEN);
+		tag->vlan_tpid = htons(ETH_P_8021Q);
+		tag->vlan_tci = htons(aux->tp_vlan_tci);
 
-		default:
-			hdrp->sll_pkttype = -1;
-			break;
-		}
-
-		hdrp->sll_hatype = htons(from.sll_hatype);
-		hdrp->sll_halen = htons(from.sll_halen);
-		memcpy(hdrp->sll_addr, from.sll_addr,
-		    (from.sll_halen > SLL_ADDRLEN) ?
-		      SLL_ADDRLEN :
-		      from.sll_halen);
-		hdrp->sll_protocol = from.sll_protocol;
+		packet_len += VLAN_TAG_LEN;
 	}
-#endif
+#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
+#endif /* HAVE_PF_PACKET_SOCKETS */
 
 	/*
 	 * XXX: According to the kernel source we should get the real
@@ -681,7 +891,7 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 	/* Fill in our own header data */
 
 	if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) {
-		snprintf(handle->errbuf, sizeof(handle->errbuf),
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 			 "SIOCGSTAMP: %s", pcap_strerror(errno));
 		return -1;
 	}
@@ -915,6 +1125,16 @@ pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
 		return (-1);
 #endif /* HAVE_SEPTEL_API */
 
+#ifdef PCAP_SUPPORT_BT
+	if (bt_platform_finddevs(alldevsp, errbuf) < 0)
+		return (-1);
+#endif
+
+#ifdef PCAP_SUPPORT_USB
+	if (usb_platform_finddevs(alldevsp, errbuf) < 0)
+		return (-1);
+#endif
+
 	return (0);
 }
 
@@ -934,7 +1154,7 @@ pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter)
 		return -1;
 	if (!filter) {
 	        strncpy(handle->errbuf, "setfilter: No filter specified",
-			sizeof(handle->errbuf));
+			PCAP_ERRBUF_SIZE);
 		return -1;
 	}
 
@@ -1072,11 +1292,47 @@ pcap_setdirection_linux(pcap_t *handle, pcap_direction_t d)
 	 * We're not using PF_PACKET sockets, so we can't determine
 	 * the direction of the packet.
 	 */
-	snprintf(handle->errbuf, sizeof(handle->errbuf),
+	snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 	    "Setting direction is not supported on SOCK_PACKET sockets");
 	return -1;
 }
 
+
+#ifdef HAVE_PF_PACKET_SOCKETS
+/*
+ * Map the PACKET_ value to a LINUX_SLL_ value; we
+ * want the same numerical value to be used in
+ * the link-layer header even if the numerical values
+ * for the PACKET_ #defines change, so that programs
+ * that look at the packet type field will always be
+ * able to handle DLT_LINUX_SLL captures.
+ */
+static short int
+map_packet_type_to_sll_type(short int sll_pkttype)
+{
+	switch (sll_pkttype) {
+
+	case PACKET_HOST:
+		return htons(LINUX_SLL_HOST);
+
+	case PACKET_BROADCAST:
+		return htons(LINUX_SLL_BROADCAST);
+
+	case PACKET_MULTICAST:
+		return  htons(LINUX_SLL_MULTICAST);
+
+	case PACKET_OTHERHOST:
+		return htons(LINUX_SLL_OTHERHOST);
+
+	case PACKET_OUTGOING:
+		return htons(LINUX_SLL_OUTGOING);
+
+	default:
+		return -1;
+	}
+}
+#endif
+
 /*
  *  Linux uses the ARP hardware type to identify the type of an
  *  interface. pcap uses the DLT_xxx constants for this. This
@@ -1113,7 +1369,7 @@ static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok)
 		 * XXX - are there any sorts of "fake Ethernet" that have
 		 * ARPHRD_ETHER but that *shouldn't offer DLT_DOCSIS as
 		 * a Cisco CMTS won't put traffic onto it or get traffic
-		 * bridged onto it?  ISDN is handled in "live_open_new()",
+		 * bridged onto it?  ISDN is handled in "activate_new()",
 		 * as we fall back on cooked mode there; are there any
 		 * others?
 		 */
@@ -1139,7 +1395,7 @@ static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok)
 		break;
 
 	case ARPHRD_AX25:
-		handle->linktype = DLT_AX25;
+		handle->linktype = DLT_AX25_KISS;
 		break;
 
 	case ARPHRD_PRONET:
@@ -1371,6 +1627,17 @@ static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok)
 		handle->linktype = DLT_LINUX_LAPD;
 		break;
 
+#ifndef ARPHRD_NONE
+#define ARPHRD_NONE	0xFFFE
+#endif
+	case ARPHRD_NONE:
+		/*
+		 * No link-layer header; packets are just IP
+		 * packets, so use DLT_RAW.
+		 */
+		handle->linktype = DLT_RAW;
+		break;
+
 	default:
 		handle->linktype = -1;
 		break;
@@ -1380,218 +1647,265 @@ static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok)
 /* ===== Functions to interface to the newer kernels ================== */
 
 /*
- *  Try to open a packet socket using the new kernel interface.
- *  Returns 0 on failure.
- *  FIXME: 0 uses to mean success (Sebastian)
+ * Try to open a packet socket using the new kernel PF_PACKET interface.
+ * Returns 1 on success, 0 on an error that means the new interface isn't
+ * present (so the old SOCK_PACKET interface should be tried), and a
+ * PCAP_ERROR_ value on an error that means that the old mechanism won't
+ * work either (so it shouldn't be tried).
  */
 static int
-live_open_new(pcap_t *handle, const char *device, int promisc,
-	      int to_ms, char *ebuf)
+activate_new(pcap_t *handle)
 {
 #ifdef HAVE_PF_PACKET_SOCKETS
-	int			sock_fd = -1, arptype;
-	int			err;
-	int			fatal_err = 0;
+	int			sock_fd = -1, arptype, val;
+	int			err = 0;
 	struct packet_mreq	mr;
+	const char* device = handle->opt.source;
 
-	/* One shot loop used for error handling - bail out with break */
-
-	do {
-		/*
-		 * Open a socket with protocol family packet. If a device is
-		 * given we try to open it in raw mode otherwise we use
-		 * the cooked interface.
-		 */
-		sock_fd = device ?
-			socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))
-		      : socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL));
-
-		if (sock_fd == -1) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "socket: %s",
-				 pcap_strerror(errno) );
-			break;
-		}
+	/*
+	 * Open a socket with protocol family packet. If a device is
+	 * given we try to open it in raw mode otherwise we use
+	 * the cooked interface.
+	 */
+	sock_fd = device ?
+		socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))
+	      : socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL));
 
-		/* It seems the kernel supports the new interface. */
-		handle->md.sock_packet = 0;
+	if (sock_fd == -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "socket: %s",
+			 pcap_strerror(errno) );
+		return 0;	/* try old mechanism */
+	}
 
-		/*
-		 * Get the interface index of the loopback device.
-		 * If the attempt fails, don't fail, just set the
-		 * "md.lo_ifindex" to -1.
-		 *
-		 * XXX - can there be more than one device that loops
-		 * packets back, i.e. devices other than "lo"?  If so,
-		 * we'd need to find them all, and have an array of
-		 * indices for them, and check all of them in
-		 * "pcap_read_packet()".
-		 */
-		handle->md.lo_ifindex = iface_get_id(sock_fd, "lo", ebuf);
+	/* It seems the kernel supports the new interface. */
+	handle->md.sock_packet = 0;
 
-		/*
-		 * Default value for offset to align link-layer payload
-		 * on a 4-byte boundary.
-		 */
-		handle->offset	 = 0;
+	/*
+	 * Get the interface index of the loopback device.
+	 * If the attempt fails, don't fail, just set the
+	 * "md.lo_ifindex" to -1.
+	 *
+	 * XXX - can there be more than one device that loops
+	 * packets back, i.e. devices other than "lo"?  If so,
+	 * we'd need to find them all, and have an array of
+	 * indices for them, and check all of them in
+	 * "pcap_read_packet()".
+	 */
+	handle->md.lo_ifindex = iface_get_id(sock_fd, "lo", handle->errbuf);
 
-		/*
-		 * What kind of frames do we have to deal with? Fall back
-		 * to cooked mode if we have an unknown interface type.
-		 */
+	/*
+	 * Default value for offset to align link-layer payload
+	 * on a 4-byte boundary.
+	 */
+	handle->offset	 = 0;
 
-		if (device) {
-			/* Assume for now we don't need cooked mode. */
-			handle->md.cooked = 0;
+	/*
+	 * What kind of frames do we have to deal with? Fall back
+	 * to cooked mode if we have an unknown interface type
+	 * or a type we know doesn't work well in raw mode.
+	 */
+	if (device) {
+		/* Assume for now we don't need cooked mode. */
+		handle->md.cooked = 0;
 
-			arptype	= iface_get_arptype(sock_fd, device, ebuf);
-			if (arptype == -1) {
-				fatal_err = 1;
-				break;
+		if (handle->opt.rfmon) {
+			/*
+			 * We were asked to turn on monitor mode.
+			 * Do so before we get the link-layer type,
+			 * because entering monitor mode could change
+			 * the link-layer type.
+			 */
+			err = enter_rfmon_mode_wext(handle, sock_fd, device);
+			if (err < 0) {
+				/* Hard failure */
+				close(sock_fd);
+				return err;
 			}
-			map_arphrd_to_dlt(handle, arptype, 1);
-			if (handle->linktype == -1 ||
-			    handle->linktype == DLT_LINUX_SLL ||
-			    handle->linktype == DLT_LINUX_IRDA ||
-			    handle->linktype == DLT_LINUX_LAPD ||
-			    (handle->linktype == DLT_EN10MB &&
-			     (strncmp("isdn", device, 4) == 0 ||
-			      strncmp("isdY", device, 4) == 0))) {
+			if (err == 0) {
 				/*
-				 * Unknown interface type (-1), or a
-				 * device we explicitly chose to run
-				 * in cooked mode (e.g., PPP devices),
-				 * or an ISDN device (whose link-layer
-				 * type we can only determine by using
-				 * APIs that may be different on different
-				 * kernels) - reopen in cooked mode.
+				 * Nothing worked for turning monitor mode
+				 * on.
 				 */
-				if (close(sock_fd) == -1) {
-					snprintf(ebuf, PCAP_ERRBUF_SIZE,
-						 "close: %s", pcap_strerror(errno));
-					break;
-				}
-				sock_fd = socket(PF_PACKET, SOCK_DGRAM,
-						 htons(ETH_P_ALL));
-				if (sock_fd == -1) {
-					snprintf(ebuf, PCAP_ERRBUF_SIZE,
-						 "socket: %s", pcap_strerror(errno));
-					break;
-				}
-				handle->md.cooked = 1;
+				close(sock_fd);
+				return PCAP_ERROR_RFMON_NOTSUP;
+			}
+		}
+		arptype	= iface_get_arptype(sock_fd, device, handle->errbuf);
+		if (arptype < 0) {
+			close(sock_fd);
+			return arptype;
+		}
+		map_arphrd_to_dlt(handle, arptype, 1);
+		if (handle->linktype == -1 ||
+		    handle->linktype == DLT_LINUX_SLL ||
+		    handle->linktype == DLT_LINUX_IRDA ||
+		    handle->linktype == DLT_LINUX_LAPD ||
+		    (handle->linktype == DLT_EN10MB &&
+		     (strncmp("isdn", device, 4) == 0 ||
+		      strncmp("isdY", device, 4) == 0))) {
+			/*
+			 * Unknown interface type (-1), or a
+			 * device we explicitly chose to run
+			 * in cooked mode (e.g., PPP devices),
+			 * or an ISDN device (whose link-layer
+			 * type we can only determine by using
+			 * APIs that may be different on different
+			 * kernels) - reopen in cooked mode.
+			 */
+			if (close(sock_fd) == -1) {
+				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+					 "close: %s", pcap_strerror(errno));
+				return PCAP_ERROR;
+			}
+			sock_fd = socket(PF_PACKET, SOCK_DGRAM,
+			    htons(ETH_P_ALL));
+			if (sock_fd == -1) {
+				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				    "socket: %s", pcap_strerror(errno));
+				return PCAP_ERROR;
+			}
+			handle->md.cooked = 1;
+
+			/*
+			 * Get rid of any link-layer type list
+			 * we allocated - this only supports cooked
+			 * capture.
+			 */
+			if (handle->dlt_list != NULL) {
+				free(handle->dlt_list);
+				handle->dlt_list = NULL;
+				handle->dlt_count = 0;
+			}
 
+			if (handle->linktype == -1) {
 				/*
-				 * Get rid of any link-layer type list
-				 * we allocated - this only supports cooked
-				 * capture.
+				 * Warn that we're falling back on
+				 * cooked mode; we may want to
+				 * update "map_arphrd_to_dlt()"
+				 * to handle the new type.
 				 */
-				if (handle->dlt_list != NULL) {
-					free(handle->dlt_list);
-					handle->dlt_list = NULL;
-					handle->dlt_count = 0;
-				}
-
-				if (handle->linktype == -1) {
-					/*
-					 * Warn that we're falling back on
-					 * cooked mode; we may want to
-					 * update "map_arphrd_to_dlt()"
-					 * to handle the new type.
-					 */
-					snprintf(ebuf, PCAP_ERRBUF_SIZE,
-						"arptype %d not "
-						"supported by libpcap - "
-						"falling back to cooked "
-						"socket",
-						arptype);
-				}
-				/* IrDA capture is not a real "cooked" capture,
-				 * it's IrLAP frames, not IP packets. */
-				if (handle->linktype != DLT_LINUX_IRDA &&
-			    		handle->linktype != DLT_LINUX_LAPD)
-					handle->linktype = DLT_LINUX_SLL;
+				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+					"arptype %d not "
+					"supported by libpcap - "
+					"falling back to cooked "
+					"socket",
+					arptype);
 			}
 
-			handle->md.ifindex = iface_get_id(sock_fd, device, ebuf);
-			if (handle->md.ifindex == -1)
-				break;
-
-			if ((err = iface_bind(sock_fd, handle->md.ifindex,
-			    ebuf)) < 0) {
-				if (err == -2)
-					fatal_err = 1;
-				break;
-			}
-		} else {
 			/*
-			 * This is cooked mode.
+			 * IrDA capture is not a real "cooked" capture,
+			 * it's IrLAP frames, not IP packets.  The
+			 * same applies to LAPD capture.
 			 */
-			handle->md.cooked = 1;
-			handle->linktype = DLT_LINUX_SLL;
+			if (handle->linktype != DLT_LINUX_IRDA &&
+			    handle->linktype != DLT_LINUX_LAPD)
+				handle->linktype = DLT_LINUX_SLL;
+		}
 
-			/*
-			 * We're not bound to a device.
-			 * XXX - true?  Or true only if we're using
-			 * the "any" device?
-			 * For now, we're using this as an indication
-			 * that we can't transmit; stop doing that only
-			 * if we figure out how to transmit in cooked
-			 * mode.
-			 */
-			handle->md.ifindex = -1;
+		handle->md.ifindex = iface_get_id(sock_fd, device,
+		    handle->errbuf);
+		if (handle->md.ifindex == -1) {
+			close(sock_fd);
+			return PCAP_ERROR;
 		}
 
+		if ((err = iface_bind(sock_fd, handle->md.ifindex,
+		    handle->errbuf)) != 1) {
+		    	close(sock_fd);
+			if (err < 0)
+				return err;
+			else
+				return 0;	/* try old mechanism */
+		}
+	} else {
 		/*
-		 * Select promiscuous mode on if "promisc" is set.
-		 *
-		 * Do not turn allmulti mode on if we don't select
-		 * promiscuous mode - on some devices (e.g., Orinoco
-		 * wireless interfaces), allmulti mode isn't supported
-		 * and the driver implements it by turning promiscuous
-		 * mode on, and that screws up the operation of the
-		 * card as a normal networking interface, and on no
-		 * other platform I know of does starting a non-
-		 * promiscuous capture affect which multicast packets
-		 * are received by the interface.
+		 * This is cooked mode.
 		 */
+		handle->md.cooked = 1;
+		handle->linktype = DLT_LINUX_SLL;
 
 		/*
-		 * Hmm, how can we set promiscuous mode on all interfaces?
-		 * I am not sure if that is possible at all.
+		 * We're not bound to a device.
+		 * XXX - true?  Or true only if we're using
+		 * the "any" device?
+		 * For now, we're using this as an indication
+		 * that we can't transmit; stop doing that only
+		 * if we figure out how to transmit in cooked
+		 * mode.
 		 */
+		handle->md.ifindex = -1;
+	}
 
-		if (device && promisc) {
-			memset(&mr, 0, sizeof(mr));
-			mr.mr_ifindex = handle->md.ifindex;
-			mr.mr_type    = PACKET_MR_PROMISC;
-			if (setsockopt(sock_fd, SOL_PACKET,
-				PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) == -1)
-			{
-				snprintf(ebuf, PCAP_ERRBUF_SIZE,
-					"setsockopt: %s", pcap_strerror(errno));
-				break;
-			}
-		}
+	/*
+	 * Select promiscuous mode on if "promisc" is set.
+	 *
+	 * Do not turn allmulti mode on if we don't select
+	 * promiscuous mode - on some devices (e.g., Orinoco
+	 * wireless interfaces), allmulti mode isn't supported
+	 * and the driver implements it by turning promiscuous
+	 * mode on, and that screws up the operation of the
+	 * card as a normal networking interface, and on no
+	 * other platform I know of does starting a non-
+	 * promiscuous capture affect which multicast packets
+	 * are received by the interface.
+	 */
 
-		/* Save the socket FD in the pcap structure */
+	/*
+	 * Hmm, how can we set promiscuous mode on all interfaces?
+	 * I am not sure if that is possible at all.
+	 */
 
-		handle->fd 	 = sock_fd;
+	if (device && handle->opt.promisc) {
+		memset(&mr, 0, sizeof(mr));
+		mr.mr_ifindex = handle->md.ifindex;
+		mr.mr_type    = PACKET_MR_PROMISC;
+		if (setsockopt(sock_fd, SOL_PACKET, PACKET_ADD_MEMBERSHIP,
+		    &mr, sizeof(mr)) == -1) {
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				"setsockopt: %s", pcap_strerror(errno));
+			close(sock_fd);
+			return PCAP_ERROR;
+		}
+	}
 
-		return 1;
+	/* Enable auxillary data if supported and reserve room for
+	 * reconstructing VLAN headers. */
+#ifdef HAVE_PACKET_AUXDATA
+	val = 1;
+	if (setsockopt(sock_fd, SOL_PACKET, PACKET_AUXDATA, &val,
+		       sizeof(val)) == -1 && errno != ENOPROTOOPT) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "setsockopt: %s", pcap_strerror(errno));
+		close(sock_fd);
+		return PCAP_ERROR;
+	}
+	handle->offset += VLAN_TAG_LEN;
+#endif /* HAVE_PACKET_AUXDATA */
 
-	} while(0);
+	/*
+	 * This is a 2.2[.x] or later kernel (we know that
+	 * because we're not using a SOCK_PACKET socket -
+	 * PF_PACKET is supported only in 2.2 and later
+	 * kernels).
+	 *
+	 * We can safely pass "recvfrom()" a byte count
+	 * based on the snapshot length.
+	 *
+	 * If we're in cooked mode, make the snapshot length
+	 * large enough to hold a "cooked mode" header plus
+	 * 1 byte of packet data (so we don't pass a byte
+	 * count of 0 to "recvfrom()").
+	 */
+	if (handle->md.cooked) {
+		if (handle->snapshot < SLL_HDR_LEN + 1)
+			handle->snapshot = SLL_HDR_LEN + 1;
+	}
+	handle->bufsize = handle->snapshot;
 
-	if (sock_fd != -1)
-		close(sock_fd);
+	/* Save the socket FD in the pcap structure */
+	handle->fd = sock_fd;
 
-	if (fatal_err) {
-		/*
-		 * Get rid of any link-layer type list we allocated.
-		 */
-		if (handle->dlt_list != NULL)
-			free(handle->dlt_list);
-		return -2;
-	} else
-		return 0;
+	return 1;
 #else
 	strncpy(ebuf,
 		"New packet capturing interface not supported by build "
@@ -1600,6 +1914,488 @@ live_open_new(pcap_t *handle, const char *device, int promisc,
 #endif
 }
 
+static int 
+activate_mmap(pcap_t *handle)
+{
+#ifdef HAVE_PACKET_RING
+	int ret;
+
+	if (handle->opt.buffer_size == 0) {
+		/* by default request 2M for the ring buffer */
+		handle->opt.buffer_size = 2*1024*1024;
+	}
+	ret = prepare_tpacket_socket(handle);
+	if (ret == 0)
+		return ret;
+	ret = create_ring(handle);
+	if (ret == 0)
+		return ret;
+
+	/* override some defaults and inherit the other fields from
+	 * activate_new
+	 * handle->offset is used to get the current position into the rx ring 
+	 * handle->cc is used to store the ring size */
+	handle->read_op = pcap_read_linux_mmap;
+	handle->cleanup_op = pcap_cleanup_linux_mmap;
+	handle->setfilter_op = pcap_setfilter_linux_mmap;
+	handle->setnonblock_op = pcap_setnonblock_mmap;
+	handle->getnonblock_op = pcap_getnonblock_mmap;
+	handle->selectable_fd = handle->fd;
+	return 1;
+#else /* HAVE_PACKET_RING */
+	return 0;
+#endif /* HAVE_PACKET_RING */
+}
+
+#ifdef HAVE_PACKET_RING
+static int
+prepare_tpacket_socket(pcap_t *handle)
+{
+#ifdef HAVE_TPACKET2
+	socklen_t len;
+	int val;
+#endif
+
+	handle->md.tp_version = TPACKET_V1;
+	handle->md.tp_hdrlen = sizeof(struct tpacket_hdr);
+
+#ifdef HAVE_TPACKET2
+	/* Probe whether kernel supports TPACKET_V2 */
+	val = TPACKET_V2;
+	len = sizeof(val);
+	if (getsockopt(handle->fd, SOL_PACKET, PACKET_HDRLEN, &val, &len) < 0) {
+		if (errno == ENOPROTOOPT)
+			return 1;
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "can't get TPACKET_V2 header len on socket %d: %d-%s",
+			 handle->fd, errno, pcap_strerror(errno));
+		return 0;
+	}
+	handle->md.tp_hdrlen = val;
+
+	val = TPACKET_V2;
+	if (setsockopt(handle->fd, SOL_PACKET, PACKET_VERSION, &val,
+		       sizeof(val)) < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "can't activate TPACKET_V2 on socket %d: %d-%s",
+			 handle->fd, errno, pcap_strerror(errno));
+		return 0;
+	}
+	handle->md.tp_version = TPACKET_V2;
+
+	/* Reserve space for VLAN tag reconstruction */
+	val = VLAN_TAG_LEN;
+	if (setsockopt(handle->fd, SOL_PACKET, PACKET_RESERVE, &val,
+		       sizeof(val)) < 0) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "can't set up reserve on socket %d: %d-%s",
+			 handle->fd, errno, pcap_strerror(errno));
+		return 0;
+	}
+
+#endif /* HAVE_TPACKET2 */
+	return 1;
+}
+
+static void
+compute_ring_block(int frame_size, unsigned *block_size, unsigned *frames_per_block)
+{
+	/* compute the minumum block size that will handle this frame. 
+	 * The block has to be page size aligned. 
+	 * The max block size allowed by the kernel is arch-dependent and 
+	 * it's not explicitly checked here. */
+	*block_size = getpagesize();
+	while (*block_size < frame_size) 
+		*block_size <<= 1;
+
+	*frames_per_block = *block_size/frame_size;
+}
+
+static int
+create_ring(pcap_t *handle)
+{
+	unsigned i, j, ringsize, frames_per_block;
+	struct tpacket_req req;
+
+	/* Note that with large snapshot (say 64K) only a few frames 
+	 * will be available in the ring even with pretty large ring size
+	 * (and a lot of memory will be unused). 
+	 * The snap len should be carefully chosen to achive best
+	 * performance */
+	req.tp_frame_size = TPACKET_ALIGN(handle->snapshot +
+					  TPACKET_ALIGN(handle->md.tp_hdrlen) +
+					  sizeof(struct sockaddr_ll));
+	req.tp_frame_nr = handle->opt.buffer_size/req.tp_frame_size;
+	compute_ring_block(req.tp_frame_size, &req.tp_block_size, &frames_per_block);
+	req.tp_block_nr = req.tp_frame_nr / frames_per_block;
+
+	/* req.tp_frame_nr is requested to match frames_per_block*req.tp_block_nr */
+	req.tp_frame_nr = req.tp_block_nr * frames_per_block;
+
+	/* ask the kernel to create the ring */
+retry:
+	if (setsockopt(handle->fd, SOL_PACKET, PACKET_RX_RING,
+					(void *) &req, sizeof(req))) {
+		/* try to reduce requested ring size to prevent memory failure */
+		if ((errno == ENOMEM) && (req.tp_block_nr > 1)) {
+			req.tp_frame_nr >>= 1;
+			req.tp_block_nr = req.tp_frame_nr/frames_per_block;
+			goto retry;
+		}
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "can't create rx ring on "
+				"packet socket %d: %d-%s", handle->fd, errno, 
+				pcap_strerror(errno));
+		return 0;
+	}
+
+	/* memory map the rx ring */
+	ringsize = req.tp_block_nr * req.tp_block_size;
+	handle->bp = mmap(0, ringsize, PROT_READ| PROT_WRITE, MAP_SHARED, 
+					handle->fd, 0);
+	if (handle->bp == MAP_FAILED) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "can't mmap rx ring: %d-%s",
+			errno, pcap_strerror(errno));
+
+		/* clear the allocated ring on error*/
+		destroy_ring(handle);
+		return 0;
+	}
+
+	/* allocate a ring for each frame header pointer*/
+	handle->cc = req.tp_frame_nr;
+	handle->buffer = malloc(handle->cc * sizeof(union thdr *));
+	if (!handle->buffer) {
+		destroy_ring(handle);
+		return 0;
+	}
+
+	/* fill the header ring with proper frame ptr*/
+	handle->offset = 0;
+	for (i=0; i<req.tp_block_nr; ++i) {
+		void *base = &handle->bp[i*req.tp_block_size];
+		for (j=0; j<frames_per_block; ++j, ++handle->offset) {
+			RING_GET_FRAME(handle) = base;
+			base += req.tp_frame_size;
+		}
+	}
+
+	handle->bufsize = req.tp_frame_size;
+	handle->offset = 0;
+	return 1;
+}
+
+/* free all ring related resources*/
+static void
+destroy_ring(pcap_t *handle)
+{
+	/* tell the kernel to destroy the ring*/
+	struct tpacket_req req;
+	memset(&req, 0, sizeof(req));
+	setsockopt(handle->fd, SOL_PACKET, PACKET_RX_RING,
+				(void *) &req, sizeof(req));
+
+	/* if ring is mapped, unmap it*/
+	if (handle->bp) {
+		/* need to re-compute the ring size */
+		unsigned frames_per_block, block_size;
+		compute_ring_block(handle->bufsize, &block_size, &frames_per_block);
+
+		/* do not perform sanity check here: we can't recover any error */
+		munmap(handle->bp, block_size * handle->cc / frames_per_block);
+		handle->bp = 0;
+	}
+}
+
+static void
+pcap_cleanup_linux_mmap( pcap_t *handle )
+{
+	destroy_ring(handle);
+	pcap_cleanup_linux(handle);
+}
+
+
+static int
+pcap_getnonblock_mmap(pcap_t *p, char *errbuf)
+{
+	/* use negative value of timeout to indicate non blocking ops */
+	return (p->md.timeout<0);
+}
+
+static int
+pcap_setnonblock_mmap(pcap_t *p, int nonblock, char *errbuf)
+{
+	/* map each value to the corresponding 2's complement, to 
+	 * preserve the timeout value provided with pcap_set_timeout */
+	if (nonblock) {
+		if (p->md.timeout > 0)
+			p->md.timeout = p->md.timeout*-1 - 1;
+	} else 
+		if (p->md.timeout < 0)
+			p->md.timeout = (p->md.timeout+1)*-1;
+	return 0;
+}
+
+static inline union thdr *
+pcap_get_ring_frame(pcap_t *handle, int status)
+{
+	union thdr h;
+
+	h.raw = RING_GET_FRAME(handle);
+	switch (handle->md.tp_version) {
+	case TPACKET_V1:
+		if (status != (h.h1->tp_status ? TP_STATUS_USER :
+						TP_STATUS_KERNEL))
+			return NULL;
+		break;
+#ifdef HAVE_TPACKET2
+	case TPACKET_V2:
+		if (status != (h.h2->tp_status ? TP_STATUS_USER :
+						TP_STATUS_KERNEL))
+			return NULL;
+		break;
+#endif
+	}
+	return h.raw;
+}
+
+static int
+pcap_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, 
+		u_char *user)
+{
+	int pkts = 0;
+
+	/* wait for frames availability.*/
+	if ((handle->md.timeout >= 0) &&
+	    !pcap_get_ring_frame(handle, TP_STATUS_USER)) {
+		struct pollfd pollinfo;
+		int ret;
+
+		pollinfo.fd = handle->fd;
+		pollinfo.events = POLLIN;
+
+		do {
+			/* poll() requires a negative timeout to wait forever */
+			ret = poll(&pollinfo, 1, (handle->md.timeout > 0)?
+			 			handle->md.timeout: -1);
+			if ((ret < 0) && (errno != EINTR)) {
+				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 
+					 "can't poll on packet socket fd %d: %d-%s",
+					handle->fd, errno, pcap_strerror(errno));
+				return -1;
+			}
+			/* check for break loop condition on interrupted syscall*/
+			if (handle->break_loop) {
+				handle->break_loop = 0;
+				return -2;
+			}
+		} while (ret < 0);
+	}
+
+	/* non-positive values of max_packets are used to require all 
+	 * packets currently available in the ring */
+	while ((pkts < max_packets) || (max_packets <= 0)) {
+		int run_bpf;
+		struct sockaddr_ll *sll;
+		struct pcap_pkthdr pcaphdr;
+		unsigned char *bp;
+		union thdr h;
+		unsigned int tp_len;
+		unsigned int tp_mac;
+		unsigned int tp_snaplen;
+		unsigned int tp_sec;
+		unsigned int tp_usec;
+
+		h.raw = pcap_get_ring_frame(handle, TP_STATUS_USER);
+		if (!h.raw)
+			break;
+
+		switch (handle->md.tp_version) {
+		case TPACKET_V1:
+			tp_len	   = h.h1->tp_len;
+			tp_mac	   = h.h1->tp_mac;
+			tp_snaplen = h.h1->tp_snaplen;
+			tp_sec	   = h.h1->tp_sec;
+			tp_usec	   = h.h1->tp_usec;
+			break;
+#ifdef HAVE_TPACKET2
+		case TPACKET_V2:
+			tp_len	   = h.h2->tp_len;
+			tp_mac	   = h.h2->tp_mac;
+			tp_snaplen = h.h2->tp_snaplen;
+			tp_sec	   = h.h2->tp_sec;
+			tp_usec	   = h.h2->tp_nsec / 1000;
+			break;
+#endif
+		default:
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 
+				"unsupported tpacket version %d",
+				handle->md.tp_version);
+			return -1;
+		}
+		/* perform sanity check on internal offset. */
+		if (tp_mac + tp_snaplen > handle->bufsize) {
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 
+				"corrupted frame on kernel ring mac "
+				"offset %d + caplen %d > frame len %d", 
+				tp_mac, tp_snaplen, handle->bufsize);
+			return -1;
+		}
+
+		/* run filter on received packet
+		 * If the kernel filtering is enabled we need to run the
+		 * filter until all the frames present into the ring 
+		 * at filter creation time are processed. 
+		 * In such case md.use_bpf is used as a counter for the 
+		 * packet we need to filter.
+		 * Note: alternatively it could be possible to stop applying 
+		 * the filter when the ring became empty, but it can possibly
+		 * happen a lot later... */
+		bp = (unsigned char*)h.raw + tp_mac;
+		run_bpf = (!handle->md.use_bpf) || 
+			((handle->md.use_bpf>1) && handle->md.use_bpf--);
+		if (run_bpf && handle->fcode.bf_insns && 
+				(bpf_filter(handle->fcode.bf_insns, bp,
+					tp_len, tp_snaplen) == 0))
+			goto skip;
+
+		/* check direction and interface index */
+		sll = (void *)h.raw + TPACKET_ALIGN(handle->md.tp_hdrlen);
+		if ((sll->sll_ifindex == handle->md.lo_ifindex) &&
+					(sll->sll_pkttype == PACKET_OUTGOING))
+			goto skip;
+
+		/* get required packet info from ring header */
+		pcaphdr.ts.tv_sec = tp_sec;
+		pcaphdr.ts.tv_usec = tp_usec;
+		pcaphdr.caplen = tp_snaplen;
+		pcaphdr.len = tp_len;
+
+		/* if required build in place the sll header*/
+		if (handle->md.cooked) {
+			struct sll_header *hdrp;
+
+			/*
+			 * The kernel should have left us with enough
+			 * space for an sll header; back up the packet
+			 * data pointer into that space, as that'll be
+			 * the beginning of the packet we pass to the
+			 * callback.
+			 */
+			bp -= SLL_HDR_LEN;
+
+			/*
+			 * Let's make sure that's past the end of
+			 * the tpacket header, i.e. >=
+			 * ((u_char *)thdr + TPACKET_HDRLEN), so we
+			 * don't step on the header when we construct
+			 * the sll header.
+			 */
+			if (bp < (u_char *)h.raw +
+					   TPACKET_ALIGN(handle->md.tp_hdrlen) +
+					   sizeof(struct sockaddr_ll)) {
+				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 
+					"cooked-mode frame doesn't have room for sll header");
+				return -1;
+			}
+
+			/*
+			 * OK, that worked; construct the sll header.
+			 */
+			hdrp = (struct sll_header *)bp;
+			hdrp->sll_pkttype = map_packet_type_to_sll_type(
+							sll->sll_pkttype);
+			hdrp->sll_hatype = htons(sll->sll_hatype);
+			hdrp->sll_halen = htons(sll->sll_halen);
+			memcpy(hdrp->sll_addr, sll->sll_addr, SLL_ADDRLEN);
+			hdrp->sll_protocol = sll->sll_protocol;
+
+			/* update packet len */
+			pcaphdr.caplen += SLL_HDR_LEN;
+			pcaphdr.len += SLL_HDR_LEN;
+		}
+
+#ifdef HAVE_TPACKET2
+		if (handle->md.tp_version == TPACKET_V2 && h.h2->tp_vlan_tci &&
+		    tp_snaplen >= 2 * ETH_ALEN) {
+			struct vlan_tag *tag;
+
+			bp -= VLAN_TAG_LEN;
+			memmove(bp, bp + VLAN_TAG_LEN, 2 * ETH_ALEN);
+
+			tag = (struct vlan_tag *)(bp + 2 * ETH_ALEN);
+			tag->vlan_tpid = htons(ETH_P_8021Q);
+			tag->vlan_tci = htons(h.h2->tp_vlan_tci);
+
+			pcaphdr.caplen += VLAN_TAG_LEN;
+			pcaphdr.len += VLAN_TAG_LEN;
+		}
+#endif
+
+		/* pass the packet to the user */
+		pkts++;
+		callback(user, &pcaphdr, bp);
+		handle->md.packets_read++;
+
+skip:
+		/* next packet */
+		switch (handle->md.tp_version) {
+		case TPACKET_V1:
+			h.h1->tp_status = TP_STATUS_KERNEL;
+			break;
+#ifdef HAVE_TPACKET2
+		case TPACKET_V2:
+			h.h2->tp_status = TP_STATUS_KERNEL;
+			break;
+#endif
+		}
+		if (++handle->offset >= handle->cc)
+			handle->offset = 0;
+
+		/* check for break loop condition*/
+		if (handle->break_loop) {
+			handle->break_loop = 0;
+			return -2;
+		}
+	}
+	return pkts;
+}
+
+static int 
+pcap_setfilter_linux_mmap(pcap_t *handle, struct bpf_program *filter)
+{
+	int n, offset;
+	int ret = pcap_setfilter_linux(handle, filter);
+	if (ret < 0)
+		return ret;
+
+	/* if the kernel filter is enabled, we need to apply the filter on
+	 * all packets present into the ring. Get an upper bound of their number
+	 */
+	if (!handle->md.use_bpf)
+		return ret;
+
+	/* walk the ring backward and count the free slot */
+	offset = handle->offset;
+	if (--handle->offset < 0)
+		handle->offset = handle->cc - 1;
+	for (n=0; n < handle->cc; ++n) {
+		if (--handle->offset < 0)
+			handle->offset = handle->cc - 1;
+		if (!pcap_get_ring_frame(handle, TP_STATUS_KERNEL))
+			break;
+	}
+
+	/* be careful to not change current ring position */
+	handle->offset = offset;
+
+	/* store the number of packets currently present in the ring */
+	handle->md.use_bpf = 1 + (handle->cc - n);
+	return ret;
+}
+
+#endif /* HAVE_PACKET_RING */
+
+
 #ifdef HAVE_PF_PACKET_SOCKETS
 /*
  *  Return the index of the given device name. Fill ebuf and return
@@ -1624,6 +2420,8 @@ iface_get_id(int fd, const char *device, char *ebuf)
 
 /*
  *  Bind the socket associated with FD to the given device.
+ *  Return 1 on success, 0 if we should try a SOCK_PACKET socket,
+ *  or a PCAP_ERROR_ value on a hard error.
  */
 static int
 iface_bind(int fd, int ifindex, char *ebuf)
@@ -1638,9 +2436,20 @@ iface_bind(int fd, int ifindex, char *ebuf)
 	sll.sll_protocol	= htons(ETH_P_ALL);
 
 	if (bind(fd, (struct sockaddr *) &sll, sizeof(sll)) == -1) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,
-			 "bind: %s", pcap_strerror(errno));
-		return -1;
+		if (errno == ENETDOWN) {
+			/*
+			 * Return a "network down" indication, so that
+			 * the application can report that rather than
+			 * saying we had a mysterious failure and
+			 * suggest that they report a problem to the
+			 * libpcap developers.
+			 */
+			return PCAP_ERROR_IFACE_NOT_UP;
+		} else {
+			snprintf(ebuf, PCAP_ERRBUF_SIZE,
+				 "bind: %s", pcap_strerror(errno));
+			return PCAP_ERROR;
+		}
 	}
 
 	/* Any pending errors, e.g., network is down? */
@@ -1648,251 +2457,815 @@ iface_bind(int fd, int ifindex, char *ebuf)
 	if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 			"getsockopt: %s", pcap_strerror(errno));
-		return -2;
+		return 0;
 	}
 
-	if (err > 0) {
+	if (err == ENETDOWN) {
+		/*
+		 * Return a "network down" indication, so that
+		 * the application can report that rather than
+		 * saying we had a mysterious failure and
+		 * suggest that they report a problem to the
+		 * libpcap developers.
+		 */
+		return PCAP_ERROR_IFACE_NOT_UP;
+	} else if (err > 0) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 			"bind: %s", pcap_strerror(err));
-		return -2;
+		return 0;
 	}
 
-	return 0;
+	return 1;
 }
 
-#endif
-
-
-/* ===== Functions to interface to the older kernels ================== */
-
 /*
- * With older kernels promiscuous mode is kind of interesting because we
- * have to reset the interface before exiting. The problem can't really
- * be solved without some daemon taking care of managing usage counts.
- * If we put the interface into promiscuous mode, we set a flag indicating
- * that we must take it out of that mode when the interface is closed,
- * and, when closing the interface, if that flag is set we take it out
- * of promiscuous mode.
+ * Check whether the device supports the Wireless Extensions.
+ * Returns 1 if it does, 0 if it doesn't, PCAP_ERROR_NO_SUCH_DEVICE
+ * if the device doesn't even exist.
  */
+static int
+has_wext(int sock_fd, const char *device, char *ebuf)
+{
+#ifdef IW_MODE_MONITOR
+	struct iwreq ireq;
+
+	strncpy(ireq.ifr_ifrn.ifrn_name, device,
+	    sizeof ireq.ifr_ifrn.ifrn_name);
+	ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+	if (ioctl(sock_fd, SIOCGIWNAME, &ireq) >= 0)
+		return 1;	/* yes */
+	snprintf(ebuf, PCAP_ERRBUF_SIZE,
+	    "%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
+	if (errno == ENODEV)
+		return PCAP_ERROR_NO_SUCH_DEVICE;
+#endif
+	return 0;
+}
 
 /*
- * List of pcaps for which we turned promiscuous mode on by hand.
- * If there are any such pcaps, we arrange to call "pcap_close_all()"
- * when we exit, and have it close all of them to turn promiscuous mode
- * off.
+ * Per me si va ne la citta dolente,
+ * Per me si va ne l'etterno dolore,
+ *	...
+ * Lasciate ogne speranza, voi ch'intrate.
+ *
+ * XXX - airmon-ng does special stuff with the Orinoco driver and the
+ * wlan-ng driver.
  */
-static struct pcap *pcaps_to_close;
+typedef enum {
+	MONITOR_WEXT,
+	MONITOR_HOSTAP,
+	MONITOR_PRISM,
+	MONITOR_PRISM54,
+	MONITOR_ACX100,
+	MONITOR_RT2500,
+	MONITOR_RT2570,
+	MONITOR_RT73,
+	MONITOR_RTL8XXX
+} monitor_type;
 
 /*
- * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to
- * be called on exit.
+ * Use the Wireless Extensions, if we have them, to try to turn monitor mode
+ * on if it's not already on.
+ *
+ * Returns 1 on success, 0 if we don't support the Wireless Extensions
+ * on this device, or a PCAP_ERROR_ value if we do support them but
+ * we weren't able to turn monitor mode on.
  */
-static int did_atexit;
-
-static void	pcap_close_all(void)
+static int
+enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 {
-	struct pcap *handle;
+#ifdef IW_MODE_MONITOR
+	/*
+	 * XXX - at least some adapters require non-Wireless Extensions
+	 * mechanisms to turn monitor mode on.
+	 *
+	 * Atheros cards might require that a separate "monitor virtual access
+	 * point" be created, with later versions of the madwifi driver.
+	 * airmon-ng does "wlanconfig ath create wlandev {if} wlanmode
+	 * monitor -bssid", which apparently spits out a line "athN"
+	 * where "athN" is the monitor mode device.  To leave monitor
+	 * mode, it destroys the monitor mode device.
+	 *
+	 * Some Intel Centrino adapters might require private ioctls to get
+	 * radio headers; the ipw2200 and ipw3945 drivers allow you to
+	 * configure a separate "rtapN" interface to capture in monitor
+	 * mode without preventing the adapter from operating normally.
+	 * (airmon-ng doesn't appear to use that, though.)
+	 *
+	 * It would be Truly Wonderful if mac80211 and nl80211 cleaned this
+	 * up, and if all drivers were converted to mac80211 drivers.
+	 *
+	 * If interface {if} is a mac80211 driver, the file
+	 * /sys/class/net/{if}/phy80211 is a symlink to
+	 * /sys/class/ieee80211/{phydev}, for some {phydev}.
+	 *
+	 * On Fedora 9, with a 2.6.26.3-29 kernel, my Zydas stick, at
+	 * least, has a "wmaster0" device and a "wlan0" device; the
+	 * latter is the one with the IP address.  Both show up in
+	 * "tcpdump -D" output.  Capturing on the wmaster0 device
+	 * captures with 802.11 headers.
+	 *
+	 * airmon-ng searches through /sys/class/net for devices named
+	 * monN, starting with mon0; as soon as one *doesn't* exist,
+	 * it chooses that as the monitor device name.  If the "iw"
+	 * command exists, it does "iw dev {if} interface add {monif}
+	 * type monitor", where {monif} is the monitor device.  It
+	 * then (sigh) sleeps .1 second, and then configures the
+	 * device up.  Otherwise, if /sys/class/ieee80211/{phydev}/add_iface
+	 * is a file, it writes {mondev}, without a newline, to that file,
+	 * and again (sigh) sleeps .1 second, and then iwconfig's that
+	 * device into monitor mode and configures it up.  Otherwise,
+	 * you can't do monitor mode.
+	 *
+	 * All these devices are "glued" together by having the
+	 * /sys/class/net/{device}/phy80211 links pointing to the same
+	 * place, so, given a wmaster, wlan, or mon device, you can
+	 * find the other devices by looking for devices with
+	 * the same phy80211 link.
+	 *
+	 * To turn monitor mode off, delete the monitor interface,
+	 * either with "iw dev {monif} interface del" or by sending
+	 * {monif}, with no NL, down /sys/class/ieee80211/{phydev}/remove_iface
+	 *
+	 * Note: if you try to create a monitor device named "monN", and
+	 * there's already a "monN" device, it fails, as least with
+	 * the netlink interface (which is what iw uses), with a return
+	 * value of -ENFILE.  (Return values are negative errnos.)  We
+	 * could probably use that to find an unused device.
+	 */
+	int err;
+	struct iwreq ireq;
+	struct iw_priv_args *priv;
+	monitor_type montype;
+	int i;
+	__u32 cmd;
+	int args[2];
+	int channel;
 
-	while ((handle = pcaps_to_close) != NULL)
-		pcap_close(handle);
-}
+	/*
+	 * Does this device *support* the Wireless Extensions?
+	 */
+	err = has_wext(sock_fd, device, handle->errbuf);
+	if (err <= 0)
+		return err;	/* either it doesn't or the device doesn't even exist */
+	/*
+	 * Try to get all the Wireless Extensions private ioctls
+	 * supported by this device.
+	 *
+	 * First, get the size of the buffer we need, by supplying no
+	 * buffer and a length of 0.  If the device supports private
+	 * ioctls, it should return E2BIG, with ireq.u.data.length set
+	 * to the length we need.  If it doesn't support them, it should
+	 * return EOPNOTSUPP.
+	 */
+	memset(&ireq, 0, sizeof ireq);
+	strncpy(ireq.ifr_ifrn.ifrn_name, device,
+	    sizeof ireq.ifr_ifrn.ifrn_name);
+	ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+	ireq.u.data.pointer = args;
+	ireq.u.data.length = 0;
+	ireq.u.data.flags = 0;
+	if (ioctl(sock_fd, SIOCGIWPRIV, &ireq) != -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: SIOCGIWPRIV with a zero-length buffer didn't fail!",
+		    device);
+		return PCAP_ERROR;
+	}
+	if (errno == EOPNOTSUPP) {
+		/*
+		 * No private ioctls, so we assume that there's only one
+		 * DLT_ for monitor mode.
+		 */
+		return 0;
+	}
+	if (errno != E2BIG) {
+		/*
+		 * Failed.
+		 */
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
+		return PCAP_ERROR;
+	}
+	priv = malloc(ireq.u.data.length * sizeof (struct iw_priv_args));
+	if (priv == NULL) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "malloc: %s", pcap_strerror(errno));
+		return PCAP_ERROR;
+	}
+	ireq.u.data.pointer = priv;
+	if (ioctl(sock_fd, SIOCGIWPRIV, &ireq) == -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
+		free(priv);
+		return PCAP_ERROR;
+	}
 
-static void	pcap_close_linux( pcap_t *handle )
-{
-	struct pcap	*p, *prevp;
-	struct ifreq	ifr;
+	/*
+	 * Look for private ioctls to turn monitor mode on or, if
+	 * monitor mode is on, to set the header type.
+	 */
+	montype = MONITOR_WEXT;
+	cmd = 0;
+	for (i = 0; i < ireq.u.data.length; i++) {
+		if (strcmp(priv[i].name, "monitor_type") == 0) {
+			/*
+			 * Hostap driver, use this one.
+			 * Set monitor mode first.
+			 * You can set it to 0 to get DLT_IEEE80211,
+			 * 1 to get DLT_PRISM, or 2 to get
+			 * DLT_IEEE80211_RADIO_AVS.
+			 */
+			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
+				break;
+			if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
+				break;
+			if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
+				break;
+			montype = MONITOR_HOSTAP;
+			cmd = priv[i].cmd;
+			break;
+		}
+		if (strcmp(priv[i].name, "set_prismhdr") == 0) {
+			/*
+			 * Prism54 driver, use this one.
+			 * Set monitor mode first.
+			 * You can set it to 2 to get DLT_IEEE80211
+			 * or 3 or get DLT_PRISM.
+			 */
+			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
+				break;
+			if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
+				break;
+			if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
+				break;
+			montype = MONITOR_PRISM54;
+			cmd = priv[i].cmd;
+			break;
+		}
+		if (strcmp(priv[i].name, "forceprismheader") == 0) {
+			/*
+			 * RT2570 driver, use this one.
+			 * Do this after turning monitor mode on.
+			 * You can set it to 1 to get DLT_PRISM or 2
+			 * to get DLT_IEEE80211.
+			 */
+			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
+				break;
+			if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
+				break;
+			if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
+				break;
+			montype = MONITOR_RT2570;
+			cmd = priv[i].cmd;
+			break;
+		}
+		if (strcmp(priv[i].name, "forceprism") == 0) {
+			/*
+			 * RT73 driver, use this one.
+			 * Do this after turning monitor mode on.
+			 * Its argument is a *string*; you can
+			 * set it to "1" to get DLT_PRISM or "2"
+			 * to get DLT_IEEE80211.
+			 */
+			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_CHAR)
+				break;
+			if (priv[i].set_args & IW_PRIV_SIZE_FIXED)
+				break;
+			montype = MONITOR_RT73;
+			cmd = priv[i].cmd;
+			break;
+		}
+		if (strcmp(priv[i].name, "prismhdr") == 0) {
+			/*
+			 * One of the RTL8xxx drivers, use this one.
+			 * It can only be done after monitor mode
+			 * has been turned on.  You can set it to 1
+			 * to get DLT_PRISM or 0 to get DLT_IEEE80211.
+			 */
+			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
+				break;
+			if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
+				break;
+			if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
+				break;
+			montype = MONITOR_RTL8XXX;
+			cmd = priv[i].cmd;
+			break;
+		}
+		if (strcmp(priv[i].name, "rfmontx") == 0) {
+			/*
+			 * RT2500 or RT61 driver, use this one.
+			 * It has one one-byte parameter; set
+			 * u.data.length to 1 and u.data.pointer to
+			 * point to the parameter.
+			 * It doesn't itself turn monitor mode on.
+			 * You can set it to 1 to allow transmitting
+			 * in monitor mode(?) and get DLT_IEEE80211,
+			 * or set it to 0 to disallow transmitting in
+			 * monitor mode(?) and get DLT_PRISM.
+			 */
+			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
+				break;
+			if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 2)
+				break;
+			montype = MONITOR_RT2500;
+			cmd = priv[i].cmd;
+			break;
+		}
+		if (strcmp(priv[i].name, "monitor") == 0) {
+			/*
+			 * Either ACX100 or hostap, use this one.
+			 * It turns monitor mode on.
+			 * If it takes two arguments, it's ACX100;
+			 * the first argument is 1 for DLT_PRISM
+			 * or 2 for DLT_IEEE80211, and the second
+			 * argument is the channel on which to
+			 * run.  If it takes one argument, it's
+			 * HostAP, and the argument is 2 for
+			 * DLT_IEEE80211 and 3 for DLT_PRISM.
+			 *
+			 * If we see this, we don't quit, as this
+			 * might be a version of the hostap driver
+			 * that also supports "monitor_type".
+			 */
+			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
+				break;
+			if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
+				break;
+			switch (priv[i].set_args & IW_PRIV_SIZE_MASK) {
+
+			case 1:
+				montype = MONITOR_PRISM;
+				cmd = priv[i].cmd;
+				break;
+
+			case 2:
+				montype = MONITOR_ACX100;
+				cmd = priv[i].cmd;
+				break;
+
+			default:
+				break;
+			}
+		}
+	}
+	free(priv);
+
+	/*
+	 * XXX - ipw3945?  islism?
+	 */
+
+	/*
+	 * Get the old mode.
+	 */
+	strncpy(ireq.ifr_ifrn.ifrn_name, device,
+	    sizeof ireq.ifr_ifrn.ifrn_name);
+	ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+	if (ioctl(sock_fd, SIOCGIWMODE, &ireq) == -1) {
+		/*
+		 * We probably won't be able to set the mode, either.
+		 */
+		return PCAP_ERROR_RFMON_NOTSUP;
+	}
+
+	/*
+	 * Is it currently in monitor mode?
+	 */
+	if (ireq.u.mode == IW_MODE_MONITOR) {
+		/*
+		 * Yes.  Just leave things as they are.
+		 * We don't offer multiple link-layer types, as
+		 * changing the link-layer type out from under
+		 * somebody else capturing in monitor mode would
+		 * be considered rude.
+		 */
+		return 1;
+	}
+	/*
+	 * No.  We have to put the adapter into rfmon mode.
+	 */
+
+	/*
+	 * If we haven't already done so, arrange to have
+	 * "pcap_close_all()" called when we exit.
+	 */
+	if (!pcap_do_addexit(handle)) {
+		/*
+		 * "atexit()" failed; don't put the interface
+		 * in rfmon mode, just give up.
+		 */
+		return PCAP_ERROR_RFMON_NOTSUP;
+	}
 
-	if (handle->md.clear_promisc) {
+	/*
+	 * Save the old mode.
+	 */
+	handle->md.oldmode = ireq.u.mode;
+
+	/*
+	 * Put the adapter in rfmon mode.  How we do this depends
+	 * on whether we have a special private ioctl or not.
+	 */
+	if (montype == MONITOR_PRISM) {
 		/*
-		 * We put the interface into promiscuous mode; take
-		 * it out of promiscuous mode.
+		 * We have the "monitor" private ioctl, but none of
+		 * the other private ioctls.  Use this, and select
+		 * the Prism header.
 		 *
-		 * XXX - if somebody else wants it in promiscuous mode,
-		 * this code cannot know that, so it'll take it out
-		 * of promiscuous mode.  That's not fixable in 2.0[.x]
-		 * kernels.
+		 * If it fails, just fall back on SIOCSIWMODE.
 		 */
-		memset(&ifr, 0, sizeof(ifr));
-		strncpy(ifr.ifr_name, handle->md.device, sizeof(ifr.ifr_name));
-		if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
-			fprintf(stderr,
-			    "Can't restore interface flags (SIOCGIFFLAGS failed: %s).\n"
-			    "Please adjust manually.\n"
-			    "Hint: This can't happen with Linux >= 2.2.0.\n",
-			    strerror(errno));
-		} else {
-			if (ifr.ifr_flags & IFF_PROMISC) {
-				/*
-				 * Promiscuous mode is currently on; turn it
-				 * off.
-				 */
-				ifr.ifr_flags &= ~IFF_PROMISC;
-				if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) {
-					fprintf(stderr,
-					    "Can't restore interface flags (SIOCSIFFLAGS failed: %s).\n"
-					    "Please adjust manually.\n"
-					    "Hint: This can't happen with Linux >= 2.2.0.\n",
-					    strerror(errno));
-				}
-			}
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		ireq.u.data.length = 1;	/* 1 argument */
+		args[0] = 3;	/* request Prism header */
+		memcpy(ireq.u.name, args, IFNAMSIZ);
+		if (ioctl(sock_fd, cmd, &ireq) != -1) {
+			/*
+			 * Success.
+			 * Note that we have to put the old mode back
+			 * when we close the device.
+			 */
+			handle->md.must_clear |= MUST_CLEAR_RFMON;
+
+			/*
+			 * Add this to the list of pcaps to close
+			 * when we exit.
+			 */
+			pcap_add_to_pcaps_to_close(handle);
+
+			return 1;
 		}
 
 		/*
-		 * Take this pcap out of the list of pcaps for which we
-		 * have to take the interface out of promiscuous mode.
+		 * Failure.  Fall back on SIOCSIWMODE.
 		 */
-		for (p = pcaps_to_close, prevp = NULL; p != NULL;
-		    prevp = p, p = p->md.next) {
-			if (p == handle) {
-				/*
-				 * Found it.  Remove it from the list.
-				 */
-				if (prevp == NULL) {
-					/*
-					 * It was at the head of the list.
-					 */
-					pcaps_to_close = p->md.next;
-				} else {
-					/*
-					 * It was in the middle of the list.
-					 */
-					prevp->md.next = p->md.next;
-				}
-				break;
-			}
+	}
+
+	/*
+	 * First, turn monitor mode on.
+	 */
+	strncpy(ireq.ifr_ifrn.ifrn_name, device,
+	    sizeof ireq.ifr_ifrn.ifrn_name);
+	ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+	ireq.u.mode = IW_MODE_MONITOR;
+	if (ioctl(sock_fd, SIOCSIWMODE, &ireq) == -1) {
+		/*
+		 * Scientist, you've failed.
+		 */
+		return PCAP_ERROR_RFMON_NOTSUP;
+	}
+
+	/*
+	 * XXX - airmon-ng does "iwconfig {if} key off" after setting
+	 * monitor mode and setting the channel, and then does
+	 * "iwconfig up".
+	 */
+
+	/*
+	 * Now select the appropriate radio header.
+	 */
+	switch (montype) {
+
+	case MONITOR_WEXT:
+		/*
+		 * We don't have any private ioctl to set the header.
+		 */
+		break;
+
+	case MONITOR_HOSTAP:
+		/*
+		 * Select the AVS header if we can, otherwise
+		 * select the Prism header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 2;	/* request AVS header */
+		memcpy(ireq.u.name, args, sizeof (int));
+		if (ioctl(sock_fd, cmd, &ireq) == -1) {
+			/*
+			 * Failure - try the Prism header.
+			 */
+			memset(&ireq, 0, sizeof ireq);
+			strncpy(ireq.ifr_ifrn.ifrn_name, device,
+			    sizeof ireq.ifr_ifrn.ifrn_name);
+			ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+			args[0] = 1;	/* request Prism header */
+			memcpy(ireq.u.name, args, sizeof (int));
+			ioctl(sock_fd, cmd, &ireq);
 		}
+		break;
+
+	case MONITOR_PRISM:
+		/*
+		 * The private ioctl failed.
+		 */
+		break;
+
+	case MONITOR_PRISM54:
+		/*
+		 * Select the Prism header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 3;	/* request Prism header */
+		memcpy(ireq.u.name, args, sizeof (int));
+		ioctl(sock_fd, cmd, &ireq);
+		break;
+
+	case MONITOR_ACX100:
+		/*
+		 * Get the current channel.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		if (ioctl(sock_fd, SIOCGIWFREQ, &ireq) == -1) {
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			    "%s: SIOCGIWFREQ: %s", device,
+			    pcap_strerror(errno));
+			return PCAP_ERROR;
+		}
+		channel = ireq.u.freq.m;
+
+		/*
+		 * Select the Prism header, and set the channel to the
+		 * current value.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 1;		/* request Prism header */
+		args[1] = channel;	/* set channel */
+		memcpy(ireq.u.name, args, 2*sizeof (int));
+		ioctl(sock_fd, cmd, &ireq);
+		break;
+
+	case MONITOR_RT2500:
+		/*
+		 * Disallow transmission - that turns on the
+		 * Prism header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 0;	/* disallow transmitting */
+		memcpy(ireq.u.name, args, sizeof (int));
+		ioctl(sock_fd, cmd, &ireq);
+		break;
+
+	case MONITOR_RT2570:
+		/*
+		 * Force the Prism header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 1;	/* request Prism header */
+		memcpy(ireq.u.name, args, sizeof (int));
+		ioctl(sock_fd, cmd, &ireq);
+		break;
+
+	case MONITOR_RT73:
+		/*
+		 * Force the Prism header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		ireq.u.data.length = 1;	/* 1 argument */
+		ireq.u.data.pointer = "1";
+		ireq.u.data.flags = 0;
+		ioctl(sock_fd, cmd, &ireq);
+		break;
+
+	case MONITOR_RTL8XXX:
+		/*
+		 * Force the Prism header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 1;	/* request Prism header */
+		memcpy(ireq.u.name, args, sizeof (int));
+		ioctl(sock_fd, cmd, &ireq);
+		break;
 	}
 
-	if (handle->md.device != NULL)
-		free(handle->md.device);
-	handle->md.device = NULL;
-	pcap_close_common(handle);
+	/*
+	 * Note that we have to put the old mode back when we
+	 * close the device.
+	 */
+	handle->md.must_clear |= MUST_CLEAR_RFMON;
+
+	/*
+	 * Add this to the list of pcaps to close when we exit.
+	 */
+	pcap_add_to_pcaps_to_close(handle);
+
+	return 1;
+#else
+	/*
+	 * We don't have the Wireless Extensions available, so we can't
+	 * do monitor mode.
+	 */
+	return 0;
+#endif
 }
 
+#endif /* HAVE_PF_PACKET_SOCKETS */
+
+/* ===== Functions to interface to the older kernels ================== */
+
 /*
- *  Try to open a packet socket using the old kernel interface.
- *  Returns 0 on failure.
- *  FIXME: 0 uses to mean success (Sebastian)
+ * Try to open a packet socket using the old kernel interface.
+ * Returns 1 on success and a PCAP_ERROR_ value on an error.
  */
 static int
-live_open_old(pcap_t *handle, const char *device, int promisc,
-	      int to_ms, char *ebuf)
+activate_old(pcap_t *handle)
 {
 	int		arptype;
 	struct ifreq	ifr;
+	const char	*device = handle->opt.source;
+	struct utsname	utsname;
+	int		mtu;
 
-	do {
-		/* Open the socket */
+	/* Open the socket */
 
-		handle->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL));
-		if (handle->fd == -1) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE,
-				 "socket: %s", pcap_strerror(errno));
-			break;
-		}
+	handle->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL));
+	if (handle->fd == -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "socket: %s", pcap_strerror(errno));
+		return PCAP_ERROR_PERM_DENIED;
+	}
 
-		/* It worked - we are using the old interface */
-		handle->md.sock_packet = 1;
+	/* It worked - we are using the old interface */
+	handle->md.sock_packet = 1;
 
-		/* ...which means we get the link-layer header. */
-		handle->md.cooked = 0;
+	/* ...which means we get the link-layer header. */
+	handle->md.cooked = 0;
 
-		/* Bind to the given device */
+	/* Bind to the given device */
 
-		if (!device) {
-		        strncpy(ebuf, "pcap_open_live: The \"any\" device isn't supported on 2.0[.x]-kernel systems",
-				PCAP_ERRBUF_SIZE);
-			break;
-		}
-		if (iface_bind_old(handle->fd, device, ebuf) == -1)
-			break;
+	if (!device) {
+		strncpy(handle->errbuf, "pcap_activate: The \"any\" device isn't supported on 2.0[.x]-kernel systems",
+			PCAP_ERRBUF_SIZE);
+		return PCAP_ERROR;
+	}
+	if (iface_bind_old(handle->fd, device, handle->errbuf) == -1)
+		return PCAP_ERROR;
 
-		/*
-		 * Try to get the link-layer type.
-		 */
-		arptype = iface_get_arptype(handle->fd, device, ebuf);
-		if (arptype == -1)
-			break;
+	/*
+	 * Try to get the link-layer type.
+	 */
+	arptype = iface_get_arptype(handle->fd, device, handle->errbuf);
+	if (arptype < 0)
+		return PCAP_ERROR;
 
-		/*
-		 * Try to find the DLT_ type corresponding to that
-		 * link-layer type.
-		 */
-		map_arphrd_to_dlt(handle, arptype, 0);
-		if (handle->linktype == -1) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE,
-				 "unknown arptype %d", arptype);
-			break;
-		}
+	/*
+	 * Try to find the DLT_ type corresponding to that
+	 * link-layer type.
+	 */
+	map_arphrd_to_dlt(handle, arptype, 0);
+	if (handle->linktype == -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "unknown arptype %d", arptype);
+		return PCAP_ERROR;
+	}
 
-		/* Go to promisc mode if requested */
+	/* Go to promisc mode if requested */
 
-		if (promisc) {
-			memset(&ifr, 0, sizeof(ifr));
-			strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
-			if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
-				snprintf(ebuf, PCAP_ERRBUF_SIZE,
-					 "SIOCGIFFLAGS: %s", pcap_strerror(errno));
-				break;
-			}
-			if ((ifr.ifr_flags & IFF_PROMISC) == 0) {
-				/*
-				 * Promiscuous mode isn't currently on,
-				 * so turn it on, and remember that
-				 * we should turn it off when the
-				 * pcap_t is closed.
-				 */
+	if (handle->opt.promisc) {
+		memset(&ifr, 0, sizeof(ifr));
+		strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
+		if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				 "SIOCGIFFLAGS: %s", pcap_strerror(errno));
+			return PCAP_ERROR;
+		}
+		if ((ifr.ifr_flags & IFF_PROMISC) == 0) {
+			/*
+			 * Promiscuous mode isn't currently on,
+			 * so turn it on, and remember that
+			 * we should turn it off when the
+			 * pcap_t is closed.
+			 */
 
+			/*
+			 * If we haven't already done so, arrange
+			 * to have "pcap_close_all()" called when
+			 * we exit.
+			 */
+			if (!pcap_do_addexit(handle)) {
 				/*
-				 * If we haven't already done so, arrange
-				 * to have "pcap_close_all()" called when
-				 * we exit.
+				 * "atexit()" failed; don't put
+				 * the interface in promiscuous
+				 * mode, just give up.
 				 */
-				if (!did_atexit) {
-					if (atexit(pcap_close_all) == -1) {
-						/*
-						 * "atexit()" failed; don't
-						 * put the interface in
-						 * promiscuous mode, just
-						 * give up.
-						 */
-						strncpy(ebuf, "atexit failed",
-							PCAP_ERRBUF_SIZE);
-						break;
-					}
-					did_atexit = 1;
-				}
-
-				ifr.ifr_flags |= IFF_PROMISC;
-				if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) {
-				        snprintf(ebuf, PCAP_ERRBUF_SIZE,
-						 "SIOCSIFFLAGS: %s",
-						 pcap_strerror(errno));
-					break;
-				}
-				handle->md.clear_promisc = 1;
+				return PCAP_ERROR;
+			}
 
-				/*
-				 * Add this to the list of pcaps
-				 * to close when we exit.
-				 */
-				handle->md.next = pcaps_to_close;
-				pcaps_to_close = handle;
+			ifr.ifr_flags |= IFF_PROMISC;
+			if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) {
+			        snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+					 "SIOCSIFFLAGS: %s",
+					 pcap_strerror(errno));
+				return PCAP_ERROR;
 			}
+			handle->md.must_clear |= MUST_CLEAR_PROMISC;
+
+			/*
+			 * Add this to the list of pcaps
+			 * to close when we exit.
+			 */
+			pcap_add_to_pcaps_to_close(handle);
 		}
+	}
 
+	/*
+	 * Compute the buffer size.
+	 *
+	 * We're using SOCK_PACKET, so this might be a 2.0[.x]
+	 * kernel, and might require special handling - check.
+	 */
+	if (uname(&utsname) < 0 ||
+	    strncmp(utsname.release, "2.0", 3) == 0) {
 		/*
-		 * Default value for offset to align link-layer payload
-		 * on a 4-byte boundary.
+		 * Either we couldn't find out what kernel release
+		 * this is, or it's a 2.0[.x] kernel.
+		 *
+		 * In the 2.0[.x] kernel, a "recvfrom()" on
+		 * a SOCK_PACKET socket, with MSG_TRUNC set, will
+		 * return the number of bytes read, so if we pass
+		 * a length based on the snapshot length, it'll
+		 * return the number of bytes from the packet
+		 * copied to userland, not the actual length
+		 * of the packet.
+		 *
+		 * This means that, for example, the IP dissector
+		 * in tcpdump will get handed a packet length less
+		 * than the length in the IP header, and will
+		 * complain about "truncated-ip".
+		 *
+		 * So we don't bother trying to copy from the
+		 * kernel only the bytes in which we're interested,
+		 * but instead copy them all, just as the older
+		 * versions of libpcap for Linux did.
+		 *
+		 * The buffer therefore needs to be big enough to
+		 * hold the largest packet we can get from this
+		 * device.  Unfortunately, we can't get the MRU
+		 * of the network; we can only get the MTU.  The
+		 * MTU may be too small, in which case a packet larger
+		 * than the buffer size will be truncated *and* we
+		 * won't get the actual packet size.
+		 *
+		 * However, if the snapshot length is larger than
+		 * the buffer size based on the MTU, we use the
+		 * snapshot length as the buffer size, instead;
+		 * this means that with a sufficiently large snapshot
+		 * length we won't artificially truncate packets
+		 * to the MTU-based size.
+		 *
+		 * This mess just one of many problems with packet
+		 * capture on 2.0[.x] kernels; you really want a
+		 * 2.2[.x] or later kernel if you want packet capture
+		 * to work well.
 		 */
-		handle->offset	 = 0;
-
-		return 1;
+		mtu = iface_get_mtu(handle->fd, device, handle->errbuf);
+		if (mtu == -1)
+			return PCAP_ERROR;
+		handle->bufsize = MAX_LINKHEADER_SIZE + mtu;
+		if (handle->bufsize < handle->snapshot)
+			handle->bufsize = handle->snapshot;
+	} else {
+		/*
+		 * This is a 2.2[.x] or later kernel.
+		 *
+		 * We can safely pass "recvfrom()" a byte count
+		 * based on the snapshot length.
+		 */
+		handle->bufsize = handle->snapshot;
+	}
 
-	} while (0);
+	/*
+	 * Default value for offset to align link-layer payload
+	 * on a 4-byte boundary.
+	 */
+	handle->offset	 = 0;
 
-	pcap_close_linux(handle);
-	return 0;
+	return 1;
 }
 
 /*
@@ -1971,7 +3344,13 @@ iface_get_arptype(int fd, const char *device, char *ebuf)
 	if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
 			 "SIOCGIFHWADDR: %s", pcap_strerror(errno));
-		return -1;
+		if (errno == ENODEV) {
+			/*
+			 * No such device.
+			 */
+			return PCAP_ERROR_NO_SUCH_DEVICE;
+		}
+		return PCAP_ERROR;
 	}
 
 	return ifr.ifr_hwaddr.sa_family;
@@ -1995,7 +3374,7 @@ fix_program(pcap_t *handle, struct sock_fprog *fcode)
 	len = handle->fcode.bf_len;
 	f = (struct bpf_insn *)malloc(prog_size);
 	if (f == NULL) {
-		snprintf(handle->errbuf, sizeof(handle->errbuf),
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 			 "malloc: %s", pcap_strerror(errno));
 		return -1;
 	}
@@ -2167,7 +3546,7 @@ set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode)
 			if (save_errno != EAGAIN) {
 				/* Fatal error */
 				reset_kernel_filter(handle);
-				snprintf(handle->errbuf, sizeof(handle->errbuf),
+				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 				 "recv: %s", pcap_strerror(save_errno));
 				return -2;
 			}
diff --git a/contrib/libpcap/pcap-namedb.h b/contrib/libpcap/pcap-namedb.h
index bbd06b0..e9ef300 100644
--- a/contrib/libpcap/pcap-namedb.h
+++ b/contrib/libpcap/pcap-namedb.h
@@ -31,60 +31,13 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD$
- * @(#) $Header: /tcpdump/master/libpcap/pcap-namedb.h,v 1.10 2005/03/17 07:02:32 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-namedb.h,v 1.13 2006/10/04 18:13:32 guy Exp $ (LBL)
  */
 
-#ifndef lib_pcap_namedb_h
-#define lib_pcap_namedb_h
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/*
- * As returned by the pcap_next_etherent()
- * XXX this stuff doesn't belong in this interface, but this
- * library already must do name to address translation, so
- * on systems that don't have support for /etc/ethers, we
- * export these hooks since they'll
- */
-struct pcap_etherent {
-	u_char addr[6];
-	char name[122];
-};
-#ifndef PCAP_ETHERS_FILE
-#define PCAP_ETHERS_FILE "/etc/ethers"
-#endif
-struct	pcap_etherent *pcap_next_etherent(FILE *);
-u_char *pcap_ether_hostton(const char*);
-u_char *pcap_ether_aton(const char *);
-
-bpf_u_int32 **pcap_nametoaddr(const char *);
-#ifdef INET6
-struct addrinfo *pcap_nametoaddrinfo(const char *);
-#endif
-bpf_u_int32 pcap_nametonetaddr(const char *);
-
-int	pcap_nametoport(const char *, int *, int *);
-int	pcap_nametoportrange(const char *, int *, int *, int *);
-int	pcap_nametoproto(const char *);
-int	pcap_nametoeproto(const char *);
-int	pcap_nametollc(const char *);
 /*
- * If a protocol is unknown, PROTO_UNDEF is returned.
- * Also, pcap_nametoport() returns the protocol along with the port number.
- * If there are ambiguous entried in /etc/services (i.e. domain
- * can be either tcp or udp) PROTO_UNDEF is returned.
+ * For backwards compatibility.
+ *
+ * Note to OS vendors: do NOT get rid of this file!  Some applications
+ * might expect to be able to include <pcap-namedb.h>.
  */
-#define PROTO_UNDEF		-1
-
-/* XXX move these to pcap-int.h? */
-int __pcap_atodn(const char *, bpf_u_int32 *);
-int __pcap_atoin(const char *, bpf_u_int32 *);
-u_short	__pcap_nametodnaddr(const char *);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
+#include <pcap/namedb.h>
diff --git a/contrib/libpcap/pcap-nit.c b/contrib/libpcap/pcap-nit.c
index 94c4528..ed04208 100644
--- a/contrib/libpcap/pcap-nit.c
+++ b/contrib/libpcap/pcap-nit.c
@@ -20,7 +20,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-nit.c,v 1.57.2.1 2005/05/03 18:54:37 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-nit.c,v 1.58.2.4 2008-04-14 20:41:52 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -99,7 +99,6 @@ static int
 pcap_read_nit(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 {
 	register int cc, n;
-	register struct bpf_insn *fcode = p->fcode.bf_insns;
 	register u_char *bp, *cp, *ep;
 	register struct nit_hdr *nh;
 	register int caplen;
@@ -175,13 +174,13 @@ pcap_read_nit(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		caplen = nh->nh_wirelen;
 		if (caplen > p->snapshot)
 			caplen = p->snapshot;
-		if (bpf_filter(fcode, cp, nh->nh_wirelen, caplen)) {
+		if (bpf_filter(p->fcode.bf_insns, cp, nh->nh_wirelen, caplen)) {
 			struct pcap_pkthdr h;
 			h.ts = nh->nh_timestamp;
 			h.len = nh->nh_wirelen;
 			h.caplen = caplen;
 			(*callback)(user, &h, cp);
-			if (++n >= cnt && cnt >= 0) {
+			if (++n >= cnt && cnt > 0) {
 				p->cc = ep - bp;
 				p->bp = bp;
 				return (n);
@@ -238,51 +237,43 @@ nit_setflags(int fd, int promisc, int to_ms, char *ebuf)
 	return (0);
 }
 
-static void
-pcap_close_nit(pcap_t *p)
-{
-	pcap_close_common(p);
-	if (p->device != NULL)
-		free(p->device);
-}
-
-pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+static int
+pcap_activate_nit(pcap_t *p)
 {
 	int fd;
 	struct sockaddr_nit snit;
-	register pcap_t *p;
 
-	p = (pcap_t *)malloc(sizeof(*p));
-	if (p == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
-		return (NULL);
+	if (p->opt.rfmon) {
+		/*
+		 * No monitor mode on SunOS 3.x or earlier (no
+		 * Wi-Fi *devices* for the hardware that supported
+		 * them!).
+		 */
+		return (PCAP_ERROR_RFMON_NOTSUP);
 	}
 
-	if (snaplen < 96)
+	if (p->snapshot < 96)
 		/*
 		 * NIT requires a snapshot length of at least 96.
 		 */
-		snaplen = 96;
+		p->snapshot = 96;
 
 	memset(p, 0, sizeof(*p));
 	p->fd = fd = socket(AF_NIT, SOCK_RAW, NITPROTO_RAW);
 	if (fd < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 		    "socket: %s", pcap_strerror(errno));
 		goto bad;
 	}
 	snit.snit_family = AF_NIT;
-	(void)strncpy(snit.snit_ifname, device, NITIFSIZ);
+	(void)strncpy(snit.snit_ifname, p->opt.source, NITIFSIZ);
 
 	if (bind(fd, (struct sockaddr *)&snit, sizeof(snit))) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 		    "bind: %s: %s", snit.snit_ifname, pcap_strerror(errno));
 		goto bad;
 	}
-	p->snapshot = snaplen;
-	nit_setflags(p->fd, promisc, to_ms, ebuf);
+	nit_setflags(p->fd, p->opt.promisc, p->md.timeout, p->errbuf);
 
 	/*
 	 * NIT supports only ethernets.
@@ -292,17 +283,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->bufsize = BUFSPACE;
 	p->buffer = (u_char *)malloc(p->bufsize);
 	if (p->buffer == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
-		goto bad;
-	}
-
-	/*
-	 * We need the device name in order to send packets.
-	 */
-	p->device = strdup(device);
-	if (p->device == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
-		free(p->buffer);
+		strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
 		goto bad;
 	}
 
@@ -339,14 +320,23 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->getnonblock_op = pcap_getnonblock_fd;
 	p->setnonblock_op = pcap_setnonblock_fd;
 	p->stats_op = pcap_stats_nit;
-	p->close_op = pcap_close_nit;
 
-	return (p);
+	return (0);
  bad:
-	if (fd >= 0)
-		close(fd);
-	free(p);
-	return (NULL);
+	return (PCAP_ERROR);
+}
+
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_nit;
+	return (p);
 }
 
 int
diff --git a/contrib/libpcap/pcap-nit.h b/contrib/libpcap/pcap-nit.h
deleted file mode 100644
index 52f5fc4..0000000
--- a/contrib/libpcap/pcap-nit.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright (c) 1990, 1994
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms are permitted
- * provided that the above copyright notice and this paragraph are
- * duplicated in all such forms and that any documentation,
- * advertising materials, and other materials related to such
- * distribution and use acknowledge that the software was developed
- * by the University of California, Lawrence Berkeley Laboratory,
- * Berkeley, CA.  The name of the University may not be used to
- * endorse or promote products derived from this software without
- * specific prior written permission.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- *
- * @(#) $Header: /tcpdump/master/libpcap/pcap-nit.h,v 1.2.1.1 1999/10/07 23:46:40 mcr Exp $ (LBL)
- */
diff --git a/contrib/libpcap/pcap-null.c b/contrib/libpcap/pcap-null.c
index 06e3ab3..f72a0c3 100644
--- a/contrib/libpcap/pcap-null.c
+++ b/contrib/libpcap/pcap-null.c
@@ -20,7 +20,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-null.c,v 1.21 2003/11/15 23:24:03 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-null.c,v 1.21.4.1 2008-04-04 19:39:06 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -40,10 +40,9 @@ static const char rcsid[] _U_ =
 static char nosup[] = "live packet capture not supported on this system";
 
 pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+pcap_activate(pcap_t *p)
 {
-	(void)strlcpy(ebuf, nosup, PCAP_ERRBUF_SIZE);
+	(void)strlcpy(p->errbuf, nosup, PCAP_ERRBUF_SIZE);
 	return (NULL);
 }
 
diff --git a/contrib/libpcap/pcap-pf.c b/contrib/libpcap/pcap-pf.c
index e733540..be93814 100644
--- a/contrib/libpcap/pcap-pf.c
+++ b/contrib/libpcap/pcap-pf.c
@@ -24,7 +24,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.91.2.2 2005/05/03 18:54:37 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.94.2.3 2008-04-14 20:41:52 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -62,7 +62,7 @@ struct rtentry;
 #include <unistd.h>
 
 /*
- * Make "pcap.h" not include "pcap-bpf.h"; we are going to include the
+ * Make "pcap.h" not include "pcap/bpf.h"; we are going to include the
  * native OS version, as we need various BPF ioctls from it.
  */
 #define PCAP_DONT_INCLUDE_PCAP_BPF_H
@@ -88,7 +88,6 @@ static int
 pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user)
 {
 	register u_char *p, *bp;
-	struct bpf_insn *fcode;
 	register int cc, n, buflen, inc;
 	register struct enstamp *sp;
 #ifdef LBL_ALIGN
@@ -98,7 +97,6 @@ pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user)
 	register int pad;
 #endif
 
-	fcode = pc->md.use_bpf ? NULL : pc->fcode.bf_insns;
  again:
 	cc = pc->cc;
 	if (cc == 0) {
@@ -187,7 +185,8 @@ pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user)
 
 		/*
 		 * Short-circuit evaluation: if using BPF filter
-		 * in kernel, no need to do it now.
+		 * in kernel, no need to do it now - we already know
+		 * the packet passed the filter.
 		 *
 #ifdef PCAP_FDDIPAD
 		 * Note: the filter code was generated assuming
@@ -197,8 +196,8 @@ pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user)
 		 * skipping that padding.
 #endif
 		 */
-		if (fcode == NULL ||
-		    bpf_filter(fcode, p, sp->ens_count, buflen)) {
+		if (pc->md.use_bpf ||
+		    bpf_filter(pc->fcode.bf_insns, p, sp->ens_count, buflen)) {
 			struct pcap_pkthdr h;
 			pc->md.TotAccepted++;
 			h.ts = sp->ens_tstamp;
@@ -285,30 +284,21 @@ pcap_stats_pf(pcap_t *p, struct pcap_stat *ps)
 }
 
 /*
- * We include the OS's <net/bpf.h>, not our "pcap-bpf.h", so we probably
+ * We include the OS's <net/bpf.h>, not our "pcap/bpf.h", so we probably
  * don't get DLT_DOCSIS defined.
  */
 #ifndef DLT_DOCSIS
 #define DLT_DOCSIS	143
 #endif
 
-pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+static int
+pcap_activate_pf(pcap_t *p)
 {
-	pcap_t *p;
 	short enmode;
 	int backlog = -1;	/* request the most */
 	struct enfilter Filter;
 	struct endevp devparams;
 
-	p = (pcap_t *)malloc(sizeof(*p));
-	if (p == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,
-		    "pcap_open_live: %s", pcap_strerror(errno));
-		return (0);
-	}
-	memset(p, 0, sizeof(*p));
 	/*
 	 * Initially try a read/write open (to allow the inject
 	 * method to work).  If that fails due to permission
@@ -328,21 +318,21 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * "const char *" as its first argument.  That appears to be
 	 * the case, at least on Digital UNIX 4.0.
 	 */
-	p->fd = pfopen(device, O_RDWR);
+	p->fd = pfopen(p->opt.source, O_RDWR);
 	if (p->fd == -1 && errno == EACCES)
-		p->fd = pfopen(device, O_RDONLY);
+		p->fd = pfopen(p->opt.source, O_RDONLY);
 	if (p->fd < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "pf open: %s: %s\n\
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "pf open: %s: %s\n\
 your system may not be properly configured; see the packetfilter(4) man page\n",
-			device, pcap_strerror(errno));
+			p->opt.source, pcap_strerror(errno));
 		goto bad;
 	}
 	p->md.OrigMissed = -1;
 	enmode = ENTSTAMP|ENBATCH|ENNONEXCL;
-	if (promisc)
+	if (p->opt.promisc)
 		enmode |= ENPROMISC;
 	if (ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCMBIS: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCMBIS: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
@@ -353,13 +343,13 @@ your system may not be properly configured; see the packetfilter(4) man page\n",
 #endif
 	/* set the backlog */
 	if (ioctl(p->fd, EIOCSETW, (caddr_t)&backlog) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSETW: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCSETW: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 	/* discover interface type */
 	if (ioctl(p->fd, EIOCDEVP, (caddr_t)&devparams) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCDEVP: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCDEVP: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
@@ -441,8 +431,8 @@ your system may not be properly configured; see the packetfilter(4) man page\n",
 		 * framing", there's not much we can do, as that
 		 * doesn't specify a particular type of header.
 		 */
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "unknown data-link type %u",
-		    devparams.end_dev_type);
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+		    "unknown data-link type %u", devparams.end_dev_type);
 		goto bad;
 	}
 	/* set truncation */
@@ -451,32 +441,31 @@ your system may not be properly configured; see the packetfilter(4) man page\n",
 		p->fddipad = PCAP_FDDIPAD;
 
 		/* packetfilter includes the padding in the snapshot */
-		snaplen += PCAP_FDDIPAD;
+		p->snapshot += PCAP_FDDIPAD;
 	} else
 		p->fddipad = 0;
 #endif
-	if (ioctl(p->fd, EIOCTRUNCATE, (caddr_t)&snaplen) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCTRUNCATE: %s",
+	if (ioctl(p->fd, EIOCTRUNCATE, (caddr_t)&p->snapshot) < 0) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCTRUNCATE: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
-	p->snapshot = snaplen;
 	/* accept all packets */
 	memset(&Filter, 0, sizeof(Filter));
 	Filter.enf_Priority = 37;	/* anything > 2 */
 	Filter.enf_FilterLen = 0;	/* means "always true" */
 	if (ioctl(p->fd, EIOCSETF, (caddr_t)&Filter) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSETF: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCSETF: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 
-	if (to_ms != 0) {
+	if (p->md.timeout != 0) {
 		struct timeval timeout;
-		timeout.tv_sec = to_ms / 1000;
-		timeout.tv_usec = (to_ms * 1000) % 1000000;
+		timeout.tv_sec = p->md.timeout / 1000;
+		timeout.tv_usec = (p->md.timeout * 1000) % 1000000;
 		if (ioctl(p->fd, EIOCSRTIMEOUT, (caddr_t)&timeout) < 0) {
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSRTIMEOUT: %s",
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCSRTIMEOUT: %s",
 				pcap_strerror(errno));
 			goto bad;
 		}
@@ -485,7 +474,7 @@ your system may not be properly configured; see the packetfilter(4) man page\n",
 	p->bufsize = BUFSPACE;
 	p->buffer = (u_char*)malloc(p->bufsize + p->offset);
 	if (p->buffer == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
+		strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
 		goto bad;
 	}
 
@@ -502,19 +491,23 @@ your system may not be properly configured; see the packetfilter(4) man page\n",
 	p->getnonblock_op = pcap_getnonblock_fd;
 	p->setnonblock_op = pcap_setnonblock_fd;
 	p->stats_op = pcap_stats_pf;
-	p->close_op = pcap_close_common;
 
-	return (p);
+	return (0);
  bad:
-	if (p->fd >= 0)
-		close(p->fd);
-	/*
-	 * Get rid of any link-layer type list we allocated.
-	 */
-	if (p->dlt_list != NULL)
-		free(p->dlt_list);
-	free(p);
-	return (NULL);
+	return (PCAP_ERROR);
+}
+
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_pf;
+	return (p);
 }
 
 int
diff --git a/contrib/libpcap/pcap-pf.h b/contrib/libpcap/pcap-pf.h
deleted file mode 100644
index 60bea83..0000000
--- a/contrib/libpcap/pcap-pf.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright (c) 1990, 1994
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms are permitted
- * provided that the above copyright notice and this paragraph are
- * duplicated in all such forms and that any documentation,
- * advertising materials, and other materials related to such
- * distribution and use acknowledge that the software was developed
- * by the University of California, Lawrence Berkeley Laboratory,
- * Berkeley, CA.  The name of the University may not be used to
- * endorse or promote products derived from this software without
- * specific prior written permission.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- *
- * @(#) $Header: /tcpdump/master/libpcap/pcap-pf.h,v 1.2.1.1 1999/10/07 23:46:40 mcr Exp $ (LBL)
- */
diff --git a/contrib/libpcap/pcap-savefile.manfile b/contrib/libpcap/pcap-savefile.manfile
new file mode 100644
index 0000000..21fdb2e
--- /dev/null
+++ b/contrib/libpcap/pcap-savefile.manfile
@@ -0,0 +1,127 @@
+'\" t
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap-savefile.manfile.in,v 1.1.2.3 2008-10-24 07:34:06 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP-SAVEFILE 5 "21 October 2008"
+.SH NAME
+pcap-savefile \- libpcap savefile format
+.SH DESCRIPTION
+NOTE: applications and libraries should, if possible, use libpcap to
+read savefiles, rather than having their own code to read savefiles. 
+If, in the future, a new file format is supported by libpcap,
+applications and libraries using libpcap to read savefiles will be able
+to read the new format of savefiles, but applications and libraries
+using their own code to read savefiles will have to be changed to
+support the new file format.
+.PP
+``Savefiles'' read and written by libpcap and applications using libpcap
+start with a per-file header.  The format of the per-file header is:
+.RS
+.TS
+box;
+c s
+c | c
+c s.
+Magic number
+_
+Major version	Minor version
+_
+Time zone offset
+_
+Time stamp accuracy
+_
+Snapshot length
+_
+Link-layer header type
+.TE
+.RE
+.PP
+All fields in the per-file header are in the byte order of the host
+writing the file.  The first field in the per-file header is a 4-byte
+magic number, with the value 0xa1b2c3d4.  The magic number, when read by
+a host with the same byte order as the host that wrote the file, will
+have the value 0xa1b2c3d4, and, when read by a host with the opposite
+byte order as the host that wrote the file, will have the value
+0xd4c3b2a1.  That allows software reading the file to determine whether
+the byte order of the host that wrote the file is the same as the byte
+order of the host on which the file is being read, and thus whether the
+values in the per-file and per-packet headers need to be byte-swapped.
+.PP
+Following this are:
+.IP
+A 2-byte file format major version number; the current version number is
+2.
+.IP
+A 2-byte file format minor version number; the current version number is
+4.
+.IP
+A 4-byte time zone offset; this is always 0.
+.IP
+A 4-byte number giving the accuracy of time stamps in the file; this is
+always 0.
+.IP
+A 4-byte number giving the "snapshot length" of the capture; packets
+longer than the snapshot length are truncated to the snapshot length, so
+that, if the snapshot length is
+.IR N ,
+only the first
+.I N
+bytes of a packet longer than
+.I N
+bytes will be saved in the capture.
+.IP
+a 4-byte number giving the link-layer header type for packets in the
+capture; see
+.BR pcap-linktype (7)
+for the
+.B LINKTYPE_
+values that can appear in this field.
+.PP
+Following the per-file header are zero or more packets; each packet
+begins with a per-packet header, which is immediately followed by the
+raw packet data.  The format of the per-packet header is:
+.RS
+.TS
+box;
+c.
+Time stamp, seconds value
+_
+Time stamp, microseconds value
+_
+Length of captured packet data
+_
+Un-truncated length of the packet data
+.TE
+.RE
+.PP
+All fields in the per-packet header are in the byte order of the host
+writing the file.  The per-packet header begins with a time stamp giving
+the approximate time the packet was captured; the time stamp consists of
+a 4-byte value, giving the time in seconds since January 1, 1970,
+00:00:00 UTC, followed by a 4-byte value, giving the time in
+microseconds since that second.  Following that are a 4-byte value
+giving the number of bytes of captured data that follow the per-packet
+header and a 4-byte value giving the number of bytes that would have
+been present had the packet not been truncated by the snapshot length. 
+The two lengths will be equal if the number of bytes of packet data are
+less than or equal to the snapshot length.
+.SH SEE ALSO
+pcap(3PCAP), pcap-linktype(7)
diff --git a/contrib/libpcap/pcap-savefile.manfile.in b/contrib/libpcap/pcap-savefile.manfile.in
new file mode 100644
index 0000000..3b9503f
--- /dev/null
+++ b/contrib/libpcap/pcap-savefile.manfile.in
@@ -0,0 +1,127 @@
+'\" t
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap-savefile.manfile.in,v 1.1.2.3 2008-10-24 07:34:06 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP-SAVEFILE @MAN_FILE_FORMATS@ "21 October 2008"
+.SH NAME
+pcap-savefile \- libpcap savefile format
+.SH DESCRIPTION
+NOTE: applications and libraries should, if possible, use libpcap to
+read savefiles, rather than having their own code to read savefiles. 
+If, in the future, a new file format is supported by libpcap,
+applications and libraries using libpcap to read savefiles will be able
+to read the new format of savefiles, but applications and libraries
+using their own code to read savefiles will have to be changed to
+support the new file format.
+.PP
+``Savefiles'' read and written by libpcap and applications using libpcap
+start with a per-file header.  The format of the per-file header is:
+.RS
+.TS
+box;
+c s
+c | c
+c s.
+Magic number
+_
+Major version	Minor version
+_
+Time zone offset
+_
+Time stamp accuracy
+_
+Snapshot length
+_
+Link-layer header type
+.TE
+.RE
+.PP
+All fields in the per-file header are in the byte order of the host
+writing the file.  The first field in the per-file header is a 4-byte
+magic number, with the value 0xa1b2c3d4.  The magic number, when read by
+a host with the same byte order as the host that wrote the file, will
+have the value 0xa1b2c3d4, and, when read by a host with the opposite
+byte order as the host that wrote the file, will have the value
+0xd4c3b2a1.  That allows software reading the file to determine whether
+the byte order of the host that wrote the file is the same as the byte
+order of the host on which the file is being read, and thus whether the
+values in the per-file and per-packet headers need to be byte-swapped.
+.PP
+Following this are:
+.IP
+A 2-byte file format major version number; the current version number is
+2.
+.IP
+A 2-byte file format minor version number; the current version number is
+4.
+.IP
+A 4-byte time zone offset; this is always 0.
+.IP
+A 4-byte number giving the accuracy of time stamps in the file; this is
+always 0.
+.IP
+A 4-byte number giving the "snapshot length" of the capture; packets
+longer than the snapshot length are truncated to the snapshot length, so
+that, if the snapshot length is
+.IR N ,
+only the first
+.I N
+bytes of a packet longer than
+.I N
+bytes will be saved in the capture.
+.IP
+a 4-byte number giving the link-layer header type for packets in the
+capture; see
+.BR pcap-linktype (@MAN_MISC_INFO@)
+for the
+.B LINKTYPE_
+values that can appear in this field.
+.PP
+Following the per-file header are zero or more packets; each packet
+begins with a per-packet header, which is immediately followed by the
+raw packet data.  The format of the per-packet header is:
+.RS
+.TS
+box;
+c.
+Time stamp, seconds value
+_
+Time stamp, microseconds value
+_
+Length of captured packet data
+_
+Un-truncated length of the packet data
+.TE
+.RE
+.PP
+All fields in the per-packet header are in the byte order of the host
+writing the file.  The per-packet header begins with a time stamp giving
+the approximate time the packet was captured; the time stamp consists of
+a 4-byte value, giving the time in seconds since January 1, 1970,
+00:00:00 UTC, followed by a 4-byte value, giving the time in
+microseconds since that second.  Following that are a 4-byte value
+giving the number of bytes of captured data that follow the per-packet
+header and a 4-byte value giving the number of bytes that would have
+been present had the packet not been truncated by the snapshot length. 
+The two lengths will be equal if the number of bytes of packet data are
+less than or equal to the snapshot length.
+.SH SEE ALSO
+pcap(3PCAP), pcap-linktype(@MAN_MISC_INFO@)
diff --git a/contrib/libpcap/pcap-septel.c b/contrib/libpcap/pcap-septel.c
index 5169ec0..c0473bb 100644
--- a/contrib/libpcap/pcap-septel.c
+++ b/contrib/libpcap/pcap-septel.c
@@ -16,7 +16,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-septel.c,v 1.1.2.2 2005/06/21 01:03:23 guy Exp $";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-septel.c,v 1.2.2.2 2008-04-14 20:41:52 guy Exp $";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -50,8 +50,8 @@ static const char rcsid[] _U_ =
 /* This code is required when compiling for a Septel device only. */
 #include "pcap-septel.h"
 
-/* Replace dag function names with pcap equivalent. */
-#define septel_open_live pcap_open_live
+/* Replace septel function names with pcap equivalent. */
+#define septel_create pcap_create
 #define septel_platform_finddevs pcap_platform_finddevs
 #endif /* SEPTEL_ONLY */
 
@@ -59,12 +59,6 @@ static int septel_setfilter(pcap_t *p, struct bpf_program *fp);
 static int septel_stats(pcap_t *p, struct pcap_stat *ps);
 static int septel_setnonblock(pcap_t *p, int nonblock, char *errbuf);
 
-static void septel_platform_close(pcap_t *p) {
-
-}
-
-
-
 /*
  *  Read at most max_packets from the capture queue and call the callback
  *  for each of them. Returns the number of packets handled, -1 if an
@@ -199,28 +193,14 @@ septel_inject(pcap_t *handle, const void *buf _U_, size_t size _U_)
 }
 
 /*
- *  Get a handle for a live capture from the given Septel device.  Always pass a NULL device
+ *  Activate a handle for a live capture from the given Septel device.  Always pass a NULL device
  *  The promisc flag is ignored because Septel cards have built-in tracing.
- *  The to_ms parameter is also ignored as it is
- *  not supported in hardware.
+ *  The timeout is also ignored as it is not supported in hardware.
  *
  *  See also pcap(3).
  */
-pcap_t *septel_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebuf) {
-  pcap_t *handle;
-
-  handle = malloc(sizeof(*handle));
-  if (handle == NULL) {
-    snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc %s: %s", device, pcap_strerror(errno));
-    return NULL;
-  }
-
-  /* Initialize some components of the pcap structure. */
-  
-  memset(handle, 0, sizeof(*handle));
-  
-  handle->snapshot = snaplen;
-
+static pcap_t *septel_activate(pcap_t* handle) {
+  /* Initialize some components of the pcap structure. */  
   handle->linktype = DLT_MTP2;
   
   handle->bufsize = 0;
@@ -237,16 +217,19 @@ pcap_t *septel_open_live(const char *device, int snaplen, int promisc, int to_ms
   handle->getnonblock_op = pcap_getnonblock_fd;
   handle->setnonblock_op = septel_setnonblock;
   handle->stats_op = septel_stats;
-  handle->close_op = septel_platform_close;
 
-  return handle;
+  return 0;
+}
 
-fail:
-  if (handle != NULL) {
-    free(handle);
-  }
+pcap_t *septel_create(const char *device, char *ebuf) {
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return NULL;
 
-  return NULL;
+	p->activate_op = septel_activate;
+	return p;
 }
 
 static int septel_stats(pcap_t *p, struct pcap_stat *ps) {
diff --git a/contrib/libpcap/pcap-septel.h b/contrib/libpcap/pcap-septel.h
index 1de6377..c916797 100644
--- a/contrib/libpcap/pcap-septel.h
+++ b/contrib/libpcap/pcap-septel.h
@@ -8,8 +8,8 @@
  * Authors: Gilbert HOYEK (gil_hoyek@hotmail.com), Elias M. KHOURY
  * (+961 3 485343);
  *
- * @(#) $Header: /tcpdump/master/libpcap/pcap-septel.h,v 1.1.2.1 2005/06/20 21:30:19 guy Exp $
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-septel.h,v 1.1.4.1 2008-04-04 19:39:06 guy Exp $
  */
 
-pcap_t *septel_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebuf);
+pcap_t *septel_create(const char *device, char *ebuf);
 
diff --git a/contrib/libpcap/pcap-sita.c b/contrib/libpcap/pcap-sita.c
new file mode 100644
index 0000000..971f8b0
--- /dev/null
+++ b/contrib/libpcap/pcap-sita.c
@@ -0,0 +1,980 @@
+/*
+ *  pcap-sita.c: Packet capture interface additions for SITA ACN devices
+ *
+ *  Copyright (c) 2007 Fulko Hew, SITA INC Canada, Inc <fulko.hew@sita.aero>
+ *
+ *  License: BSD
+ *
+ *  Redistribution and use in source and binary forms, with or without
+ *  modification, are permitted provided that the following conditions
+ *  are met:
+ *
+ *  1. Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *  2. Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in
+ *     the documentation and/or other materials provided with the
+ *     distribution.
+ *  3. The names of the authors may not be used to endorse or promote
+ *     products derived from this software without specific prior
+ *     written permission.
+ *
+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ *  IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ *  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+ /* $Id: pcap-sita.c */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/time.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include "pcap-int.h"
+
+#include "pcap-sita.h"
+
+	/* non-configureable manifests follow */
+
+#define IOP_SNIFFER_PORT	49152			/* TCP port on the IOP used for 'distributed pcap' usage */
+#define MAX_LINE_SIZE		255				/* max size of a buffer/line in /etc/hosts we allow */
+#define MAX_CHASSIS			8				/* number of chassis in an ACN site */
+#define MAX_GEOSLOT			8				/* max number of access units in an ACN site */
+
+#define FIND			0
+#define LIVE			1
+
+typedef struct iface {
+	struct iface	*next;					/* a pointer to the next interface */
+	char			*name;					/* this interface's name on Wireshark */
+	char			*IOPname;				/* this interface's name on an IOP */
+	uint32_t		iftype;					/* the type of interface (DLT values) */
+} iface_t;
+
+typedef struct unit {
+	char				*ip;				/* this unit's IP address (as extracted from /etc/hosts) */
+	int					fd;					/* the connection to this unit (if it exists) */
+	int					find_fd;			/* a big kludge to avoid my programming limitations since I could have this unit open for findalldevs purposes */
+	int					first_time;			/* 0 = just opened via acn_open_live(),  ie. the first time, NZ = nth time */
+	struct sockaddr_in	*serv_addr;			/* the address control block for comms to this unit */
+	int					chassis;
+	int					geoslot;
+	iface_t				*iface;				/* a pointer to a linked list of interface structures */
+	char				*imsg;				/* a pointer to an inbound message */
+	int					len;				/* the current size of the inbound message */
+} unit_t;
+
+static char			*errorString;
+static unit_t		units[MAX_CHASSIS+1][MAX_GEOSLOT+1];	/* we use indexes of 1 through 8, but we reserve/waste index 0 */
+static fd_set		readfds;								/* a place to store the file descriptors for the connections to the IOPs */
+static fd_set		working_set;
+static int			max_fs;
+static char			static_buf[32];
+
+pcap_if_t			*acn_if_list;							/* pcap's list of available interfaces */
+
+static void dump_interface_list(void) {
+	pcap_if_t		*iff;
+	pcap_addr_t		*addr;
+	int				longest_name_len = 0;
+	char			*n, *d, *f;
+	int				if_number = 0;
+
+	iff = acn_if_list;
+	while (iff) {
+		if (iff->name && (strlen(iff->name) > longest_name_len)) longest_name_len = strlen(iff->name);
+		iff = iff->next;
+	}
+	iff = acn_if_list;
+	printf("Interface List:\n");
+	while (iff) {
+		n = (iff->name)							? iff->name			: "";
+		d = (iff->description)					? iff->description	: "";
+		f = (iff->flags == PCAP_IF_LOOPBACK)	? "L"				: "";
+		printf("%3d: %*s %s '%s'\n", if_number++, longest_name_len, n, f, d);
+		addr = iff->addresses;
+		while (addr) {
+			printf("%*s ", (5 + longest_name_len), "");		/* add some indentation */
+			printf("%15s  ", (addr->addr)		? inet_ntoa(((struct sockaddr_in *)addr->addr)->sin_addr)		: "");
+			printf("%15s  ", (addr->netmask)	? inet_ntoa(((struct sockaddr_in *)addr->netmask)->sin_addr)	: "");
+			printf("%15s  ", (addr->broadaddr)	? inet_ntoa(((struct sockaddr_in *)addr->broadaddr)->sin_addr)	: "");
+			printf("%15s  ", (addr->dstaddr)	? inet_ntoa(((struct sockaddr_in *)addr->dstaddr)->sin_addr)	: "");
+			printf("\n");
+			addr = addr->next;
+		}
+		iff = iff->next;
+	}
+}
+
+static void dump(unsigned char *ptr, int i, int indent) {
+	fprintf(stderr, "%*s", indent, " ");
+	for (; i > 0; i--) {
+		fprintf(stderr, "%2.2x ", *ptr++);
+	}
+	fprintf(stderr, "\n");
+}
+
+static void dump_interface_list_p(void) {
+	pcap_if_t		*iff;
+	pcap_addr_t		*addr;
+	int				if_number = 0;
+
+	iff = acn_if_list;
+	printf("Interface Pointer @ %p is %p:\n", &acn_if_list, iff);
+	while (iff) {
+		printf("%3d: %p %p next: %p\n", if_number++, iff->name, iff->description, iff->next);
+		dump((unsigned char *)iff, sizeof(pcap_if_t), 5);
+		addr = iff->addresses;
+		while (addr) {
+			printf("          %p %p %p %p, next: %p\n", addr->addr, addr->netmask, addr->broadaddr, addr->dstaddr, addr->next);
+			dump((unsigned char *)addr, sizeof(pcap_addr_t), 10);
+			addr = addr->next;
+		}
+		iff = iff->next;
+	}
+}
+
+static void dump_unit_table(void) {
+	int		chassis, geoslot;
+	iface_t	*p;
+
+	printf("%c:%c %s %s\n", 'C', 'S', "fd", "IP Address");
+	for (chassis = 0; chassis <= MAX_CHASSIS; chassis++) {
+		for (geoslot = 0; geoslot <= MAX_GEOSLOT; geoslot++) {
+			if (units[chassis][geoslot].ip != NULL)
+				printf("%d:%d %2d %s\n", chassis, geoslot, units[chassis][geoslot].fd, units[chassis][geoslot].ip);
+			p = units[chassis][geoslot].iface;
+			while (p) {
+				char *n = (p->name)			? p->name			: "";
+				char *i = (p->IOPname)		? p->IOPname		: "";
+				p = p->next;
+				printf("   %12s    -> %12s\n", i, n);
+			}
+		}
+	}
+}
+
+static int find_unit_by_fd(int fd, int *chassis, int *geoslot, unit_t **unit_ptr) {
+	int		c, s;
+
+	for (c = 0; c <= MAX_CHASSIS; c++) {
+		for (s = 0; s <= MAX_GEOSLOT; s++) {
+			if (units[c][s].fd == fd || units[c][s].find_fd == fd) {
+				if (chassis)	*chassis = c;
+				if (geoslot)	*geoslot = s;
+				if (unit_ptr)	*unit_ptr = &units[c][s];
+				return 1;
+			}
+		}
+	}
+	return 0;
+}
+
+static int read_client_nbytes(int fd, int count, unsigned char *buf) {
+	unit_t			*u;
+	int				chassis, geoslot;
+	int				len;
+
+	find_unit_by_fd(fd, &chassis, &geoslot, &u);
+	while (count) {
+		if ((len = recv(fd, buf, count, 0)) <= 0)	return -1;	/* read in whatever data was sent to us */
+		count -= len;	
+		buf += len;
+	}															/* till we have everything we are looking for */
+	return 0;
+}
+
+static void empty_unit_iface(unit_t *u) {
+	iface_t	*p, *cur;
+
+	cur = u->iface;
+	while (cur) {											/* loop over all the interface entries */
+		if (cur->name)			free(cur->name);			/* throwing away the contents if they exist */
+		if (cur->IOPname)		free(cur->IOPname);
+		p = cur->next;
+		free(cur);											/* then throw away the structure itself */
+		cur = p;
+	}
+	u->iface = 0;											/* and finally remember that there are no remaining structure */
+}
+
+static void empty_unit(int chassis, int geoslot) {
+	unit_t	*u = &units[chassis][geoslot];
+
+	empty_unit_iface(u);
+	if (u->imsg) {											/* then if an inbound message buffer exists */
+		u->imsg = (char *)realloc(u->imsg, 1);				/* and re-allocate the old large buffer into a new small one */
+	}
+}
+
+static void empty_unit_table(void) {
+	int		chassis, geoslot;
+
+	for (chassis = 0; chassis <= MAX_CHASSIS; chassis++) {
+		for (geoslot = 0; geoslot <= MAX_GEOSLOT; geoslot++) {
+			if (units[chassis][geoslot].ip != NULL) {
+				free(units[chassis][geoslot].ip);			/* get rid of the malloc'ed space that holds the IP address */
+				units[chassis][geoslot].ip = 0;				/* then set the pointer to NULL */
+			}
+			empty_unit(chassis, geoslot);
+		}
+	}
+}
+
+static char *find_nth_interface_name(int n) {
+	int		chassis, geoslot;
+	iface_t	*p;
+	char	*last_name = 0;
+
+	if (n < 0) n = 0;												/* ensure we are working with a valid number */
+	for (chassis = 0; chassis <= MAX_CHASSIS; chassis++) {			/* scan the table... */
+		for (geoslot = 0; geoslot <= MAX_GEOSLOT; geoslot++) {
+			if (units[chassis][geoslot].ip != NULL) {
+				p = units[chassis][geoslot].iface;
+				while (p) {											/* and all interfaces... */
+					if (p->IOPname) last_name = p->name;			/* remembering the last name found */
+					if (n-- == 0) return last_name;					/* and if we hit the instance requested */
+					p = p->next;
+				}
+			}
+		}
+	}
+											/* if we couldn't fine the selected entry */
+	if (last_name)	return last_name;		/* ... but we did have at least one entry... return the last entry found */
+	return "";								/* ... but if there wasn't any entry... return an empty string instead */
+}
+
+int acn_parse_hosts_file(char *errbuf) {				/* returns: -1 = error, 0 = OK */
+	FILE	*fp;
+	char	buf[MAX_LINE_SIZE];
+	char	*ptr, *ptr2;
+	int		pos;
+	int		chassis, geoslot;
+	unit_t	*u;
+
+	empty_unit_table();
+	if ((fp = fopen("/etc/hosts", "r")) == NULL) {										/* try to open the hosts file and if it fails */
+		snprintf(errbuf, PCAP_ERRBUF_SIZE, "Cannot open '/etc/hosts' for reading.");	/* return the nohostsfile error response */
+		return -1;
+	}
+	while (fgets(buf, MAX_LINE_SIZE-1, fp)) {			/* while looping over the file */
+
+		pos = strcspn(buf, "#\n\r");					/* find the first comment character or EOL */
+		*(buf + pos) = '\0';							/* and clobber it and anything that follows it */
+
+		pos = strspn(buf, " \t");						/* then find the first non-white space */
+		if (pos == strlen(buf))							/* if there is nothing but white space on the line */
+			continue;									/* ignore that empty line */
+		ptr = buf + pos;								/* and skip over any of that leading whitespace */
+
+		if ((ptr2 = strstr(ptr, "_I_")) == NULL)		/* skip any lines that don't have names that look like they belong to IOPs */
+			continue;
+		if (*(ptr2 + 4) != '_')							/* and skip other lines that have names that don't look like ACN components */
+			continue;
+		*(ptr + strcspn(ptr, " \t")) = '\0';			/* null terminate the IP address so its a standalone string */
+
+		chassis = *(ptr2 + 3) - '0';					/* extract the chassis number */
+		geoslot = *(ptr2 + 5) - '0';					/* and geo-slot number */
+		if (chassis < 1 || chassis > MAX_CHASSIS ||
+			geoslot < 1 || geoslot > MAX_GEOSLOT) {		/* if the chassis and/or slot numbers appear to be bad... */
+			snprintf(errbuf, PCAP_ERRBUF_SIZE, "Invalid ACN name in '/etc/hosts'.");	/* warn the user */
+			continue;																	/* and ignore the entry */
+		}
+		if ((ptr2 = (char *)malloc(strlen(ptr) + 1)) == NULL) {
+			snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+			continue;
+		}
+		strcpy(ptr2, ptr);								/* copy the IP address into our malloc'ed memory */
+		u = &units[chassis][geoslot];
+		u->ip = ptr2;									/* and remember the whole shebang */
+		u->chassis = chassis;
+		u->geoslot = geoslot;
+	}
+	fclose(fp);
+	if (*errbuf)	return -1;
+	else			return 0;
+}
+
+static int open_with_IOP(unit_t  *u, int flag) {
+	int					sockfd;
+	char				*ip;
+
+	if (u->serv_addr == NULL) {
+		u->serv_addr = malloc(sizeof(struct sockaddr_in));
+	}
+	ip = u->ip;
+	bzero((char *)u->serv_addr, sizeof(struct sockaddr_in));
+	u->serv_addr->sin_family		= AF_INET;
+	u->serv_addr->sin_addr.s_addr	= inet_addr(ip);
+	u->serv_addr->sin_port			= htons(IOP_SNIFFER_PORT);
+
+	if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+		fprintf(stderr, "pcap can't open a socket for connecting to IOP at %s\n", ip);
+		return 0;
+	}
+	if (connect(sockfd, (struct sockaddr *)u->serv_addr, sizeof(struct sockaddr_in)) < 0) {
+		fprintf(stderr, "pcap can't connect to IOP at %s\n", ip);
+		return 0;
+	}
+	if (flag == LIVE)	u->fd = sockfd;
+	else				u->find_fd = sockfd;
+	u->first_time = 0;
+	return sockfd;			/* return the non-zero file descriptor as a 'success' indicator */
+}
+
+static void close_with_IOP(int chassis, int geoslot, int flag) {
+	int		*id;
+
+	if (flag == LIVE)	id = &units[chassis][geoslot].fd;
+	else				id = &units[chassis][geoslot].find_fd;
+
+	if (*id) {										/* this was the last time, so... if we are connected... */
+		close(*id);									/* disconnect us */
+		*id = 0;									/* and forget that the descriptor exists because we are not open */
+	}
+}
+
+static void pcap_cleanup_acn(pcap_t *handle) {
+	int		chassis, geoslot;
+	unit_t	*u;
+
+	if (find_unit_by_fd(handle->fd, &chassis, &geoslot, &u) == 0)
+		return;
+	close_with_IOP(chassis, geoslot, LIVE);
+	if (u)
+		u->first_time = 0;
+	pcap_cleanup_live_common(handle);
+}
+
+static void send_to_fd(int fd, int len, unsigned char *str) {
+	int		nwritten;
+	int		chassis, geoslot;
+
+	while (len > 0) {
+		if ((nwritten = write(fd, str, len)) <= 0) {
+			find_unit_by_fd(fd, &chassis, &geoslot, NULL);
+			if (units[chassis][geoslot].fd == fd)			close_with_IOP(chassis, geoslot, LIVE);
+			else if (units[chassis][geoslot].find_fd == fd)	close_with_IOP(chassis, geoslot, FIND);
+			empty_unit(chassis, geoslot);
+			return;
+		}
+		len -= nwritten;
+		str += nwritten;
+	}
+}
+
+static void acn_freealldevs(void) {
+
+	pcap_if_t	*iff, *next_iff;
+	pcap_addr_t	*addr, *next_addr;
+
+	for (iff = acn_if_list; iff != NULL; iff = next_iff) {
+		next_iff = iff->next;
+		for (addr = iff->addresses; addr != NULL; addr = next_addr) {
+			next_addr = addr->next;
+			if (addr->addr)			free(addr->addr);
+			if (addr->netmask)		free(addr->netmask);
+			if (addr->broadaddr)	free(addr->broadaddr);
+			if (addr->dstaddr)		free(addr->dstaddr);
+			free(addr);
+		}
+		if (iff->name)			free(iff->name);
+		if (iff->description)	free(iff->description);
+		free(iff);
+	}
+}
+
+static char *nonUnified_port_num(unit_t *u, int IOPportnum) {
+
+	sprintf(static_buf, "%d_%d", u->chassis, u->geoslot);
+	return static_buf;
+}
+
+static char *unified_port_num(unit_t *u, int IOPportnum) {
+	int			portnum;
+
+	portnum = ((u->chassis - 1) * 64) + ((u->geoslot - 1) * 8) + IOPportnum + 1;
+	sprintf(static_buf, "%d", portnum);
+	return static_buf;
+}
+
+static char *translate_IOP_to_pcap_name(unit_t *u, char *IOPname, bpf_u_int32 iftype) {
+	iface_t		*iface_ptr, *iface;
+	char		*name;
+	char		buf[32];
+	char		*proto;
+	char		*port;
+	int			IOPportnum = 0;
+
+	iface = malloc(sizeof(iface_t));		/* get memory for a structure */
+	bzero((char *)iface, sizeof(iface_t));
+
+	iface->iftype = iftype;					/* remember the interface type of this interface */
+
+	name = malloc(strlen(IOPname) + 1);		/* get memory for the IOP's name */
+	strcpy(name, IOPname);					/* and copy it in */
+	iface->IOPname = name;					/* and stick it into the structure */
+
+	if (strncmp(IOPname, "lo", 2) == 0) {
+		IOPportnum = atoi(&IOPname[2]);
+		switch (iftype) {
+			case DLT_EN10MB:	proto = "lo";		port = nonUnified_port_num(u, IOPportnum);	break;
+			default:			proto = "???";		port = unified_port_num(u, IOPportnum);		break;
+		}
+	} else if (strncmp(IOPname, "eth", 3) == 0) {
+		IOPportnum = atoi(&IOPname[3]);
+		switch (iftype) {
+			case DLT_EN10MB:	proto = "eth";		port = nonUnified_port_num(u, IOPportnum);	break;
+			default:			proto = "???";		port = unified_port_num(u, IOPportnum);		break;
+		}
+	} else if (strncmp(IOPname, "wan", 3) == 0) {
+		IOPportnum = atoi(&IOPname[3]);
+		switch (iftype) {
+			case DLT_SITA:		proto = "wan";		port = unified_port_num(u, IOPportnum);		break;
+			default:			proto = "???";		port = unified_port_num(u, IOPportnum);		break;
+		}
+	}
+
+	sprintf(buf, "%s_%s", proto, port);		/* compose the user's name for that IOP port name */
+	name = malloc(strlen(buf) + 1);			/* get memory for that name */
+	strcpy(name, buf);						/* and copy it in */
+	iface->name = name;						/* and stick it into the structure */
+
+	if (u->iface == 0) {					/* if this is the first name */
+		u->iface = iface;					/* stick this entry at the head of the list */
+	} else {
+		iface_ptr = u->iface;
+		while (iface_ptr->next) {			/* othewise scan the list */
+			iface_ptr = iface_ptr->next;	/* till we're at the last entry */
+		}
+		iface_ptr->next = iface;			/* then tack this entry on the end of the list */
+	}
+	return iface->name;
+}
+
+static int if_sort(char *s1, char *s2) {
+	char	*s1_p2, *s2_p2;
+	char	str1[MAX_LINE_SIZE], str2[MAX_LINE_SIZE];
+	int		s1_p1_len, s2_p1_len;
+	int		retval;
+
+	if ((s1_p2 = strchr(s1, '_'))) {	/* if an underscore is found... */
+		s1_p1_len = s1_p2 - s1;			/* the prefix length is the difference in pointers */
+		s1_p2++;						/* the suffix actually starts _after_ the underscore */
+	} else {							/* otherwise... */
+		s1_p1_len = strlen(s1);			/* the prefix length is the length of the string itself */
+		s1_p2 = 0;						/* and there is no suffix */
+	}
+	if ((s2_p2 = strchr(s2, '_'))) {	/* now do the same for the second string */
+		s2_p1_len = s2_p2 - s2;
+		s2_p2++;
+	} else {
+		s2_p1_len = strlen(s2);
+		s2_p2 = 0;
+	}
+	strncpy(str1, s1, (s1_p1_len > sizeof(str1)) ? s1_p1_len : sizeof(str1));   *(str1 + s1_p1_len) = 0;
+	strncpy(str2, s2, (s2_p1_len > sizeof(str2)) ? s2_p1_len : sizeof(str2));   *(str2 + s2_p1_len) = 0;
+	retval = strcmp(str1, str2);
+	if (retval != 0) return retval;		/* if they are not identical, then we can quit now and return the indication */
+	return strcmp(s1_p2, s2_p2);		/* otherwise we return the result of comparing the 2nd half of the string */
+}
+
+static void sort_if_table(void) {
+	pcap_if_t	*p1, *p2, *prev, *temp;
+	int			has_swapped;
+
+	if (!acn_if_list) return;				/* nothing to do if the list is empty */
+
+	while (1) {
+		p1 = acn_if_list;					/* start at the head of the list */
+		prev = 0;
+		has_swapped = 0;
+		while ((p2 = p1->next)) {
+			if (if_sort(p1->name, p2->name) > 0) {
+				if (prev) {					/* we are swapping things that are _not_ at the head of the list */
+					temp = p2->next;
+					prev->next = p2;
+					p2->next = p1;
+					p1->next = temp;
+				} else {					/* special treatment if we are swapping with the head of the list */
+					temp = p2->next;
+					acn_if_list= p2;
+					p2->next = p1;
+					p1->next = temp;
+				}
+				p1 = p2;
+				prev = p1;
+				has_swapped = 1;
+			}
+			prev = p1;
+			p1 = p1->next;
+		}
+		if (has_swapped == 0)
+			return;
+	}	
+	return;
+}
+	
+static int process_client_data (char *errbuf) {								/* returns: -1 = error, 0 = OK */
+	int					chassis, geoslot;
+	unit_t				*u;
+	pcap_if_t			*iff, *prev_iff;
+	pcap_addr_t			*addr, *prev_addr;
+	char				*ptr;
+	int					address_count;
+	struct sockaddr_in	*s;
+	char				*newname;
+	bpf_u_int32				interfaceType;
+	unsigned char		flags;
+
+	prev_iff = 0;
+	for (chassis = 0; chassis <= MAX_CHASSIS; chassis++) {
+		for (geoslot = 0; geoslot <= MAX_GEOSLOT; geoslot++) {				/* now loop over all the devices */
+			u = &units[chassis][geoslot];
+			empty_unit_iface(u);
+			ptr = u->imsg;													/* point to the start of the msg for this IOP */
+			while (ptr < (u->imsg + u->len)) {
+				if ((iff = malloc(sizeof(pcap_if_t))) == NULL) {
+					snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+					return -1;
+				}
+				bzero((char *)iff, sizeof(pcap_if_t));
+				if (acn_if_list == 0)	acn_if_list = iff;					/* remember the head of the list */
+				if (prev_iff)			prev_iff->next = iff;				/* insert a forward link */
+
+				if (*ptr) {													/* if there is a count for the name */
+					if ((iff->name = malloc(*ptr + 1)) == NULL) {			/* get that amount of space */
+						snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+						return -1;
+					}
+					memcpy(iff->name, (ptr + 1), *ptr);						/* copy the name into the malloc'ed space */
+					*(iff->name + *ptr) = 0;								/* and null terminate the string */
+					ptr += *ptr;											/* now move the pointer forwards by the length of the count plus the length of the string */
+				}
+				ptr++;
+
+				if (*ptr) {													/* if there is a count for the description */
+					if ((iff->description = malloc(*ptr + 1)) == NULL) {	/* get that amount of space */
+						snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+						return -1;
+					}
+					memcpy(iff->description, (ptr + 1), *ptr);				/* copy the name into the malloc'ed space */
+					*(iff->description + *ptr) = 0;							/* and null terminate the string */
+					ptr += *ptr;											/* now move the pointer forwards by the length of the count plus the length of the string */
+				}
+				ptr++;
+
+				interfaceType = ntohl(*(bpf_u_int32 *)ptr);
+				ptr += 4;													/* skip over the interface type */
+
+				flags = *ptr++;
+				if (flags) iff->flags = PCAP_IF_LOOPBACK;					/* if this is a loopback style interface, lets mark it as such */
+
+				address_count = *ptr++;
+
+				prev_addr = 0;
+				while (address_count--) {
+					if ((addr = malloc(sizeof(pcap_addr_t))) == NULL) {
+						snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+						return -1;
+					}
+					bzero((char *)addr, sizeof(pcap_addr_t));
+					if (iff->addresses == 0) iff->addresses = addr;
+					if (prev_addr) prev_addr->next = addr;							/* insert a forward link */
+					if (*ptr) {														/* if there is a count for the address */
+						if ((s = malloc(sizeof(struct sockaddr_in))) == NULL) {		/* get that amount of space */
+							snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+							return -1;
+						}
+						bzero((char *)s, sizeof(struct sockaddr_in));
+						addr->addr = (struct sockaddr *)s;
+						s->sin_family		= AF_INET;
+						s->sin_addr.s_addr	= *(bpf_u_int32 *)(ptr + 1);			/* copy the address in */
+						ptr += *ptr;										/* now move the pointer forwards according to the specified length of the address */
+					}
+					ptr++;													/* then forwards one more for the 'length of the address' field */
+					if (*ptr) {												/* process any netmask */
+						if ((s = malloc(sizeof(struct sockaddr_in))) == NULL) {
+							snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+							return -1;
+						}
+						bzero((char *)s, sizeof(struct sockaddr_in));
+						addr->netmask = (struct sockaddr *)s;
+						s->sin_family		= AF_INET;
+						s->sin_addr.s_addr	= *(bpf_u_int32*)(ptr + 1);
+						ptr += *ptr;
+					}
+					ptr++;
+					if (*ptr) {												/* process any broadcast address */
+						if ((s = malloc(sizeof(struct sockaddr_in))) == NULL) {
+							snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+							return -1;
+						}
+						bzero((char *)s, sizeof(struct sockaddr_in));
+						addr->broadaddr = (struct sockaddr *)s;
+						s->sin_family		= AF_INET;
+						s->sin_addr.s_addr	= *(bpf_u_int32*)(ptr + 1);
+						ptr += *ptr;
+					}
+					ptr++;
+					if (*ptr) {												/* process any destination address */
+						if ((s = malloc(sizeof(struct sockaddr_in))) == NULL) {
+							snprintf(errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+							return -1;
+						}
+						bzero((char *)s, sizeof(struct sockaddr_in));
+						addr->dstaddr = (struct sockaddr *)s;
+						s->sin_family		= AF_INET;
+						s->sin_addr.s_addr	= *(bpf_u_int32*)(ptr + 1);
+						ptr += *ptr;
+					}
+					ptr++;
+					prev_addr = addr;
+				}
+				prev_iff = iff;
+
+				newname = translate_IOP_to_pcap_name(u, iff->name, interfaceType);		/* add a translation entry and get a point to the mangled name */
+				if ((iff->name = realloc(iff->name, strlen(newname) + 1)) == NULL) {	/* we now re-write the name stored in the interface list */
+					snprintf(errbuf, PCAP_ERRBUF_SIZE, "realloc: %s", pcap_strerror(errno));
+					return -1;
+				}
+				strcpy(iff->name, newname);												/* to this new name */
+			}
+		}
+	}
+	return 0;
+}
+
+static int read_client_data (int fd) {
+	unsigned char	buf[256];
+	int				chassis, geoslot;
+	unit_t			*u;
+	int				len;
+
+	find_unit_by_fd(fd, &chassis, &geoslot, &u);
+
+	if ((len = recv(fd, buf, sizeof(buf), 0)) <= 0)	return 0;	/* read in whatever data was sent to us */
+
+	if ((u->imsg = realloc(u->imsg, (u->len + len))) == NULL)	/* extend the buffer for the new data */
+		return 0;
+	memcpy((u->imsg + u->len), buf, len);						/* append the new data */
+	u->len += len;
+	return 1;
+}
+
+static void wait_for_all_answers(void) {
+	int		retval;
+	struct	timeval tv;
+	int		fd;
+	int		chassis, geoslot;
+
+	tv.tv_sec = 2;
+	tv.tv_usec = 0;
+
+	while (1) {
+		int flag = 0;
+		for (fd = 0; fd <= max_fs; fd++) {								/* scan the list of descriptors we may be listening to */
+			if (FD_ISSET(fd, &readfds)) flag = 1;						/* and see if there are any still set */
+		}
+		if (flag == 0) return;											/* we are done, when they are all gone */
+
+		memcpy(&working_set, &readfds, sizeof(readfds));				/* otherwise, we still have to listen for more stuff, till we timeout */
+		retval = select(max_fs + 1, &working_set, NULL, NULL, &tv);
+		if (retval == -1) {												/* an error occured !!!!! */
+			return;
+		} else if (retval == 0) {										/* timeout occured, so process what we've got sofar and return */
+			printf("timeout\n");
+			return;
+		} else {
+			for (fd = 0; fd <= max_fs; fd++) {							/* scan the list of things to do, and do them */
+				if (FD_ISSET(fd, &working_set)) {
+					if (read_client_data(fd) == 0) {					/* if the socket has closed */
+						FD_CLR(fd, &readfds);							/* and descriptors we listen to for errors */
+						find_unit_by_fd(fd, &chassis, &geoslot, NULL);
+						close_with_IOP(chassis, geoslot, FIND);			/* and close out connection to him */
+					}
+				}
+			}
+		}
+	}
+}
+
+static char *get_error_response(int fd, char *errbuf) {		/* return a pointer on error, NULL on no error */
+	char	byte;
+	int		len = 0;
+
+	while (1) {
+		recv(fd, &byte, 1, 0);							/* read another byte in */
+		if (errbuf && (len++ < PCAP_ERRBUF_SIZE)) {		/* and if there is still room in the buffer */
+			*errbuf++ = byte;							/* stick it in */
+			*errbuf = '\0';								/* ensure the string is null terminated just in case we might exceed the buffer's size */
+		}
+		if (byte == '\0') {
+			if (len > 1)	{ return errbuf;	}
+			else			{ return NULL;		}
+		}
+	}
+}
+
+int acn_findalldevs(char *errbuf) {								/* returns: -1 = error, 0 = OK */
+	int		chassis, geoslot;
+	unit_t	*u;
+
+	FD_ZERO(&readfds);
+	max_fs = 0;
+	for (chassis = 0; chassis <= MAX_CHASSIS; chassis++) {
+		for (geoslot = 0; geoslot <= MAX_GEOSLOT; geoslot++) {
+			u = &units[chassis][geoslot];
+			if (u->ip && (open_with_IOP(u, FIND))) {			/* connect to the remote IOP */
+				send_to_fd(u->find_fd, 1, (unsigned char *)"\0");
+				if (get_error_response(u->find_fd, errbuf))
+					close_with_IOP(chassis, geoslot, FIND);
+				else {
+					if (u->find_fd > max_fs)
+						max_fs = u->find_fd;								/* remember the highest number currently in use */
+					FD_SET(u->find_fd, &readfds);						/* we are going to want to read this guy's response to */
+					u->len = 0;
+					send_to_fd(u->find_fd, 1, (unsigned char *)"Q");		/* this interface query request */
+				}
+			}
+		}
+	}
+	wait_for_all_answers();
+	if (process_client_data(errbuf))
+		return -1;
+	sort_if_table();
+	return 0;
+}
+
+static int pcap_stats_acn(pcap_t *handle, struct pcap_stat *ps) {
+	unsigned char	buf[12];
+
+	send_to_fd(handle->fd, 1, (unsigned char *)"S");						/* send the get_stats command to the IOP */
+
+	if (read_client_nbytes(handle->fd, sizeof(buf), buf) == -1) return -1;	/* try reading the required bytes */
+
+	ps->ps_recv		= ntohl(*(uint32_t *)&buf[0]);							/* break the buffer into its three 32 bit components */
+	ps->ps_drop		= ntohl(*(uint32_t *)&buf[4]);
+	ps->ps_ifdrop	= ntohl(*(uint32_t *)&buf[8]);
+
+	return 0;
+}
+
+static int acn_open_live(const char *name, char *errbuf, int *linktype) {		/* returns 0 on error, else returns the file descriptor */
+	int			chassis, geoslot;
+	unit_t		*u;
+	iface_t		*p;
+	pcap_if_t	*alldevsp;
+
+	pcap_findalldevs(&alldevsp, errbuf);
+	for (chassis = 0; chassis <= MAX_CHASSIS; chassis++) {										/* scan the table... */
+		for (geoslot = 0; geoslot <= MAX_GEOSLOT; geoslot++) {
+			u = &units[chassis][geoslot];
+			if (u->ip != NULL) {
+				p = u->iface;
+				while (p) {																		/* and all interfaces... */
+					if (p->IOPname && p->name && (strcmp(p->name, name) == 0)) {				/* and if we found the interface we want... */
+						*linktype = p->iftype;
+						open_with_IOP(u, LIVE);													/* start a connection with that IOP */
+						send_to_fd(u->fd, strlen(p->IOPname)+1, (unsigned char *)p->IOPname);	/* send the IOP's interface name, and a terminating null */
+						if (get_error_response(u->fd, errbuf)) {
+							return -1;
+						}
+						return u->fd;															/* and return that open descriptor */
+					}
+					p = p->next;
+				}
+			}
+		}
+	}
+	return -1;																				/* if the interface wasn't found, return an error */
+}
+
+static void acn_start_monitor(int fd, int snaplen, int timeout, int promiscuous, int direction) {
+	unsigned char	buf[8];
+	unit_t			*u;
+
+	//printf("acn_start_monitor()\n");				// fulko
+	find_unit_by_fd(fd, NULL, NULL, &u);
+	if (u->first_time == 0) {
+		buf[0]					= 'M';
+		*(uint32_t *)&buf[1]	= htonl(snaplen);
+		buf[5]					= timeout;
+		buf[6]					= promiscuous;
+		buf[7]					= direction;
+	//printf("acn_start_monitor() first time\n");				// fulko
+		send_to_fd(fd, 8, buf);								/* send the start monitor command with its parameters to the IOP */
+		u->first_time = 1;
+	}
+	//printf("acn_start_monitor() complete\n");				// fulko
+}
+
+static int pcap_inject_acn(pcap_t *p, const void *buf _U_, size_t size _U_) {
+	strlcpy(p->errbuf, "Sending packets isn't supported on ACN adapters",
+	    PCAP_ERRBUF_SIZE);
+	return (-1);
+}
+
+static int pcap_setfilter_acn(pcap_t *handle, struct bpf_program *bpf) {
+	int				fd = handle->fd;
+	int				count;
+	struct bpf_insn	*p;
+	uint16_t		shortInt;
+	uint32_t		longInt;
+
+	send_to_fd(fd, 1, (unsigned char *)"F");			/* BPF filter follows command */
+	count = bpf->bf_len;
+	longInt = htonl(count);
+	send_to_fd(fd, 4, (unsigned char *)&longInt);		/* send the instruction sequence count */
+	p = bpf->bf_insns;
+	while (count--) {									/* followed by the list of instructions */
+		shortInt = htons(p->code);
+		longInt = htonl(p->k);
+		send_to_fd(fd, 2, (unsigned char *)&shortInt);
+		send_to_fd(fd, 1, (unsigned char *)&p->jt);
+		send_to_fd(fd, 1, (unsigned char *)&p->jf);
+		send_to_fd(fd, 4, (unsigned char *)&longInt);
+		p++;
+	}
+	if (get_error_response(fd, NULL))
+		return -1;
+	return 0;
+}
+
+static int pcap_setdirection_acn(pcap_t *handle, pcap_direction_t d) {
+	snprintf(handle->errbuf, sizeof(handle->errbuf),
+	    "Setting direction is not supported on ACN adapters");
+	return -1;
+}
+
+static int acn_read_n_bytes_with_timeout(pcap_t *handle, int count) {
+	struct		timeval tv;
+	int			retval, fd;
+	fd_set		r_fds;
+	fd_set		w_fds;
+	u_char		*bp;
+	int			len = 0;
+	int			offset = 0;
+
+	tv.tv_sec = 5;
+	tv.tv_usec = 0;
+
+	fd = handle->fd;
+	FD_ZERO(&r_fds);
+	FD_SET(fd, &r_fds);
+	memcpy(&w_fds, &r_fds, sizeof(r_fds));
+	bp = handle->bp;
+	while (count) {
+		retval = select(fd + 1, &w_fds, NULL, NULL, &tv);
+		if (retval == -1) {											/* an error occured !!!!! */
+//			fprintf(stderr, "error during packet data read\n");
+			return -1;												/* but we need to return a good indication to prevent unneccessary popups */
+		} else if (retval == 0) {									/* timeout occured, so process what we've got sofar and return */
+//			fprintf(stderr, "timeout during packet data read\n");
+			return -1;
+		} else {
+			if ((len = recv(fd, (bp + offset), count, 0)) <= 0) {
+//				fprintf(stderr, "premature exit during packet data rx\n");
+				return -1;
+			}
+			count -= len;
+			offset += len;
+		}
+	}
+	return 0;
+}
+
+static int pcap_read_acn(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user) {
+	#define HEADER_SIZE (4 * 4)
+	unsigned char		packet_header[HEADER_SIZE];
+	struct pcap_pkthdr	pcap_header;
+
+	//printf("pcap_read_acn()\n");			// fulko
+	acn_start_monitor(handle->fd, handle->snapshot, handle->md.timeout, handle->md.clear_promisc, handle->direction);	/* maybe tell him to start monitoring */
+	//printf("pcap_read_acn() after start monitor\n");			// fulko
+
+	handle->bp = packet_header;
+	if (acn_read_n_bytes_with_timeout(handle, HEADER_SIZE) == -1) return 0;			/* try to read a packet header in so we can get the sizeof the packet data */
+
+	pcap_header.ts.tv_sec	= ntohl(*(uint32_t *)&packet_header[0]);				/* tv_sec */
+	pcap_header.ts.tv_usec	= ntohl(*(uint32_t *)&packet_header[4]);				/* tv_usec */
+	pcap_header.caplen		= ntohl(*(uint32_t *)&packet_header[8]);				/* caplen */
+	pcap_header.len			= ntohl(*(uint32_t *)&packet_header[12]);				/* len */
+
+	handle->bp = handle->buffer + handle->offset;									/* start off the receive pointer at the right spot */
+	if (acn_read_n_bytes_with_timeout(handle, pcap_header.caplen) == -1) return 0;	/* then try to read in the rest of the data */
+
+	callback(user, &pcap_header, handle->bp);										/* call the user supplied callback function */
+	return 1;
+}
+
+static int pcap_activate_sita(pcap_t *handle) {
+	int		fd;
+
+	if (handle->opt.rfmon) {
+		/*
+		 * No monitor mode on SITA devices (they're not Wi-Fi
+		 * devices).
+		 */
+		return PCAP_ERROR_RFMON_NOTSUP;
+	}
+
+	/* Initialize some components of the pcap structure. */
+
+	handle->inject_op = pcap_inject_acn;
+	handle->setfilter_op = pcap_setfilter_acn;
+	handle->setdirection_op = pcap_setdirection_acn;
+	handle->set_datalink_op = NULL;	/* can't change data link type */
+	handle->getnonblock_op = pcap_getnonblock_fd;
+	handle->setnonblock_op = pcap_setnonblock_fd;
+	handle->cleanup_op = pcap_cleanup_acn;
+	handle->read_op = pcap_read_acn;
+	handle->stats_op = pcap_stats_acn;
+
+	fd = acn_open_live(handle->opt.source, handle->errbuf,
+	    &handle->linktype);
+	if (fd == -1)
+		return PCAP_ERROR;
+	handle->md.clear_promisc = handle->md.promisc;
+	handle->fd = fd;
+	handle->bufsize = handle->snapshot;
+
+	/* Allocate the buffer */
+
+	handle->buffer	 = malloc(handle->bufsize + handle->offset);
+	if (!handle->buffer) {
+	        snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "malloc: %s", pcap_strerror(errno));
+		pcap_cleanup_acn(handle);
+		return PCAP_ERROR;
+	}
+
+	/*
+	 * "handle->fd" is a socket, so "select()" and "poll()"
+	 * should work on it.
+	 */
+	handle->selectable_fd = handle->fd;
+
+	return 0;
+}
+
+pcap_t *pcap_create(const char *device, char *ebuf) {
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_sita;
+	return (p);
+}
diff --git a/contrib/libpcap/pcap-sita.h b/contrib/libpcap/pcap-sita.h
new file mode 100644
index 0000000..b232ee2
--- /dev/null
+++ b/contrib/libpcap/pcap-sita.h
@@ -0,0 +1,10 @@
+/*
+ * pcap-sita.h: Packet capture interface for SITA WAN devices
+ *
+ * Authors: Fulko Hew (fulko.hew@sita.aero) (+1 905 6815570);
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-sita.h
+ */
+
+extern int acn_parse_hosts_file(char *errbuf);
+extern int acn_findalldevs(char *errbuf);
diff --git a/contrib/libpcap/pcap-sita.html b/contrib/libpcap/pcap-sita.html
new file mode 100644
index 0000000..5f7884f
--- /dev/null
+++ b/contrib/libpcap/pcap-sita.html
@@ -0,0 +1,943 @@
+<HTML><HEAD>
+<STYLE type="text/css">
+<!--
+A { text-decoration:none }
+-->
+</STYLE>
+</HEAD>
+<BODY>
+
+<TABLE WIDTH=100%><TR>
+	<TD ALIGN=LEFT VALIGN=TOP>
+		<FONT SIZE=+0 FACE="COURIER"><B>A "Distributed Pcap" for<BR>Remote Monitoring LANs & WANs</B><BR>
+										(Design Notes for the SITA ACN device)</FONT>
+	</TD>
+	<TD ALIGN=RIGHT VALIGN=TOP>
+		Fulko Hew<BR>SITA INC Canada, Inc.<BR>Revised: October 2, 2007
+	</TD>
+</TR></TABLE>
+
+
+<H3>SUMMARY</H3>
+<UL>
+	<STRONG>Note:</STRONG> This document is part of the libpcap CVS and was derived from 'pcap.3' (circa Aug/07).
+	<P>
+	The ACN provides a customized/distributed version of this library that alows SMPs to
+	interact with the various IOPs within the site providing a standard mechanism
+	to capture LAN and WAN message traffic.
+	<P>
+	<CENTER>
+		<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3 WIDTH=75%>
+			<TR>
+				<TH VALIGN=TOP>SMP</TH>
+				<TD VALIGN=TOP>The Supervisory Management Processor where Wireshark (or equivalent)
+								runs in conjuction with a libpcap front-end.</TD>
+			</TR>
+			<TR>
+				<TH VALIGN=TOP>IOP</TH>
+				<TD VALIGN=TOP>I/O Processors where the monitored ports exist in conjunction
+								with a custom device driver/libpcap back-end.</TD>
+			</TR>
+		</TABLE>
+	</CENTER>
+	<P>
+	Each IOP will be capable of supporting multiple connections from an SMP
+	enabling monitoring of more than one interface at a time, each through
+	its own seperate connection.  The IOP is responsible to ensure and report
+	an error if any attempt is made to monitor the same interface more than once.
+	<P>
+	There are three applications that will be supported by the ACN version of libpcap.
+	They each use a slightly different mode for looping/capturing and termination
+	as summarized in the following table:
+	<P>
+	<CENTER>
+	<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+    	<TR><TH>Application</TH>	<TH>Capture</TH>	<TH>Termination</TH></TR>
+    	<TR><TH VALIGN=TOP NOWRAP>wireshark</TH>
+			<TD VALIGN=TOP>pcap_dispatch(all packets in one buffer of capture only)</TD>
+			<TD VALIGN=TOP>pcap_breakloop()</TD>
+		</TR>
+    	<TR><TH VALIGN=TOP NOWRAP>tshark</TH>
+			<TD VALIGN=TOP>pcap_dispatch(one buffer of capture only)</TD>
+			<TD VALIGN=TOP>Since a CTRL-C was used to terminate the application, pcap_breakloop() is never called.</TD>
+		</TR>
+    	<TR><TH VALIGN=TOP NOWRAP>tcpdump</TH>
+			<TD VALIGN=TOP>pcap_loop(all packets in the next buffer, and loop forever)</TD>
+			<TD VALIGN=TOP>pcap_breakloop()</TD>
+		</TR>
+	</TABLE>
+	</CENTER>
+	<P>
+	<B>Note: </B>In all cases, the termination of capturing is always (apparently) followed by
+	pcap_close().  Pcap_breakloop() is only used to stop/suspend looping/processing,
+	and upon close interpretation of the function definitions, it is possible to resume
+	capturing following a pcap_breakloop() without any re-initialization.
+	<P>
+	<H4>ACN Limitations</H4>
+	<OL>
+		<LI>Monitoring of backup IOPs is not currently supported.
+		<LI>Ethernet interfaces cannot be monitored in promiscuous mode.
+	</OL>
+
+</UL>
+
+<H3>ROUTINES</H3>
+<UL>
+		The following list of functions is the sub-set of Pcap functions that have been
+		altered/enhanced to support the ACN remote monitoring facility.  The remainder of the Pcap
+		functions continue to perform their duties un-altered.  Libpcap only supports this
+		mode of operation if it has been configured/compiled for SITA/ACN support.
+		<P>
+		<UL><FONT FACE=COURIER>
+			pcap_findalldevs<BR>
+			pcap_freealldevs<BR>
+			pcap_open_live<BR>
+			pcap_close<BR>
+			pcap_setfilter<BR>
+			pcap_dispatch<BR>
+			pcap_loop<BR>
+			pcap_next<BR>
+			pcap_next_ex<BR>
+			pcap_stats<BR>
+		</FONT></UL>
+
+	These subroutines have been modified for the ACN specific distributed and remote monitoring
+	ability perform the following basic functions.  More detail is provided in the
+	"SMP/IOP Inter-Process Communication Protocol" section.
+	<P>
+<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_open_live()</B></TD>
+		<TD VALIGN=TOP>Used to obtain a packet capture descriptor to look at packets on the network.</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			The SMP will open a connection to the selected IOP on its 'sniffer' port
+			to ensure it is available.  It sends a null terminated string identifying
+			the interface to be monitored.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>
+			After any required processing is complete, the IOP will return a
+			null terminated string containing an error message if one occured.
+			If no error occured, a empty string is still returned.
+			Errors are:
+			<UL>
+			<LI>"Interface (xxx) does not exist."
+			<LI>"Interface (xxx) not configured."
+			<LI>"Interface (xxx) already being monitored."
+			</UL>
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_findalldevs()</B></TD>
+		<TD VALIGN=TOP>It constructs a list of network devices that can be opened with pcap_open_live().</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			It obtains a list of IOPs currently available (via /etc/hosts).
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			The SMP will sequentially open a connection to each IOP on its 'sniffer' port to ensure
+			the IOP is available.
+			It sends a null terminated empty interface ID followed by the query request command.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>The IOP returns an error response and its list of devices.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			The SMP closes the TCP connection with each IOP.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			The SMP adds the received information to its internal structure.
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_freealldevs()</B></TD>
+		<TD VALIGN=TOP>Used to free a list allocated by pcap_findalldevs().</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			The SMP frees the structure it built as a result of the previous
+			invocation of pcap_findalldevs().
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_dispatch()</B></TD>
+		<TD VALIGN=TOP>Used to collect and process packets.</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
+			the SMP will pass down the monitor start command and various parameters the IOP should use.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>
+			The IOP now sends a stream of captured data.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			The SMP will read the reverse channel of the connection between the SMP and the
+			IOP that provides the captured data (via 'p->read_op' which is 'pcap_read_linux()'
+			until the select() call returns a 'no more data' indication.
+			It will the process (at most) the next 'cnt' packets and invoke the specified
+			callback function for each packet processed.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
+			<TD>
+			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_loop()</B></TD>
+		<TD VALIGN=TOP>
+				Is similar to pcap_dispatch() except it keeps reading packets until
+				the requested number of packets are processed or an error occurs.
+		</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
+			the SMP will pass down the monitor start command and various parameters the IOP should use.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>
+			The IOP now sends a stream of captured data.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			The SMP continuously reads the next packet from the reverse channel of the connection
+			between the SMP and the IOP that provides the captured data (via 'p->read_op'
+			which is 'pcap_read_linux()' until 'cnt' packets have been received.
+			The specified callback function will be invoked for each packet received.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
+			<TD>
+			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_next()</B></TD>
+		<TD VALIGN=TOP>
+			It reads the next packet (by calling pcap_dispatch() with a count of 1)
+			and returns a pointer to the data in that packet.
+		</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
+			the SMP will pass down the monitor start command and various parameters the IOP should use.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>
+			The IOP now sends a stream of captured data.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			The SMP reads only the next packet from the reverse channel of the connection
+			between the SMP and the IOP that provides the captured data (via calling pcap_dispatch()
+			with a count of 1) and returns a pointer to that data by invoking an internal callback.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
+			<TD>
+			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_next_ex()</B></TD>
+		<TD VALIGN=TOP>Reads the next packet and returns a success/failure indication.</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			On the first invocation of pcap_dispatch(), pcap_loop(), or pcap_next(), or pcap_next_ex() following a pcap_open_live(),
+			the SMP will pass down the monitor start command and various parameters the IOP should use.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>
+			The IOP now sends a stream of captured data.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			The SMP reads only the next packet from the reverse channel of the connection
+			between the SMP and the IOP that provides the captured data (via calling pcap_dispatch()
+			with a count of 1) and returns seperate pointers to both the
+			packet header and packet data by invoking an internal callback.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
+			<TD>
+			The IOP continues to listen for additional commands as well as capturing and forwarding data to the SMP.
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_setfilter()</B></TD>
+        <TD VALIGN=TOP>Used to specify a filter program.</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			The SMP sends a 'set filter' command followed by the BPF commands.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>
+			The IOP returns a null terminated error string if it failed to accept the filter.
+			If no error occured, then a NULL terminated empty string is returned instead.
+			Errors are:
+			<UL>
+			<LI>"Invalid BPF."
+			<LI>"Insufficient resources for BPF."
+			</UL>
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_stats()</B></TD>
+        <TD VALIGN=TOP>Fills in a pcap_stat struct with packet statistics.</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			The SMP sends a message to the IOP requesting its statistics.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP -> SMP</TH>
+			<TD>
+			The IOP returns the statistics.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>SMP</TH>
+			<TD>
+			The SMP fills in the structure provided with the information retrieved from the IOP.
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+
+	<TR>
+		<TD VALIGN=TOP ROWSPAN=2><B>pcap_close()</B></TD>
+        <TD VALIGN=TOP>Closes the file and deallocates resources.</TD>
+	</TR>
+	<TR><TD><TABLE BORDER=0 CELLSPACING=0 CELLPADDING=3 WIDTH=100%>
+		<TR><TH VALIGN=TOP NOWRAP>SMP -> IOP</TH>
+			<TD>
+			The SMP closes the file descriptor, and if the descriptor is that of
+			the comminucation session with an IOP, it too is terminated.
+			</TD>
+		</TR>
+		<TR><TH VALIGN=TOP NOWRAP>IOP</TH>
+			<TD>
+			If the IOP detects that its communication session with an SMP
+			has closed, it will terminate any monitoring in progress,
+			release any resources and close its end of the session.
+			It will not maintain persistance of any information or prior mode of operation.
+			</TD>
+		</TR>
+	</TABLE></TD></TR>
+</TABLE>
+</UL>
+
+<P>
+<H3>SMP/IOP Inter-Process Communication Protocol</H3>
+
+<UL>
+	<LI><P>Communications between an SMP and an IOP consists of a TCP session
+			between an ephemeral port on the SMP and the well known port of 49152
+			(which is the first available port in the 'dynamic and/or private port'
+			range) on an IOP.
+	<LI><P>Following a TCP open operation the IOP receives a null terminated
+			'interface ID' string to determine the type of operation that follows:
+	<LI><P>Every command received by an IOP implies a 'stop trace/stop forwarding' operation must
+			occur before executing the received command.
+	<LI><P>A session is closed when the SMP closes the TCP session with the IOP.
+			Obviously monitoring and forwarding is also stopped at that time.
+
+	<B>Note: </B>All multi-octet entities are sent in network neutral order.
+	<P>
+
+	<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=5>
+		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
+		<TR>
+			<TD VALIGN=TOP ROWSPAN=6>pcap_findalldevs()</TD>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>Open socket (to each IOP), and sends:
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+					<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>Interface ID</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>A NULL to indicate an an empty 'interface ID'.</TD>
+					</TR>
+				</TABLE>
+			</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
+			<TD VALIGN=TOP>Send its (possibly empty) NULL terminated error response string.</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>Sends the 'interface query request':
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+					<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>Interface ID</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>A 'Q' (indicating 'interface query request').</TD>
+					</TR>
+				</TABLE>
+			</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
+			<TD VALIGN=TOP>The IOP returns a list of sequences of information as
+				defined by the return parameter of this function call (as shown in the following table).
+				Elements are specified by providing an unsigned byte preceeding the actual data that contains length information.
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+				<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Notes:</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+				</TR>
+				<TR>
+					<TD ROWSPAN=7>&nbsp;</TD>
+					<TD VALIGN=TOP ALIGN=RIGHT>length</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP>The number of octets in the name field that follows.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Name</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1-255</TD>
+					<TD VALIGN=TOP>The name of the interface. The format of the name is an alphabetic string (indicating
+									the type of interface) followed by an optional numeric string (indicating the interface's
+									sequence number).
+									Sequence numbers (if needed) will begin at zero and progress monotonically upwards.
+									(i.e. 'eth0', 'lo', 'wan0', etc.)
+									<P>
+									For an IOP, the alphabetic string will be one of: 'eth', 'wan', and 'lo'
+									for Ethernet, WAN ports and the IP loopback device respectively.
+									An IOP currently supports: 'eth0', 'eth1', 'lo', 'wan0' ... 'wan7'.
+									<P>
+						<B>Note:</B> IOPs and ACNs will not currently support the concept of 'any' interface.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP>The number of octets in the interface description field that follows.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Interface Description</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
+					<TD VALIGN=TOP>A description of the interface or it may be an empty string. (i.e. 'ALC')</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Interface Type</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>4</TD>
+					<TD VALIGN=TOP>The type of interface as defined in the description for pcap_datalink() (in network neutral order).</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Loopback Flag</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP>1 = if the interface is a loopback interface, zero = otherwise.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=RIGHT>count</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP># of address entries that follow.
+						Each entry is a series of bytes in network neutral order.
+						See the parameter definition above for more details.</TD>
+				</TR>
+				<TR>
+					<TD ALIGN=CENTER ROWSPAN=8 WIDTH=1%>Repeated 'count' number of times.</TD>
+					<TD VALIGN=TOP ALIGN=RIGHT>length</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP>The number of octets in the address field that follows.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Address</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1-255</TD>
+					<TD VALIGN=TOP>The address of this interface (in network neutral order).</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP>The number of octets in the netmask field that follows.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Network Mask</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
+					<TD VALIGN=TOP>The network mask used on this interface (if applicable) (in network neutral order).</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP>The number of octets in the broadcast address field that follows.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Broadcast Address</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
+					<TD VALIGN=TOP>The broadcast address of this interface (if applicable) (in network neutral order).</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=RIGHT>length</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+					<TD VALIGN=TOP>The number of octets in the destination address field that follows.</TD>
+				</TR>
+				<TR><TD VALIGN=TOP ALIGN=LEFT>Destination Address</TD>
+					<TD VALIGN=TOP ALIGN=CENTER>0-255</TD>
+					<TD VALIGN=TOP>The destination address of this interface (if applicable) (in network neutral order).</TD>
+				</TR>
+				</TABLE>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>Close the socket.</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
+			<TD VALIGN=TOP>Close the socket.</TD>
+		</TR>
+		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
+		<TR>
+			<TD VALIGN=TOP ROWSPAN=2>pcap_open_live()</TD>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>Open socket, and sends:
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+					<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>Interface ID</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>'n'</TD>
+						<TD VALIGN=TOP>'n' octets containing a NULL terminated interface name string.</TD>
+					</TR>
+				</TABLE>
+			</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
+			<TD VALIGN=TOP>Send its NULL terminated error response string.</TD>
+		</TR>
+		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
+		<TR>
+			<TD VALIGN=TOP NOWRAP ROWSPAN=2>pcap_dispatch()<BR>pcap_loop()<BR>pcap_next()<BR>pcap_next_ex()</TD>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>On the first invocation following a pcap_open_live() or pcap_breakloop() additional information is sent:
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+					<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>command</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>'M' (indicating 'monitor start')</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>snaplen</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
+						<TD VALIGN=TOP>snaplen</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>timeout</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>timeout value (in milliseconds)</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>promiscuous</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>A flag indicating that the interface being monitored show operate
+							in promiscuous mode. [off(0) / on(NZ)]</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>direction</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>A flag indicating the direction of traffic that should be captuted [both(0) / in(1) / out(2)]</TD>
+					</TR>
+				</TABLE>
+			</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
+			<TD VALIGN=TOP>Sends captured packets.</TD>
+		</TR>
+		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
+		<TR>
+			<TD VALIGN=TOP ROWSPAN=2>pcap_setfilter()</TD>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>At any time, the SMP can issue a set filter command which contains
+							an indicator, a count of the number of statements in the filter,
+							followed by the sequence of filter commands represented as a sequence
+							of C-style structures.
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+					<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>command</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>'F' (indicating 'filter')</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>count</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
+						<TD VALIGN=TOP>The number of command in the Berkeley Packet Filter that follow.</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>BPF program</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>'n'</TD>
+						<TD VALIGN=TOP>8 bytes of each command (repeated 'n' times).<BR>
+								 	Each command consists of that C-style structure which contains:
+							<P>
+							<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+								<TR>
+								<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+								<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+								<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+								</TR>
+								<TR>
+									<TD VALIGN=TOP>opcode</TD>
+									<TD VALIGN=TOP ALIGN=CENTER>2</TD>
+									<TD VALIGN=TOP>The command's opcode.</TD>
+								</TR>
+								<TR>
+									<TD VALIGN=TOP>'jt'</TD>
+									<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+									<TD VALIGN=TOP>The 'jump if true' program counter offset.</TD>
+								</TR>
+								<TR>
+									<TD VALIGN=TOP>'jf'</TD>
+									<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+									<TD VALIGN=TOP>The 'jump if false' program counter offset.</TD>
+								</TR>
+								<TR>
+									<TD VALIGN=TOP>'k'</TD>
+									<TD VALIGN=TOP ALIGN=CENTER>4</TD>
+									<TD VALIGN=TOP>The 'other' data field.</TD>
+								</TR>
+							</TABLE>
+							<P>
+							Refer to the bpf(4) man page for more details.
+						</TD>
+					</TR>
+				</TABLE>
+			</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
+			<TD VALIGN=TOP>In return the IOP will send its (possibly empty) NULL terminated error response string.</TD>
+		</TR>
+		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
+		<TR>
+			<TD VALIGN=TOP ROWSPAN=2>pcap_stats()</TD>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>At any time, the SMP can issue a 'retrieve statistics' command which contains:<BR>
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+					<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>command</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>1</TD>
+						<TD VALIGN=TOP>'S' (indicating 'request statistics')</TD>
+					</TR>
+				</TABLE>
+			</TD>
+		</TR>
+		<TR>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>IOP -> SMP</TD>
+			<TD VALIGN=TOP>In return the IOP will send:
+				<P>
+				<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+					<TR>
+					<TH VALIGN=TOP ALIGN=CENTER>Name/<BR>Purpose</TH>
+					<TH VALIGN=TOP ALIGN=CENTER NOWRAP>Size<BR>(in bytes)</TH>
+					<TH VALIGN=TOP ALIGN=CENTER>Description</TH>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>ps_recv</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
+						<TD VALIGN=TOP>The number of packets that passed the filter.</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>ps_drop</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
+						<TD VALIGN=TOP>The number of packets that were dropped because the input queue was full,
+							regardless of whether they passed the filter.</TD>
+					</TR>
+					<TR>
+						<TD VALIGN=TOP>ps_ifdrop</TD>
+						<TD VALIGN=TOP ALIGN=CENTER>4</TD>
+						<TD VALIGN=TOP>The number of packets dropped by the network inteface
+							(regardless of whether they would have passed the input filter).</TD>
+					</TR>
+				</TABLE>
+			</TD>
+		</TR>
+		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
+		<TR>
+			<TD VALIGN=TOP ROWSPAN=1>pcap_close()</TD>
+			<TD VALIGN=TOP ALIGN=CENTER NOWRAP>SMP -> IOP</TD>
+			<TD VALIGN=TOP>At any time, the SMP can close the TCP session with the IOP.</TD>
+		</TR>
+		<TR><TH COLSPAN=3><HR WIDTH=100%></TH></TR>
+	</TABLE>
+</UL>
+
+<H3>Interface ID Naming Convention</H3>
+<UL>
+	Each interface within an IOP will be referred to uniquely.  Since an currently contains
+	8 monitorable WAN ports and a monitorable Ethernet port, the naming convention is:
+	<P>
+	<CENTER>
+	<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+		<TR><TH>Interface #</TH>		<TH>Type</TH>					<TH>Name</TH></TR>
+		<TR><TD ALIGN=CENTER>1</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan0</TD></TR>
+		<TR><TD ALIGN=CENTER>2</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan1</TD></TR>
+		<TR><TD ALIGN=CENTER>3</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan2</TD></TR>
+		<TR><TD ALIGN=CENTER>4</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan3</TD></TR>
+		<TR><TD ALIGN=CENTER>5</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan4</TD></TR>
+		<TR><TD ALIGN=CENTER>6</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan5</TD></TR>
+		<TR><TD ALIGN=CENTER>7</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan6</TD></TR>
+		<TR><TD ALIGN=CENTER>8</TD>		<TD ALIGN=CENTER>WAN</TD>		<TD ALIGN=CENTER>wan7</TD></TR>
+		<TR><TD ALIGN=CENTER>9</TD>		<TD ALIGN=CENTER>Ethernet</TD>	<TD ALIGN=CENTER>eth0</TD></TR>
+		<TR><TD ALIGN=CENTER>10</TD>	<TD ALIGN=CENTER>Ethernet</TD>	<TD ALIGN=CENTER>eth1</TD></TR>
+	</TABLE>
+	</CENTER>
+</UL>
+
+<H3>Packet Trace Data Format</H3>
+<UL>
+	The format of the trace data that is sent to the SMP follows a portion of the libpcap file format
+	and is summarized here.  This format specifies the generic requirements needed to
+	be able to decode packets, but does not cover ACN specifics such as custom MAC addressing
+	and WAN protocol support.
+	<P>
+
+	Although a libpcap file begins with a global header followed by zero or
+	more records for each captured packet, trace data sent to the SMP does NOT begin with a global header.
+	A trace sequence looks like this:
+	<P>
+	<TABLE>
+		<TR>
+  			<TD STYLE="background-color: #c0FFc0">&nbsp;[Packet Header]&nbsp;</TD>
+  			<TD STYLE="background-color: #c0FFc0">&nbsp;[Packet Data]&nbsp;</TD>
+  			<TD STYLE="background-color: #c0c0FF">&nbsp;[Packet Header]&nbsp;</TD>
+  			<TD STYLE="background-color: #c0c0FF">&nbsp;[Packet Data]&nbsp;</TD>
+  			<TD STYLE="background-color: #e0c0c0">&nbsp;[Packet Header]&nbsp;</TD>
+  			<TD STYLE="background-color: #e0c0c0">&nbsp;[Packet Data]&nbsp;</TD>
+  			<TD>...</TD>
+		</TR>
+	</TABLE>
+
+<H4>Packet Header</H4>
+	<UL>
+		Each captured packet starts with a header that contains the following values
+		(in network neutral order):
+
+		<FONT SIZE=-1>
+		<PRE>
+ uint32 tv_sec;  /* timestamp seconds */
+ uint32 tv_usec; /* timestamp microseconds */
+ uint32 caplen;  /* number of octets in the following packet */
+ uint32 len;     /* original length of packet on the wire */
+		</PRE>
+		</FONT>
+
+		<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+			<TR>
+				<TD VALIGN=TOP>tv_sec</TD>
+				<TD>The date and time when this packet was captured.
+					This value is in seconds since January 1, 1970 00:00:00 GMT;
+					this is also known as a UN*X time_t. You can use the ANSI C
+					<em>time()</em> function from <em>time.h</em> to get this value,
+					but you might use a more optimized way to get this timestamp value.
+					If this timestamp isn't based on GMT (UTC), use <em>thiszone</em>
+					from the global header for adjustments.</TD>
+			</TR>
+			<TR>
+				<TD VALIGN=TOP>tv_usec</TD>
+				<TD>The microseconds when this packet was captured, as an offset to <em>ts_sec</em>.
+					<B>Beware: </B>this value must never reach 1 second (1,000,000),
+					in this case <em>ts_sec</em> must be increased instead!</TD>
+			</TR>
+			<TR>
+				<TD VALIGN=TOP>caplen</TD>
+				<TD>The number of bytes actually provided in the capture record.
+					This value should never become larger than <em>len</em> or the
+					<em>snaplen</em> value specified during the capture.</TD>
+			</TR>
+			<TR>
+				<TD VALIGN=TOP>len</TD>
+				<TD>The length of the packet "on the wire" when it was captured.
+					If <em>caplen</em> and <em>len</em> differ, the actually
+					saved packet size was limited by the value of <em>snaplen</em> specified
+					during one of the capture directives such as pcap_dispatch().</TD>
+			</TR>
+		</TABLE>
+	</UL>
+
+<H4>Packet Data</H4>
+	<UL>
+	The actual packet data will immediately follow the packet header as a sequence of <em>caplen</em> octets.
+	Depending on the DLT encoding number assigned to the interface, the packet data will contain an additional
+	custom header used to convey WAN port related information.
+	</UL>
+
+<H4>ACN Custom Packet Header</H4>
+	<UL>
+	PCAP, Wireshark and Tcpdump enhancements have been added to the ACN to support
+	monitoring of its ports, however each of these facilities were focused on capturing
+	and displaying traffic from LAN interfaces.  The SITA extentions to these facilities
+	are used to also provide the ability to capture, filter, and display information from
+	an ACN's WAN ports.
+	<P>
+	Although each packet follows the standard libpcap format, since there are
+	two types of interfaces that can be monitored, the format of the data
+	packet varies slightly.
+	<P>
+	<UL TYPE=DISC>
+		<LI>For Ethernet (like) devices, the packet format is unchanged from the standard Pcap format.
+		<LI>For WAN devices, the packet contains a 5 byte header that preceeds the actual captured data
+			described by the following table:
+	</UL>
+	<P>
+	<CENTER>
+	<TABLE BORDER=1 CELLSPACING=0 CELLPADDING=3>
+	<TR>	<TH>Octet</TH>
+			<TH>Name</TH>
+			<TH>Mask/Value</TH>
+			<TH COLSPAN=2>Definition</TH>		</TR>
+
+	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=3>0</TH>
+			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=3>Control / Status</TH>
+
+			<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx0</FONT></TD>
+			<TD>Transmitted by capture device</TD>
+			<TD ROWSPAN=2 ALIGN=CENTER>(see 'Errors' octets)</TD>							</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>
+			<TD>Received by capture device</TD>												</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>
+			<TD COLSPAN=2>No buffer was available during capture of previous packet.</TD>	</TR>
+
+	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=8>1</TH>
+			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=8>Signals</TH>
+
+			<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>	<TD COLSPAN=2>DSR asserted</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD>	<TD COLSPAN=2>DTR asserted</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD>	<TD COLSPAN=2>CTS asserted</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD>	<TD COLSPAN=2>RTS asserted</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD>	<TD COLSPAN=2>DCD asserted</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD>	<TD COLSPAN=2>Undefined</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD>	<TD COLSPAN=2>Undefined</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>	<TD COLSPAN=2>Undefined</TD>		</TR>
+
+	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>2</TH>
+			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>Errors<BR>(octet 1)</TH>
+
+			<TH>&nbsp;</TH>															<TH>Tx</TH>						<TH>Rx</TH>				</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>	<TD>Underrun</TD>				<TD>Framing</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD>	<TD>CTS Lost</TD>				<TD>Parity</TD>			</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD>	<TD>UART Error</TD>				<TD>Collision</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD>	<TD>Re-Tx Limit Reached</TD>	<TD>Long Frame</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Short Frame</TD>	</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Undefined</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Undefined</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>	<TD>Undefined</TD>				<TD>Undefined</TD>		</TR>
+
+	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>3</TH>
+			<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=9>Errors<BR>(octet 2)</TH>
+
+			<TH>&nbsp;</TH>															<TH>Tx</TH>			<TH>Rx</TH>						</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxxx1</FONT></TD>	<TD>Undefined</TD>	<TD>Non-Octet Aligned</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxxx1x</FONT></TD>	<TD>Undefined</TD>	<TD>Abort Received</TD>			</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxxx1xx</FONT></TD>	<TD>Undefined</TD>	<TD>CD Lost</TD>				</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxxx1xxx</FONT></TD>	<TD>Undefined</TD>	<TD>Digital PLL Error</TD>		</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xxx1xxxx</FONT></TD>	<TD>Undefined</TD>	<TD>Overrun</TD>				</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">xx1xxxxx</FONT></TD>	<TD>Undefined</TD>	<TD>Frame Length Violation</TD>	</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">x1xxxxxx</FONT></TD>	<TD>Undefined</TD>	<TD>CRC Error</TD>				</TR>
+	<TR>	<TD VALIGN=TOP ALIGN=CENTER><FONT FACE="COURIER">1xxxxxxx</FONT></TD>	<TD>Undefined</TD>	<TD>Break Received</TD>			</TR>
+
+	<TR>	<TH VALIGN=TOP ALIGN=CENTER ROWSPAN=12>4</TH>
+			<TH VALIGN=TOP ALIGN=CENTER>Protocol</TH>
+
+			<TD COLSPAN=3>
+				<CENTER>
+				<TABLE BORDER=0 CELLPADDING=0 CELLSPACING=0>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x01</TD>	<TD>-</TD>	<TD>LAPB (BOP)				<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x02</TD>	<TD>-</TD>	<TD>Ethernet				<SUP>1</SUP>		</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x03</TD>	<TD>-</TD>	<TD>Async (Interrupt IO)	<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x04</TD>	<TD>-</TD>	<TD>Async (Block IO)		<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x05</TD>	<TD>-</TD>	<TD>IPARS					<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x06</TD>	<TD>-</TD>	<TD>UTS						<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x07</TD>	<TD>-</TD>	<TD>PPP (HDLC)				<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x08</TD>	<TD>-</TD>	<TD>SDLC					<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x09</TD>	<TD>-</TD>	<TD>Token Ring				<SUP>1</SUP>		</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x10</TD>	<TD>-</TD>	<TD>I2C						<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x11</TD>	<TD>-</TD>	<TD>DPM Link				<SUP>&nbsp;</SUP>	</TD>	</TR>
+					<TR VALIGN=BOTTOM><TD ALIGN=CENTER>0x12</TD>	<TD>-</TD>	<TD>Frame Relay (BOP)		<SUP>&nbsp;</SUP>	</TD>	</TR>
+				</TABLE>
+				</CENTER>
+				<P>
+				<STRONG>Note 1:</STRONG>
+				Ethernet and Token Ring frames will never be sent as DLT_SITA (with the 5 octet header),
+				but will be sent as their corresponding DLT types instead.
+			</TD>
+	</TR>
+	</TABLE>
+	</CENTER>
+</UL>
+<P>
+</UL>
+</UL>
diff --git a/contrib/libpcap/pcap-snit.c b/contrib/libpcap/pcap-snit.c
index 60abe64..8f937be 100644
--- a/contrib/libpcap/pcap-snit.c
+++ b/contrib/libpcap/pcap-snit.c
@@ -25,7 +25,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-snit.c,v 1.72.2.1 2005/05/03 18:54:38 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-snit.c,v 1.73.2.4 2008-04-14 20:41:52 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -113,7 +113,6 @@ static int
 pcap_read_snit(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 {
 	register int cc, n;
-	register struct bpf_insn *fcode = p->fcode.bf_insns;
 	register u_char *bp, *cp, *ep;
 	register struct nit_bufhdr *hdrp;
 	register struct nit_iftime *ntp;
@@ -187,13 +186,13 @@ pcap_read_snit(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 		if (caplen > p->snapshot)
 			caplen = p->snapshot;
 
-		if (bpf_filter(fcode, cp, nlp->nh_pktlen, caplen)) {
+		if (bpf_filter(p->fcode.bf_insns, cp, nlp->nh_pktlen, caplen)) {
 			struct pcap_pkthdr h;
 			h.ts = ntp->nh_timestamp;
 			h.len = nlp->nh_pktlen;
 			h.caplen = caplen;
 			(*callback)(user, &h, cp);
-			if (++n >= cnt && cnt >= 0) {
+			if (++n >= cnt && cnt > 0) {
 				p->cc = ep - bp;
 				p->bp = bp;
 				return (n);
@@ -261,30 +260,29 @@ nit_setflags(int fd, int promisc, int to_ms, char *ebuf)
 	return (0);
 }
 
-pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+static int
+pcap_activate_snit(pcap_t *p)
 {
 	struct strioctl si;		/* struct for ioctl() */
 	struct ifreq ifr;		/* interface request struct */
 	int chunksize = CHUNKSIZE;
 	int fd;
 	static char dev[] = "/dev/nit";
-	register pcap_t *p;
 
-	p = (pcap_t *)malloc(sizeof(*p));
-	if (p == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
-		return (NULL);
+	if (p->opt.rfmon) {
+		/*
+		 * No monitor mode on SunOS 4.x (no Wi-Fi devices on
+		 * hardware supported by SunOS 4.x).
+		 */
+		return (PCAP_ERROR_RFMON_NOTSUP);
 	}
 
-	if (snaplen < 96)
+	if (p->snapshot < 96)
 		/*
 		 * NIT requires a snapshot length of at least 96.
 		 */
-		snaplen = 96;
+		p->snapshot = 96;
 
-	memset(p, 0, sizeof(*p));
 	/*
 	 * Initially try a read/write open (to allow the inject
 	 * method to work).  If that fails due to permission
@@ -303,19 +301,19 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	if (fd < 0 && errno == EACCES)
 		p->fd = fd = open(dev, O_RDONLY);
 	if (fd < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s", dev,
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s", dev,
 		    pcap_strerror(errno));
 		goto bad;
 	}
 
 	/* arrange to get discrete messages from the STREAM and use NIT_BUF */
 	if (ioctl(fd, I_SRDOPT, (char *)RMSGD) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "I_SRDOPT: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "I_SRDOPT: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 	if (ioctl(fd, I_PUSH, "nbuf") < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "push nbuf: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "push nbuf: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
@@ -325,34 +323,33 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	si.ic_len = sizeof(chunksize);
 	si.ic_dp = (char *)&chunksize;
 	if (ioctl(fd, I_STR, (char *)&si) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "NIOCSCHUNK: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "NIOCSCHUNK: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 
 	/* request the interface */
-	strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
+	strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
 	ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = '\0';
 	si.ic_cmd = NIOCBIND;
 	si.ic_len = sizeof(ifr);
 	si.ic_dp = (char *)&ifr;
 	if (ioctl(fd, I_STR, (char *)&si) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "NIOCBIND: %s: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "NIOCBIND: %s: %s",
 			ifr.ifr_name, pcap_strerror(errno));
 		goto bad;
 	}
 
 	/* set the snapshot length */
 	si.ic_cmd = NIOCSSNAP;
-	si.ic_len = sizeof(snaplen);
-	si.ic_dp = (char *)&snaplen;
+	si.ic_len = sizeof(p->snapshot);
+	si.ic_dp = (char *)&p->snapshot;
 	if (ioctl(fd, I_STR, (char *)&si) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "NIOCSSNAP: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "NIOCSSNAP: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
-	p->snapshot = snaplen;
-	if (nit_setflags(p->fd, promisc, to_ms, ebuf) < 0)
+	if (nit_setflags(p->fd, p->opt.promisc, p->md.timeout, p->errbuf) < 0)
 		goto bad;
 
 	(void)ioctl(fd, I_FLUSH, (char *)FLUSHR);
@@ -364,7 +361,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->bufsize = BUFSPACE;
 	p->buffer = (u_char *)malloc(p->bufsize);
 	if (p->buffer == NULL) {
-		strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
+		strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
 		goto bad;
 	}
 
@@ -402,14 +399,23 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->getnonblock_op = pcap_getnonblock_fd;
 	p->setnonblock_op = pcap_setnonblock_fd;
 	p->stats_op = pcap_stats_snit;
-	p->close_op = pcap_close_common;
 
-	return (p);
+	return (0);
  bad:
-	if (fd >= 0)
-		close(fd);
-	free(p);
-	return (NULL);
+	return (PCAP_ERROR);
+}
+
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_snit;
+	return (p);
 }
 
 int
diff --git a/contrib/libpcap/pcap-snoop.c b/contrib/libpcap/pcap-snoop.c
index f6425f1..a803434 100644
--- a/contrib/libpcap/pcap-snoop.c
+++ b/contrib/libpcap/pcap-snoop.c
@@ -20,7 +20,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.54.2.1 2005/05/03 18:54:38 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.55.2.3 2008-04-14 20:41:52 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -194,9 +194,8 @@ pcap_stats_snoop(pcap_t *p, struct pcap_stat *ps)
 }
 
 /* XXX can't disable promiscuous */
-pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+static int
+pcap_activate_snoop(pcap_t *p)
 {
 	int fd;
 	struct sockaddr_raw sr;
@@ -204,55 +203,50 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	u_int v;
 	int ll_hdrlen;
 	int snooplen;
-	pcap_t *p;
 	struct ifreq ifr;
 
-	p = (pcap_t *)malloc(sizeof(*p));
-	if (p == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
-		    pcap_strerror(errno));
-		return (NULL);
-	}
-	memset(p, 0, sizeof(*p));
 	fd = socket(PF_RAW, SOCK_RAW, RAWPROTO_SNOOP);
 	if (fd < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "snoop socket: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "snoop socket: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 	p->fd = fd;
 	memset(&sr, 0, sizeof(sr));
 	sr.sr_family = AF_RAW;
-	(void)strncpy(sr.sr_ifname, device, sizeof(sr.sr_ifname));
+	(void)strncpy(sr.sr_ifname, p->opt.source, sizeof(sr.sr_ifname));
 	if (bind(fd, (struct sockaddr *)&sr, sizeof(sr))) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "snoop bind: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "snoop bind: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
 	memset(&sf, 0, sizeof(sf));
 	if (ioctl(fd, SIOCADDSNOOP, &sf) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "SIOCADDSNOOP: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCADDSNOOP: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
-	v = 64 * 1024;
+	if (handle->opt.buffer_size != 0)
+		v = handle->opt.buffer_size;
+	else
+		v = 64 * 1024;	/* default to 64K buffer size */
 	(void)setsockopt(fd, SOL_SOCKET, SO_RCVBUF, (char *)&v, sizeof(v));
 	/*
 	 * XXX hack - map device name to link layer type
 	 */
-	if (strncmp("et", device, 2) == 0 ||	/* Challenge 10 Mbit */
-	    strncmp("ec", device, 2) == 0 ||	/* Indigo/Indy 10 Mbit,
-						   O2 10/100 */
-	    strncmp("ef", device, 2) == 0 ||	/* O200/2000 10/100 Mbit */
-	    strncmp("eg", device, 2) == 0 ||	/* Octane/O2xxx/O3xxx Gigabit */
-	    strncmp("gfe", device, 3) == 0 ||	/* GIO 100 Mbit */
-	    strncmp("fxp", device, 3) == 0 ||	/* Challenge VME Enet */
-	    strncmp("ep", device, 2) == 0 ||	/* Challenge 8x10 Mbit EPLEX */
-	    strncmp("vfe", device, 3) == 0 ||	/* Challenge VME 100Mbit */
-	    strncmp("fa", device, 2) == 0 ||
-	    strncmp("qaa", device, 3) == 0 ||
-	    strncmp("cip", device, 3) == 0 ||
-	    strncmp("el", device, 2) == 0) {
+	if (strncmp("et", p->opt.source, 2) == 0 ||	/* Challenge 10 Mbit */
+	    strncmp("ec", p->opt.source, 2) == 0 ||	/* Indigo/Indy 10 Mbit,
+							   O2 10/100 */
+	    strncmp("ef", p->opt.source, 2) == 0 ||	/* O200/2000 10/100 Mbit */
+	    strncmp("eg", p->opt.source, 2) == 0 ||	/* Octane/O2xxx/O3xxx Gigabit */
+	    strncmp("gfe", p->opt.source, 3) == 0 ||	/* GIO 100 Mbit */
+	    strncmp("fxp", p->opt.source, 3) == 0 ||	/* Challenge VME Enet */
+	    strncmp("ep", p->opt.source, 2) == 0 ||	/* Challenge 8x10 Mbit EPLEX */
+	    strncmp("vfe", p->opt.source, 3) == 0 ||	/* Challenge VME 100Mbit */
+	    strncmp("fa", p->opt.source, 2) == 0 ||
+	    strncmp("qaa", p->opt.source, 3) == 0 ||
+	    strncmp("cip", p->opt.source, 3) == 0 ||
+	    strncmp("el", p->opt.source, 2) == 0) {
 		p->linktype = DLT_EN10MB;
 		p->offset = RAW_HDRPAD(sizeof(struct ether_header));
 		ll_hdrlen = sizeof(struct ether_header);
@@ -285,29 +279,38 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 			p->dlt_list[1] = DLT_DOCSIS;
 			p->dlt_count = 2;
 		}
-	} else if (strncmp("ipg", device, 3) == 0 ||
-		   strncmp("rns", device, 3) == 0 ||	/* O2/200/2000 FDDI */
-		   strncmp("xpi", device, 3) == 0) {
+	} else if (strncmp("ipg", p->opt.source, 3) == 0 ||
+		   strncmp("rns", p->opt.source, 3) == 0 ||	/* O2/200/2000 FDDI */
+		   strncmp("xpi", p->opt.source, 3) == 0) {
 		p->linktype = DLT_FDDI;
 		p->offset = 3;				/* XXX yeah? */
 		ll_hdrlen = 13;
-	} else if (strncmp("ppp", device, 3) == 0) {
+	} else if (strncmp("ppp", p->opt.source, 3) == 0) {
 		p->linktype = DLT_RAW;
 		ll_hdrlen = 0;	/* DLT_RAW meaning "no PPP header, just the IP packet"? */
-	} else if (strncmp("qfa", device, 3) == 0) {
+	} else if (strncmp("qfa", p->opt.source, 3) == 0) {
 		p->linktype = DLT_IP_OVER_FC;
 		ll_hdrlen = 24;
-	} else if (strncmp("pl", device, 2) == 0) {
+	} else if (strncmp("pl", p->opt.source, 2) == 0) {
 		p->linktype = DLT_RAW;
 		ll_hdrlen = 0;	/* Cray UNICOS/mp pseudo link */
-	} else if (strncmp("lo", device, 2) == 0) {
+	} else if (strncmp("lo", p->opt.source, 2) == 0) {
 		p->linktype = DLT_NULL;
 		ll_hdrlen = 4;
 	} else {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE,
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 		    "snoop: unknown physical layer type");
 		goto bad;
 	}
+
+	if (p->opt.rfmon) {
+		/*
+		 * No monitor mode on Irix (no Wi-Fi devices on
+		 * hardware supported by Irix).
+		 */
+		return (PCAP_ERROR_RFMON_NOTSUP);
+	}
+
 #ifdef SIOCGIFMTU
 	/*
 	 * XXX - IRIX appears to give you an error if you try to set the
@@ -315,9 +318,9 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * the MTU first and, if that succeeds, trim the snap length
 	 * to be no greater than the MTU.
 	 */
-	(void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
+	(void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
 	if (ioctl(fd, SIOCGIFMTU, (char *)&ifr) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "SIOCGIFMTU: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMTU: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
@@ -338,8 +341,8 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 #ifndef ifr_mtu
 #define ifr_mtu	ifr_metric
 #endif
-	if (snaplen > ifr.ifr_mtu + ll_hdrlen)
-		snaplen = ifr.ifr_mtu + ll_hdrlen;
+	if (p->snapshot > ifr.ifr_mtu + ll_hdrlen)
+		p->snapshot = ifr.ifr_mtu + ll_hdrlen;
 #endif
 
 	/*
@@ -347,18 +350,17 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * payload bytes to capture - it doesn't count link-layer
 	 * header bytes.
 	 */
-	snooplen = snaplen - ll_hdrlen;
+	snooplen = p->snapshot - ll_hdrlen;
 	if (snooplen < 0)
 		snooplen = 0;
 	if (ioctl(fd, SIOCSNOOPLEN, &snooplen) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "SIOCSNOOPLEN: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCSNOOPLEN: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
-	p->snapshot = snaplen;
 	v = 1;
 	if (ioctl(fd, SIOCSNOOPING, &v) < 0) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "SIOCSNOOPING: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCSNOOPING: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
@@ -366,7 +368,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->bufsize = 4096;				/* XXX */
 	p->buffer = (u_char *)malloc(p->bufsize);
 	if (p->buffer == NULL) {
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
 		    pcap_strerror(errno));
 		goto bad;
 	}
@@ -384,18 +386,23 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->getnonblock_op = pcap_getnonblock_fd;
 	p->setnonblock_op = pcap_setnonblock_fd;
 	p->stats_op = pcap_stats_snoop;
-	p->close_op = pcap_close_common;
 
-	return (p);
+	return (0);
  bad:
-	(void)close(fd);
-	/*
-	 * Get rid of any link-layer type list we allocated.
-	 */
-	if (p->dlt_list != NULL)
-		free(p->dlt_list);
-	free(p);
-	return (NULL);
+	return (PCAP_ERROR);
+}
+
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_snoop;
+	return (p);
 }
 
 int
diff --git a/contrib/libpcap/pcap-stdinc.h b/contrib/libpcap/pcap-stdinc.h
index 1281024..870e334 100644
--- a/contrib/libpcap/pcap-stdinc.h
+++ b/contrib/libpcap/pcap-stdinc.h
@@ -28,6 +28,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-stdinc.h,v 1.10.2.1 2008-10-06 15:38:39 gianluca Exp $ (LBL)
  */
 
 #define SIZEOF_CHAR 1
@@ -61,4 +62,29 @@
 
 #define snprintf _snprintf
 #define vsnprintf _vsnprintf
+#define strdup _strdup
 #define inline __inline 
+
+#ifdef __MINGW32__
+#include <stdint.h>
+#else /*__MINGW32__*/
+/* MSVC compiler */
+#ifndef _UINTPTR_T_DEFINED
+#ifdef  _WIN64
+typedef unsigned __int64    uintptr_t;
+#else
+typedef _W64 unsigned int   uintptr_t;
+#endif
+#define _UINTPTR_T_DEFINED
+#endif
+
+#ifndef _INTPTR_T_DEFINED
+#ifdef  _WIN64
+typedef __int64    intptr_t;
+#else
+typedef _W64 int   intptr_t;
+#endif
+#define _INTPTR_T_DEFINED
+#endif 
+
+#endif /*__MINGW32__*/
diff --git a/contrib/libpcap/pcap-usb-linux.c b/contrib/libpcap/pcap-usb-linux.c
new file mode 100644
index 0000000..830abc7
--- /dev/null
+++ b/contrib/libpcap/pcap-usb-linux.c
@@ -0,0 +1,730 @@
+/*
+ * Copyright (c) 2006 Paolo Abeni (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote 
+ * products derived from this software without specific prior written 
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * USB sniffing API implementation for Linux platform
+ * By Paolo Abeni <paolo.abeni@email.it>
+ * Modifications: Kris Katterjohn <katterjohn@gmail.com>
+ *
+ */
+#ifndef lint
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-usb-linux.c,v 1.16.2.8 2008-04-14 21:06:29 guy Exp $ (LBL)";
+#endif
+ 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "pcap-int.h"
+#include "pcap-usb-linux.h"
+#include "pcap/usb.h"
+
+#ifdef NEED_STRERROR_H
+#include "strerror.h"
+#endif
+
+#include <ctype.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <string.h>
+#include <dirent.h>
+#include <byteswap.h>
+#include <netinet/in.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+
+#define USB_IFACE "usb"
+#define USB_TEXT_DIR "/sys/kernel/debug/usbmon"
+#define USB_BUS_DIR "/proc/bus/usb"
+#define USB_LINE_LEN 4096
+
+
+#define PIPE_IN			0x80
+#define PIPE_ISOCHRONOUS	0
+#define PIPE_INTERRUPT		1
+#define PIPE_CONTROL		2
+#define PIPE_BULK		3
+
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define htols(s) s
+#define htoll(l) l
+#define htol64(ll) ll
+#else
+#define htols(s) bswap_16(s)
+#define htoll(l) bswap_32(l)
+#define htol64(ll) bswap_64(ll)
+#endif
+
+struct mon_bin_stats {
+	u_int32_t queued;
+	u_int32_t dropped;
+};
+
+struct mon_bin_get {
+	pcap_usb_header *hdr;
+	void *data;
+	size_t data_len;   /* Length of data (can be zero) */
+};
+
+struct mon_bin_mfetch {
+	int32_t *offvec;   /* Vector of events fetched */
+	int32_t nfetch;    /* Number of events to fetch (out: fetched) */
+	int32_t nflush;    /* Number of events to flush */
+};
+
+#define MON_IOC_MAGIC 0x92
+
+#define MON_IOCQ_URB_LEN _IO(MON_IOC_MAGIC, 1)
+#define MON_IOCX_URB  _IOWR(MON_IOC_MAGIC, 2, struct mon_bin_hdr)
+#define MON_IOCG_STATS _IOR(MON_IOC_MAGIC, 3, struct mon_bin_stats)
+#define MON_IOCT_RING_SIZE _IO(MON_IOC_MAGIC, 4)
+#define MON_IOCQ_RING_SIZE _IO(MON_IOC_MAGIC, 5)
+#define MON_IOCX_GET   _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get)
+#define MON_IOCX_MFETCH _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch)
+#define MON_IOCH_MFLUSH _IO(MON_IOC_MAGIC, 8)
+
+#define MON_BIN_SETUP 	0x1 /* setup hdr is present*/
+#define MON_BIN_SETUP_ZERO 	0x2 /* setup buffer is not available */
+#define MON_BIN_DATA_ZERO 	0x4 /* data buffer is not available */
+#define MON_BIN_ERROR 	0x8
+
+/* forward declaration */
+static int usb_activate(pcap_t *);
+static int usb_stats_linux(pcap_t *, struct pcap_stat *);
+static int usb_stats_linux_bin(pcap_t *, struct pcap_stat *);
+static int usb_read_linux(pcap_t *, int , pcap_handler , u_char *);
+static int usb_read_linux_bin(pcap_t *, int , pcap_handler , u_char *);
+static int usb_read_linux_mmap(pcap_t *, int , pcap_handler , u_char *);
+static int usb_inject_linux(pcap_t *, const void *, size_t);
+static int usb_setfilter_linux(pcap_t *, struct bpf_program *);
+static int usb_setdirection_linux(pcap_t *, pcap_direction_t);
+static void usb_cleanup_linux_mmap(pcap_t *);
+
+/* facility to add an USB device to the device list*/
+static int 
+usb_dev_add(pcap_if_t** alldevsp, int n, char *err_str)
+{
+	char dev_name[10];
+	char dev_descr[30]; 
+	snprintf(dev_name, 10, USB_IFACE"%d", n);
+	snprintf(dev_descr, 30, "USB bus number %d", n);
+
+	if (pcap_add_if(alldevsp, dev_name, 0, 
+	    dev_descr, err_str) < 0)
+		return -1;
+	return 0; 
+}
+
+int 
+usb_platform_finddevs(pcap_if_t **alldevsp, char *err_str)
+{
+	struct dirent* data;
+	int ret = 0;
+	DIR* dir;
+
+	/* scan procfs usb bus directory */
+	dir = opendir(USB_BUS_DIR);
+	if (!dir) return 0;
+	while ((ret == 0) && ((data = readdir(dir)) != 0)) {
+		int n;
+		char* name = data->d_name;
+		int len = strlen(name);
+
+		/* if this file name does not end with a number it's not of our interest */
+		if ((len < 1) || !isdigit(name[--len]))
+			continue;
+		while (isdigit(name[--len]));
+		if (sscanf(&name[len+1], "%d", &n) != 1) 
+			continue;
+
+		ret = usb_dev_add(alldevsp, n, err_str);
+	}
+
+	closedir(dir);
+	return ret;
+}
+
+static 
+int usb_mmap(pcap_t* handle)
+{
+	int len = ioctl(handle->fd, MON_IOCQ_RING_SIZE);
+	if (len < 0) 
+		return 0;
+
+	handle->buffer = mmap(0, len, PROT_READ, MAP_SHARED, handle->fd, 0);
+	return handle->buffer != MAP_FAILED;
+}
+
+pcap_t *
+usb_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	p = pcap_create_common(device, ebuf);
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = usb_activate;
+	return (p);
+}
+
+static int
+usb_activate(pcap_t* handle)
+{
+	char 		full_path[USB_LINE_LEN];
+
+	/* Initialize some components of the pcap structure. */
+	handle->bufsize = handle->snapshot;
+	handle->offset = 0;
+	handle->linktype = DLT_USB_LINUX;
+
+	handle->inject_op = usb_inject_linux;
+	handle->setfilter_op = usb_setfilter_linux;
+	handle->setdirection_op = usb_setdirection_linux;
+	handle->set_datalink_op = NULL;	/* can't change data link type */
+	handle->getnonblock_op = pcap_getnonblock_fd;
+	handle->setnonblock_op = pcap_setnonblock_fd;
+
+	/*get usb bus index from device name */
+	if (sscanf(handle->opt.source, USB_IFACE"%d", &handle->md.ifindex) != 1)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't get USB bus index from %s", handle->opt.source);
+		return PCAP_ERROR;
+	}
+
+	/*now select the read method: try to open binary interface */
+	snprintf(full_path, USB_LINE_LEN, LINUX_USB_MON_DEV"%d", handle->md.ifindex);  
+	handle->fd = open(full_path, O_RDONLY, 0);
+	if (handle->fd >= 0)
+	{
+		if (handle->opt.rfmon) {
+			/*
+			 * Monitor mode doesn't apply to USB devices.
+			 */
+			return PCAP_ERROR_RFMON_NOTSUP;
+		}
+
+		/* binary api is available, try to use fast mmap access */
+		if (usb_mmap(handle)) {
+			handle->stats_op = usb_stats_linux_bin;
+			handle->read_op = usb_read_linux_mmap;
+			handle->cleanup_op = usb_cleanup_linux_mmap;
+
+			/*
+			 * "handle->fd" is a real file, so "select()" and
+			 * "poll()" work on it.
+			 */
+			handle->selectable_fd = handle->fd;
+			return 0;
+		}
+
+		/* can't mmap, use plain binary interface access */
+		handle->stats_op = usb_stats_linux_bin;
+		handle->read_op = usb_read_linux_bin;
+	}
+	else {
+		/*Binary interface not available, try open text interface */
+		snprintf(full_path, USB_LINE_LEN, USB_TEXT_DIR"/%dt", handle->md.ifindex);  
+		handle->fd = open(full_path, O_RDONLY, 0);
+		if (handle->fd < 0)
+		{
+			/* no more fallback, give it up*/
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				"Can't open USB bus file %s: %s", full_path, strerror(errno));
+			return PCAP_ERROR;
+		}
+		handle->stats_op = usb_stats_linux;
+		handle->read_op = usb_read_linux;
+	}
+
+	if (handle->opt.rfmon) {
+		/*
+		 * Monitor mode doesn't apply to USB devices.
+		 */
+		return PCAP_ERROR_RFMON_NOTSUP;
+	}
+
+	/*
+	 * "handle->fd" is a real file, so "select()" and "poll()"
+	 * work on it.
+	 */
+	handle->selectable_fd = handle->fd;
+
+	/* for plain binary access and text access we need to allocate the read
+	 * buffer */
+	handle->buffer = malloc(handle->bufsize);
+	if (!handle->buffer) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "malloc: %s", pcap_strerror(errno));
+		return PCAP_ERROR;
+	}
+	return 0;
+}
+
+static inline int 
+ascii_to_int(char c)
+{
+	return c < 'A' ? c- '0': ((c<'a') ? c - 'A' + 10: c-'a'+10);
+}
+
+/*
+ * see <linux-kernel-source>/Documentation/usb/usbmon.txt and 
+ * <linux-kernel-source>/drivers/usb/mon/mon_text.c for urb string 
+ * format description
+ */
+static int
+usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
+{
+	/* see:
+	* /usr/src/linux/Documentation/usb/usbmon.txt 
+	* for message format
+	*/
+	unsigned timestamp;
+	int tag, cnt, ep_num, dev_addr, dummy, ret, urb_len, data_len;
+	char etype, pipeid1, pipeid2, status[16], urb_tag, line[USB_LINE_LEN];
+	char *string = line;
+	u_char * rawdata = handle->buffer;
+	struct pcap_pkthdr pkth;
+	pcap_usb_header* uhdr = (pcap_usb_header*)handle->buffer;
+	u_char urb_transfer=0;
+	int incoming=0;
+
+	/* ignore interrupt system call errors */
+	do {
+		ret = read(handle->fd, line, USB_LINE_LEN - 1);
+		if (handle->break_loop)
+		{
+			handle->break_loop = 0;
+			return -2;
+		}
+	} while ((ret == -1) && (errno == EINTR));
+	if (ret < 0)
+	{
+		if (errno == EAGAIN)
+			return 0;	/* no data there */
+
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "Can't read from fd %d: %s", handle->fd, strerror(errno));
+		return -1;
+	}
+
+	/* read urb header; %n argument may increment return value, but it's 
+	* not mandatory, so does not count on it*/
+	string[ret] = 0;
+	ret = sscanf(string, "%x %d %c %c%c:%d:%d %s%n", &tag, &timestamp, &etype, 
+		&pipeid1, &pipeid2, &dev_addr, &ep_num, status, 
+		&cnt);
+	if (ret < 8)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "Can't parse USB bus message '%s', too few tokens (expected 8 got %d)",
+		    string, ret);
+		return -1;
+	}
+	uhdr->id = tag;
+	uhdr->endpoint_number = ep_num;
+	uhdr->device_address = dev_addr;
+	uhdr->bus_id = handle->md.ifindex;
+	uhdr->status = 0;
+	string += cnt;
+
+	/* don't use usbmon provided timestamp, since it have low precision*/
+	if (gettimeofday(&pkth.ts, NULL) < 0) 
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't get timestamp for message '%s' %d:%s", 
+			string, errno, strerror(errno));
+		return -1;
+	}
+	uhdr->ts_sec = pkth.ts.tv_sec;
+	uhdr->ts_usec = pkth.ts.tv_usec;
+
+	/* parse endpoint information */
+	if (pipeid1 == 'C')
+		urb_transfer = URB_CONTROL;
+	else if (pipeid1 == 'Z')
+		urb_transfer = URB_ISOCHRONOUS;
+	else if (pipeid1 == 'I')
+		urb_transfer = URB_INTERRUPT;
+	else if (pipeid1 == 'B')
+		urb_transfer = URB_BULK;
+	if (pipeid2 == 'i') {
+		urb_transfer |= URB_TRANSFER_IN;
+		incoming = 1;
+	}
+	if (etype == 'C')
+		incoming = !incoming;
+
+	/* direction check*/
+	if (incoming)
+	{
+		if (handle->direction == PCAP_D_OUT)
+			return 0;
+	}
+	else
+		if (handle->direction == PCAP_D_IN)
+			return 0;
+	uhdr->event_type = etype;
+	uhdr->transfer_type = urb_transfer;
+	pkth.caplen = sizeof(pcap_usb_header);
+	rawdata += sizeof(pcap_usb_header);
+
+	/* check if this is a setup packet */
+	ret = sscanf(status, "%d", &dummy);
+	if (ret != 1)
+	{
+		/* this a setup packet, setup data can be filled with underscore if
+		* usbmon has not been able to read them, so we must parse this fields as 
+		* strings */
+		pcap_usb_setup* shdr;
+		char str1[3], str2[3], str3[5], str4[5], str5[5];
+		ret = sscanf(string, "%s %s %s %s %s%n", str1, str2, str3, str4, 
+		str5, &cnt);
+		if (ret < 5)
+		{
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				"Can't parse USB bus message '%s', too few tokens (expected 5 got %d)",
+				string, ret);
+			return -1;
+		}
+		string += cnt;
+
+		/* try to convert to corresponding integer */
+		shdr = &uhdr->setup;
+		shdr->bmRequestType = strtoul(str1, 0, 16);
+		shdr->bRequest = strtoul(str2, 0, 16);
+		shdr->wValue = htols(strtoul(str3, 0, 16));
+		shdr->wIndex = htols(strtoul(str4, 0, 16));
+		shdr->wLength = htols(strtoul(str5, 0, 16));
+
+		uhdr->setup_flag = 0;
+	}
+	else 
+		uhdr->setup_flag = 1;
+
+	/* read urb data */
+	ret = sscanf(string, " %d%n", &urb_len, &cnt);
+	if (ret < 1)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		  "Can't parse urb length from '%s'", string);
+		return -1;
+	}
+	string += cnt;
+
+	/* urb tag is not present if urb length is 0, so we can stop here 
+	 * text parsing */
+	pkth.len = urb_len+pkth.caplen;
+	uhdr->urb_len = urb_len;
+	uhdr->data_flag = 1;
+	data_len = 0;
+	if (uhdr->urb_len == pkth.caplen)
+		goto got;
+
+	/* check for data presence; data is present if and only if urb tag is '=' */
+	if (sscanf(string, " %c", &urb_tag) != 1)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't parse urb tag from '%s'", string);
+		return -1;
+	}
+
+	if (urb_tag != '=') 
+		goto got;
+
+	/* skip urb tag and following space */
+	string += 3;
+
+	/* if we reach this point we got some urb data*/
+	uhdr->data_flag = 0;
+
+	/* read all urb data; if urb length is greater then the usbmon internal 
+	 * buffer length used by the kernel to spool the URB, we get only
+	 * a partial information.
+	 * At least until linux 2.6.17 there is no way to set usbmon intenal buffer
+	 * length and default value is 130. */
+	while ((string[0] != 0) && (string[1] != 0) && (pkth.caplen < handle->snapshot))
+	{
+		rawdata[0] = ascii_to_int(string[0]) * 16 + ascii_to_int(string[1]);
+		rawdata++;
+		string+=2;
+		if (string[0] == ' ')
+			string++;
+		pkth.caplen++;
+		data_len++;
+	}
+
+got:
+	uhdr->data_len = data_len;
+	handle->md.packets_read++;
+	if (pkth.caplen > handle->snapshot)
+		pkth.caplen = handle->snapshot;
+
+	callback(user, &pkth, handle->buffer);
+	return 1;
+}
+
+static int
+usb_inject_linux(pcap_t *handle, const void *buf, size_t size)
+{
+	snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "inject not supported on "
+		"USB devices");
+	return (-1);
+}
+
+static int 
+usb_stats_linux(pcap_t *handle, struct pcap_stat *stats)
+{
+	int dummy, ret, consumed, cnt;
+	char string[USB_LINE_LEN];
+	char token[USB_LINE_LEN];
+	char * ptr = string;
+	snprintf(string, USB_LINE_LEN, USB_TEXT_DIR"/%ds", handle->md.ifindex);
+
+	int fd = open(string, O_RDONLY, 0);
+	if (fd < 0)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't open USB stats file %s: %s", 
+			string, strerror(errno));
+		return -1;
+	}
+
+	/* read stats line */
+	do {
+		ret = read(fd, string, USB_LINE_LEN-1);
+	} while ((ret == -1) && (errno == EINTR));
+	close(fd);
+
+	if (ret < 0)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't read stats from fd %d ", fd);
+		return -1;
+	}
+	string[ret] = 0;
+
+	/* extract info on dropped urbs */
+	for (consumed=0; consumed < ret; ) {
+		/* from the sscanf man page: 
+ 		 * The C standard says: "Execution of a %n directive does 
+ 		 * not increment the assignment count returned at the completion
+		 * of  execution" but the Corrigendum seems to contradict this.
+		 * Do not make any assumptions on the effect of %n conversions 
+		 * on the return value and explicitly check for cnt assignmet*/
+		cnt = -1;
+		int ntok = sscanf(ptr, "%s%n", token, &cnt);
+		if ((ntok < 1) || (cnt < 0))
+			break;
+		consumed += cnt;
+		ptr += cnt;
+		if (strcmp(token, "nreaders") == 0)
+			ret = sscanf(ptr, "%d", &stats->ps_drop);
+		else 
+			ret = sscanf(ptr, "%d", &dummy);
+		if (ntok != 1)
+			break;
+		consumed += cnt;
+		ptr += cnt;
+	}
+
+	stats->ps_recv = handle->md.packets_read;
+	stats->ps_ifdrop = 0;
+	return 0;
+}
+
+static int 
+usb_setfilter_linux(pcap_t *p, struct bpf_program *fp)
+{
+	return 0;
+}
+
+static int 
+usb_setdirection_linux(pcap_t *p, pcap_direction_t d)
+{
+	p->direction = d;
+	return 0;
+}
+
+
+static int 
+usb_stats_linux_bin(pcap_t *handle, struct pcap_stat *stats)
+{
+	int ret;
+	struct mon_bin_stats st;
+	ret = ioctl(handle->fd, MON_IOCG_STATS, &st);
+	if (ret < 0)
+	{
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			"Can't read stats from fd %d:%s ", handle->fd, strerror(errno));
+		return -1;
+	}
+
+	stats->ps_recv = handle->md.packets_read + st.queued;
+	stats->ps_ifdrop = st.dropped;
+	return 0;
+}
+
+/*
+ * see <linux-kernel-source>/Documentation/usb/usbmon.txt and 
+ * <linux-kernel-source>/drivers/usb/mon/mon_bin.c binary ABI
+ */
+static int
+usb_read_linux_bin(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
+{
+	struct mon_bin_get info;
+	int ret;
+	struct pcap_pkthdr pkth;
+	int clen = handle->snapshot - sizeof(pcap_usb_header);
+
+	/* the usb header is going to be part of 'packet' data*/
+	info.hdr = (pcap_usb_header*) handle->buffer;
+	info.data = handle->buffer + sizeof(pcap_usb_header);
+	info.data_len = clen;
+
+	/* ignore interrupt system call errors */
+	do {
+		ret = ioctl(handle->fd, MON_IOCX_GET, &info);
+		if (handle->break_loop)
+		{
+			handle->break_loop = 0;
+			return -2;
+		}
+	} while ((ret == -1) && (errno == EINTR));
+	if (ret < 0)
+	{
+		if (errno == EAGAIN)
+			return 0;	/* no data there */
+
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "Can't read from fd %d: %s", handle->fd, strerror(errno));
+		return -1;
+	}
+
+	/* we can get less that than really captured from kernel, depending on
+	 * snaplen, so adjust header accordingly */
+	if (info.hdr->data_len < clen)
+		clen = info.hdr->data_len;
+	info.hdr->data_len = clen;
+	pkth.caplen = clen + sizeof(pcap_usb_header);
+	pkth.len = info.hdr->urb_len + sizeof(pcap_usb_header);
+	pkth.ts.tv_sec = info.hdr->ts_sec;
+	pkth.ts.tv_usec = info.hdr->ts_usec;
+
+	handle->md.packets_read++;
+	callback(user, &pkth, handle->buffer);
+	return 1;
+}
+
+/*
+ * see <linux-kernel-source>/Documentation/usb/usbmon.txt and 
+ * <linux-kernel-source>/drivers/usb/mon/mon_bin.c binary ABI
+ */
+#define VEC_SIZE 32
+static int
+usb_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
+{
+	struct mon_bin_mfetch fetch;
+	int32_t vec[VEC_SIZE];
+	struct pcap_pkthdr pkth;
+	pcap_usb_header* hdr;
+	int nflush = 0;
+	int packets = 0;
+
+	for (;;) {
+		int i, ret;
+		int limit = max_packets - packets;
+		if (limit <= 0)
+			limit = VEC_SIZE;
+		if (limit > VEC_SIZE)
+			limit = VEC_SIZE;
+
+		/* try to fetch as many events as possible*/
+		fetch.offvec = vec;
+		fetch.nfetch = limit;
+		fetch.nflush = nflush;
+		/* ignore interrupt system call errors */
+		do {
+			ret = ioctl(handle->fd, MON_IOCX_MFETCH, &fetch);
+			if (handle->break_loop)
+			{
+				handle->break_loop = 0;
+				return -2;
+			}
+		} while ((ret == -1) && (errno == EINTR));
+		if (ret < 0)
+		{
+			if (errno == EAGAIN)
+				return 0;	/* no data there */
+
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			    "Can't mfetch fd %d: %s", handle->fd, strerror(errno));
+			return -1;
+		}
+
+		/* keep track of processed events, we will flush them later */
+		nflush = fetch.nfetch;
+		for (i=0; i<fetch.nfetch; ++i) {
+			/* discard filler */
+			hdr = (pcap_usb_header*) &handle->buffer[vec[i]];
+			if (hdr->event_type == '@') 
+				continue;
+
+			/* get packet info from header*/
+			pkth.caplen = hdr->data_len + sizeof(pcap_usb_header);
+			pkth.len = hdr->urb_len + sizeof(pcap_usb_header);
+			pkth.ts.tv_sec = hdr->ts_sec;
+			pkth.ts.tv_usec = hdr->ts_usec;
+
+			handle->md.packets_read++;
+			callback(user, &pkth, (u_char*) hdr);
+			packets++;
+		}
+
+		/* with max_packets <= 0 we stop afer the first chunk*/
+		if ((max_packets <= 0) || (packets == max_packets))
+			break;
+	}
+
+	/* flush pending events*/
+	ioctl(handle->fd, MON_IOCH_MFLUSH, nflush);
+	return packets;
+}
+
+static void
+usb_cleanup_linux_mmap(pcap_t* handle)
+{
+	/* buffer must not be freed because it's memory mapped */
+	/* XXX - does it need to be unmapped? */
+	handle->buffer = NULL;
+	pcap_cleanup_live_common(handle);
+}
diff --git a/contrib/libpcap/pcap-usb-linux.h b/contrib/libpcap/pcap-usb-linux.h
new file mode 100644
index 0000000..a157907
--- /dev/null
+++ b/contrib/libpcap/pcap-usb-linux.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2006 Paolo Abeni (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote 
+ * products derived from this software without specific prior written 
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * USB sniffing API implementation for Linux platform
+ * By Paolo Abeni <paolo.abeni@email.it>
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap-usb-linux.h,v 1.4.2.1 2008-04-04 19:39:06 guy Exp $ (LBL)
+ */
+
+/*
+ * Prototypes for USB-related functions
+ */
+int usb_platform_finddevs(pcap_if_t **alldevsp, char *err_str);
+pcap_t *usb_create(const char *device, char *ebuf);
diff --git a/contrib/libpcap/pcap-win32.c b/contrib/libpcap/pcap-win32.c
index 435da66..4fea621 100644
--- a/contrib/libpcap/pcap-win32.c
+++ b/contrib/libpcap/pcap-win32.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
- * Copyright (c) 2005 - 2007 CACE Technologies, Davis (California)
+ * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -33,12 +33,16 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.25.2.7 2007/06/14 22:07:14 gianluca Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.34.2.8 2008-05-21 22:11:26 gianluca Exp $ (LBL)";
 #endif
 
 #include <pcap-int.h>
 #include <Packet32.h>
-#include <Ntddndis.h>
+#ifdef __MINGW32__
+#include <ddk/ndis.h>
+#else /*__MINGW32__*/
+#include <ntddndis.h>
+#endif /*__MINGW32__*/
 #ifdef HAVE_DAG_API
 #include <dagnew.h>
 #include <dagapi.h>
@@ -53,8 +57,11 @@ static int pcap_setfilter_win32_dag(pcap_t *, struct bpf_program *);
 static int pcap_getnonblock_win32(pcap_t *, char *);
 static int pcap_setnonblock_win32(pcap_t *, int, char *);
 
-#define	PcapBufSize 256000	/*dimension of the buffer in the pcap_t structure*/
-#define	SIZE_BUF 1000000
+/*dimension of the buffer in the pcap_t structure*/
+#define	WIN32_DEFAULT_USER_BUFFER_SIZE 256000
+
+/*dimension of the buffer in the kernel driver NPF */
+#define	WIN32_DEFAULT_KERNEL_BUFFER_SIZE 1000000
 
 /* Equivalent to ntohs(), but a lot faster under Windows */
 #define SWAPS(_X) ((_X & 0xff) << 8) | (_X >> 8)
@@ -100,6 +107,43 @@ pcap_stats_win32(pcap_t *p, struct pcap_stat *ps)
 	return 0;
 }
 
+/* Set the dimension of the kernel-level capture buffer */
+static int
+pcap_setbuff_win32(pcap_t *p, int dim)
+{
+	if(PacketSetBuff(p->adapter,dim)==FALSE)
+	{
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer");
+		return -1;
+	}
+	return 0;
+}
+
+/* Set the driver working mode */
+static int
+pcap_setmode_win32(pcap_t *p, int mode)
+{
+	if(PacketSetMode(p->adapter,mode)==FALSE)
+	{
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: working mode not recognized");
+		return -1;
+	}
+
+	return 0;
+}
+
+/*set the minimum amount of data that will release a read call*/
+static int
+pcap_setmintocopy_win32(pcap_t *p, int size)
+{
+	if(PacketSetMinToCopy(p->adapter, size)==FALSE)
+	{
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: unable to set the requested mintocopy size");
+		return -1;
+	}
+	return 0;
+}
+
 static int
 pcap_read_win32_npf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 {
@@ -376,9 +420,8 @@ pcap_inject_win32(pcap_t *p, const void *buf, size_t size){
 }
 
 static void
-pcap_close_win32(pcap_t *p)
+pcap_cleanup_win32(pcap_t *p)
 {
-	pcap_close_common(p);
 	if (p->adapter != NULL) {
 		PacketCloseAdapter(p->adapter);
 		p->adapter = NULL;
@@ -387,41 +430,39 @@ pcap_close_win32(pcap_t *p)
 		PacketFreePacket(p->Packet);
 		p->Packet = NULL;
 	}
+	pcap_cleanup_live_common(p);
 }
 
-pcap_t *
-pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
-    char *ebuf)
+static int
+pcap_activate_win32(pcap_t *p)
 {
-	register pcap_t *p;
 	NetType type;
 
+	if (p->opt.rfmon) {
+		/*
+		 * No monitor mode on Windows.  It could be done on
+		 * Vista with drivers that support the native 802.11
+		 * mechanism and monitor mode.
+		 */
+		return (PCAP_ERROR_RFMON_NOTSUP);
+	}
+
 	/* Init WinSock */
 	wsockinit();
 
-	p = (pcap_t *)malloc(sizeof(*p));
-	if (p == NULL) 
-	{
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
-		return (NULL);
-	}
-	memset(p, 0, sizeof(*p));
-	p->adapter=NULL;
-
-	p->adapter = PacketOpenAdapter((char*)device);
+	p->adapter = PacketOpenAdapter(p->opt.source);
 	
 	if (p->adapter == NULL)
 	{
-		free(p);
 		/* Adapter detected but we are not able to open it. Return failure. */
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "Error opening adapter: %s", pcap_win32strerror());
-		return NULL;
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Error opening adapter: %s", pcap_win32strerror());
+		return PCAP_ERROR;
 	}
 	
 	/*get network type*/
 	if(PacketGetNetType (p->adapter,&type) == FALSE)
 	{
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "Cannot determine the network type: %s", pcap_win32strerror());
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Cannot determine the network type: %s", pcap_win32strerror());
 		goto bad;
 	}
 	
@@ -505,12 +546,12 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	}
 
 	/* Set promiscuous mode */
-	if (promisc) 
+	if (p->opt.promisc) 
 	{
 
 		if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE)
 		{
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to promiscuous mode");
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to promiscuous mode");
 			goto bad;
 		}
 	}
@@ -518,21 +559,18 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	{
 		if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE)
 		{
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to non-promiscuous mode");
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to non-promiscuous mode");
 			goto bad;
 		}
 	}
 
 	/* Set the buffer size */
-	p->bufsize = PcapBufSize;
-
-	/* Store the timeout. Used by pcap_setnonblock() */
-	p->timeout= to_ms;
+	p->bufsize = WIN32_DEFAULT_USER_BUFFER_SIZE;
 
 	/* allocate Packet structure used during the capture */
 	if((p->Packet = PacketAllocatePacket())==NULL)
 	{
-		snprintf(ebuf, PCAP_ERRBUF_SIZE, "failed to allocate the PACKET structure");
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to allocate the PACKET structure");
 		goto bad;
 	}
 
@@ -541,29 +579,32 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	/* 
 	 * Traditional Adapter 
 	 */
-		
-		p->buffer = (u_char *)malloc(PcapBufSize);
-		if (p->buffer == NULL) 
+		/*
+		 * If the buffer size wasn't explicitly set, default to
+		 * WIN32_DEFAULT_USER_BUFFER_SIZE.
+		 */
+	 	if (p->opt.buffer_size == 0)
+	 		p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE;
+
+		if(PacketSetBuff(p->adapter,p->opt.buffer_size)==FALSE)
 		{
-			snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer");
 			goto bad;
 		}
 		
-		PacketInitPacket(p->Packet,(BYTE*)p->buffer,p->bufsize);
-		
-		p->snapshot = snaplen;
-		
-		/* allocate the standard buffer in the driver */
-		if(PacketSetBuff( p->adapter, SIZE_BUF)==FALSE)
+		p->buffer = (u_char *)malloc(p->bufsize);
+		if (p->buffer == NULL) 
 		{
-			snprintf(ebuf, PCAP_ERRBUF_SIZE,"driver error: not enough memory to allocate the kernel buffer\n");
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
 			goto bad;
 		}
 		
+		PacketInitPacket(p->Packet,(BYTE*)p->buffer,p->bufsize);
+		
 		/* tell the driver to copy the buffer only if it contains at least 16K */
 		if(PacketSetMinToCopy(p->adapter,16000)==FALSE)
 		{
-			snprintf(ebuf, PCAP_ERRBUF_SIZE,"Error calling PacketSetMinToCopy: %s\n", pcap_win32strerror());
+			snprintf(p->errbuf, PCAP_ERRBUF_SIZE,"Error calling PacketSetMinToCopy: %s", pcap_win32strerror());
 			goto bad;
 		}
 	}
@@ -582,7 +623,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		
 		snprintf(keyname, sizeof(keyname), "%s\\CardParams\\%s", 
 			"SYSTEM\\CurrentControlSet\\Services\\DAG",
-			strstr(_strlwr((char*)device), "dag"));
+			strstr(_strlwr(p->opt.source), "dag"));
 		do
 		{
 			status = RegOpenKeyEx(HKEY_LOCAL_MACHINE, keyname, 0, KEY_READ, &dagkey);
@@ -616,7 +657,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	goto bad;
 #endif /* HAVE_DAG_API */
 	
-	PacketSetReadTimeout(p->adapter, to_ms);
+	PacketSetReadTimeout(p->adapter, p->md.timeout);
 	
 #ifdef HAVE_DAG_API
 	if(p->adapter->Flags & INFO_FLAG_DAG_CARD)
@@ -641,25 +682,60 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	p->getnonblock_op = pcap_getnonblock_win32;
 	p->setnonblock_op = pcap_setnonblock_win32;
 	p->stats_op = pcap_stats_win32;
-	p->close_op = pcap_close_win32;
+	p->setbuff_op = pcap_setbuff_win32;
+	p->setmode_op = pcap_setmode_win32;
+	p->setmintocopy_op = pcap_setmintocopy_win32;
+	p->cleanup_op = pcap_cleanup_win32;
 
-	return (p);
+	return (0);
 bad:
-	if (p->adapter)
-	    PacketCloseAdapter(p->adapter);
-	if (p->buffer != NULL)
-		free(p->buffer);
-	if(p->Packet)
-		PacketFreePacket(p->Packet);
-	/*
-	 * Get rid of any link-layer type list we allocated.
-	 */
-	if (p->dlt_list != NULL)
-		free(p->dlt_list);
-	free(p);
-	return (NULL);
+	pcap_cleanup_win32(p);
+	return (PCAP_ERROR);
 }
 
+pcap_t *
+pcap_create(const char *device, char *ebuf)
+{
+	pcap_t *p;
+
+	if (strlen(device) == 1)
+	{
+		/*
+		 * It's probably a unicode string
+		 * Convert to ascii and pass it to pcap_create_common
+		 *
+		 * This wonderful hack is needed because pcap_lookupdev still returns
+		 * unicode strings, and it's used by windump when no device is specified
+		 * in the command line
+		 */
+		size_t length;
+		char* deviceAscii;
+
+		length = wcslen((wchar_t*)device);
+
+		deviceAscii = (char*)malloc(length + 1);
+
+		if (deviceAscii == NULL)
+		{
+			snprintf(ebuf, PCAP_ERRBUF_SIZE, "Malloc failed");
+			return NULL;
+		}
+
+		snprintf(deviceAscii, length + 1, "%ws", (wchar_t*)device);
+		p = pcap_create_common(deviceAscii, ebuf);
+		free(deviceAscii);
+	}
+	else
+	{
+		p = pcap_create_common(device, ebuf);
+	}
+
+	if (p == NULL)
+		return (NULL);
+
+	p->activate_op = pcap_activate_win32;
+	return (p);
+}
 
 static int
 pcap_setfilter_win32_npf(pcap_t *p, struct bpf_program *fp)
@@ -736,7 +812,7 @@ pcap_setnonblock_win32(pcap_t *p, int nonblock, char *errbuf)
 		 * (Note that this may be -1, in which case we're not
 		 * really leaving non-blocking mode.)
 		 */
-		newtimeout = p->timeout;
+		newtimeout = p->md.timeout;
 	}
 	if (!PacketSetReadTimeout(p->adapter, newtimeout)) {
 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
@@ -747,57 +823,9 @@ pcap_setnonblock_win32(pcap_t *p, int nonblock, char *errbuf)
 	return (0);
 }
 
-/* Set the driver working mode */
-int 
-pcap_setmode(pcap_t *p, int mode){
-	
-	if (p->adapter==NULL)
-	{
-		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "impossible to set mode while reading from a file");
-		return -1;
-	}
-
-	if(PacketSetMode(p->adapter,mode)==FALSE)
-	{
-		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: working mode not recognized");
-		return -1;
-	}
-
-	return 0;
-}
-
-/* Set the dimension of the kernel-level capture buffer */
-int 
-pcap_setbuff(pcap_t *p, int dim)
+/*platform-dependent routine to add devices other than NDIS interfaces*/
+int
+pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
 {
-	if (p->adapter==NULL)
-	{
-		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "The kernel buffer size cannot be set while reading from a file");
-		return -1;
-	}
-	
-	if(PacketSetBuff(p->adapter,dim)==FALSE)
-	{
-		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer");
-		return -1;
-	}
-	return 0;
-}
-
-/*set the minimum amount of data that will release a read call*/
-int 
-pcap_setmintocopy(pcap_t *p, int size)
-{
-	if (p->adapter==NULL)
-	{
-		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Impossible to set the mintocopy parameter on an offline capture");
-		return -1;
-	}	
-
-	if(PacketSetMinToCopy(p->adapter, size)==FALSE)
-	{
-		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: unable to set the requested mintocopy size");
-		return -1;
-	}
-	return 0;
+	return (0);
 }
diff --git a/contrib/libpcap/pcap.3 b/contrib/libpcap/pcap.3
deleted file mode 100644
index 14b9368..0000000
--- a/contrib/libpcap/pcap.3
+++ /dev/null
@@ -1,1332 +0,0 @@
-.\" @(#) $Header: /tcpdump/master/libpcap/pcap.3,v 1.64.2.11 2007/06/11 09:52:05 guy Exp $
-.\"
-.\" Copyright (c) 1994, 1996, 1997
-.\"	The Regents of the University of California.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that: (1) source code distributions
-.\" retain the above copyright notice and this paragraph in its entirety, (2)
-.\" distributions including binary code include the above copyright notice and
-.\" this paragraph in its entirety in the documentation or other materials
-.\" provided with the distribution, and (3) all advertising materials mentioning
-.\" features or use of this software display the following acknowledgement:
-.\" ``This product includes software developed by the University of California,
-.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
-.\" the University nor the names of its contributors may be used to endorse
-.\" or promote products derived from this software without specific prior
-.\" written permission.
-.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
-.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
-.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-.\"
-.\" $FreeBSD$
-.\"
-.TH PCAP 3 "27 February 2004"
-.SH NAME
-pcap \- Packet Capture library
-.SH SYNOPSIS
-.nf
-.ft B
-#include <pcap.h>
-.ft
-.LP
-.nf
-.ft B
-char errbuf[PCAP_ERRBUF_SIZE];
-.ft
-.LP
-.ft B
-pcap_t *pcap_open_live(const char *device, int snaplen,
-.ti +8
-int promisc, int to_ms, char *errbuf)
-pcap_t *pcap_open_dead(int linktype, int snaplen)
-pcap_t *pcap_open_offline(const char *fname, char *errbuf)
-pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf)
-pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname)
-pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *fp)
-.ft
-.LP
-.ft B
-int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);
-int pcap_getnonblock(pcap_t *p, char *errbuf);
-.ft
-.LP
-.ft B
-int pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)
-void pcap_freealldevs(pcap_if_t *alldevs)
-char *pcap_lookupdev(char *errbuf)
-int pcap_lookupnet(const char *device, bpf_u_int32 *netp,
-.ti +8
-bpf_u_int32 *maskp, char *errbuf)
-.ft
-.LP
-.ft B
-typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
-.ti +8
-			     const u_char *bytes);
-.ft B
-int pcap_dispatch(pcap_t *p, int cnt,
-.ti +8
-pcap_handler callback, u_char *user)
-int pcap_loop(pcap_t *p, int cnt,
-.ti +8
-pcap_handler callback, u_char *user)
-void pcap_dump(u_char *user, struct pcap_pkthdr *h,
-.ti +8
-u_char *sp)
-.ft
-.LP
-.ft B
-int pcap_compile(pcap_t *p, struct bpf_program *fp,
-.ti +8
-const char *str, int optimize, bpf_u_int32 netmask)
-int pcap_setfilter(pcap_t *p, struct bpf_program *fp)
-void pcap_freecode(struct bpf_program *)
-int pcap_setdirection(pcap_t *p, pcap_direction_t d)
-.ft
-.LP
-.ft B
-const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h)
-int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
-.ti +8
-const u_char **pkt_data)
-.ft
-.LP
-.ft B
-void pcap_breakloop(pcap_t *)
-.ft
-.LP
-.ft B
-int pcap_inject(pcap_t *p, const void *buf, size_t size)
-int pcap_sendpacket(pcap_t *p, const u_char *buf, int size)
-.ft
-.LP
-.ft B
-int pcap_datalink(pcap_t *p)
-int pcap_list_datalinks(pcap_t *p, int **dlt_buf);
-int pcap_set_datalink(pcap_t *p, int dlt);
-int pcap_datalink_name_to_val(const char *name);
-const char *pcap_datalink_val_to_name(int dlt);
-const char *pcap_datalink_val_to_description(int dlt);
-int pcap_snapshot(pcap_t *p)
-int pcap_is_swapped(pcap_t *p)
-int pcap_major_version(pcap_t *p)
-int pcap_minor_version(pcap_t *p)
-int pcap_stats(pcap_t *p, struct pcap_stat *ps)
-FILE *pcap_file(pcap_t *p)
-int pcap_fileno(pcap_t *p)
-int pcap_get_selectable_fd(pcap_t *p);
-void pcap_perror(pcap_t *p, char *prefix)
-char *pcap_geterr(pcap_t *p)
-const char *pcap_strerror(int error)
-const char *pcap_lib_version(void)
-.ft
-.LP
-.ft B
-void pcap_close(pcap_t *p)
-int pcap_dump_flush(pcap_dumper_t *p)
-long pcap_dump_ftell(pcap_dumper_t *p)
-FILE *pcap_dump_file(pcap_dumper_t *p)
-void pcap_dump_close(pcap_dumper_t *p)
-.ft
-.fi
-.SH DESCRIPTION
-The Packet Capture library
-provides a high level interface to packet capture systems. All packets
-on the network, even those destined for other hosts, are accessible
-through this mechanism.
-.PP
-.SH ROUTINES
-NOTE:
-.I errbuf
-in
-.BR pcap_open_live() ,
-.BR pcap_open_dead() ,
-.BR pcap_open_offline() ,
-.BR pcap_fopen_offline() ,
-.BR pcap_setnonblock() ,
-.BR pcap_getnonblock() ,
-.BR pcap_findalldevs() ,
-.BR pcap_lookupdev() ,
-and
-.B pcap_lookupnet()
-is assumed to be able to hold at least
-.B PCAP_ERRBUF_SIZE
-chars.
-.PP
-.B pcap_open_live()
-is used to obtain a packet capture descriptor to look
-at packets on the network.
-.I device
-is a string that specifies the network device to open; on Linux systems
-with 2.2 or later kernels, a
-.I device
-argument of "any" or
-.B NULL
-can be used to capture packets from all interfaces.
-.I snaplen
-specifies the maximum number of bytes to capture.  If this value is less
-than the size of a packet that is captured, only the first
-.I snaplen
-bytes of that packet will be captured and provided as packet data.  A
-value of 65535 should be sufficient, on most if not all networks, to
-capture all the data available from the packet.
-.I promisc
-specifies if the interface is to be put into promiscuous mode.
-(Note that even if this parameter is false, the interface
-could well be in promiscuous mode for some other reason.)  For now, this
-doesn't work on the "any" device; if an argument of "any" or NULL is
-supplied, the
-.I promisc
-flag is ignored.
-.I to_ms
-specifies the read timeout in milliseconds.  The read timeout is used to
-arrange that the read not necessarily return immediately when a packet
-is seen, but that it wait for some amount of time to allow more packets
-to arrive and to read multiple packets from the OS kernel in one
-operation.  Not all platforms support a read timeout; on platforms that
-don't, the read timeout is ignored.  A zero value for
-.IR to_ms ,
-on platforms that support a read timeout,
-will cause a read to wait forever to allow enough packets to
-arrive, with no timeout.
-.I errbuf
-is used to return error or warning text.  It will be set to error text when
-.B pcap_open_live()
-fails and returns
-.BR NULL .
-.I errbuf
-may also be set to warning text when
-.B pcap_open_live()
-succeds; to detect this case the caller should store a zero-length string in
-.I errbuf
-before calling
-.B pcap_open_live()
-and display the warning to the user if
-.I errbuf
-is no longer a zero-length string.
-.PP
-.B pcap_open_dead()
-is used for creating a
-.B pcap_t
-structure to use when calling the other functions in libpcap.  It is
-typically used when just using libpcap for compiling BPF code.
-.PP
-.B pcap_open_offline()
-is called to open a ``savefile'' for reading.
-.I fname
-specifies the name of the file to open. The file has
-the same format as those used by
-.B tcpdump(1)
-and
-.BR tcpslice(1) .
-The name "-" in a synonym for
-.BR stdin .
-Alternatively, you may call
-.B pcap_fopen_offline()
-to read dumped data from an existing open stream
-.IR fp .
-Note that on Windows, that stream should be opened in binary mode.
-.I errbuf
-is used to return error text and is only set when
-.B pcap_open_offline()
-or
-.B pcap_fopen_offline()
-fails and returns
-.BR NULL .
-.PP
-.B pcap_dump_open()
-is called to open a ``savefile'' for writing. The name "-" in a synonym
-for
-.BR stdout .
-.B NULL
-is returned on failure.
-.I p
-is a
-.I pcap
-struct as returned by
-.B pcap_open_offline()
-or
-.BR pcap_open_live() .
-.I fname
-specifies the name of the file to open. Alternatively, you may call
-.B pcap_dump_fopen()
-to write data to an existing open stream
-.IR fp .
-Note that on Windows, that stream should be opened in binary mode.
-If
-.B NULL
-is returned,
-.B pcap_geterr()
-can be used to get the error text.
-.PP
-.PP
-.B pcap_setnonblock()
-puts a capture descriptor, opened with
-.BR pcap_open_live() ,
-into ``non-blocking'' mode, or takes it out of ``non-blocking'' mode,
-depending on whether the
-.I nonblock
-argument is non-zero or zero.  It has no effect on ``savefiles''.
-If there is an error, \-1 is returned and
-.I errbuf
-is filled in with an appropriate error message; otherwise, 0 is
-returned.
-In
-``non-blocking'' mode, an attempt to read from the capture descriptor
-with
-.B pcap_dispatch()
-will, if no packets are currently available to be read, return 0
-immediately rather than blocking waiting for packets to arrive.
-.B pcap_loop()
-and
-.B pcap_next()
-will not work in ``non-blocking'' mode.
-.PP
-.B pcap_getnonblock()
-returns the current ``non-blocking'' state of the capture descriptor; it
-always returns 0 on ``savefiles''.
-If there is an error, \-1 is returned and
-.I errbuf
-is filled in with an appropriate error message.
-.PP
-.B pcap_findalldevs()
-constructs a list of network devices that can be opened with
-.BR pcap_open_live() .
-(Note that there may be network devices that cannot be opened with
-.BR pcap_open_live()
-by the
-process calling
-.BR pcap_findalldevs() ,
-because, for example, that process might not have sufficient privileges
-to open them for capturing; if so, those devices will not appear on the
-list.)
-.I alldevsp
-is set to point to the first element of the list; each element of the
-list is of type
-.BR pcap_if_t ,
-and has the following members:
-.RS
-.TP
-.B next
-if not
-.BR NULL ,
-a pointer to the next element in the list;
-.B NULL
-for the last element of the list
-.TP
-.B name
-a pointer to a string giving a name for the device to pass to
-.B pcap_open_live()
-.TP
-.B description
-if not
-.BR NULL ,
-a pointer to a string giving a human-readable description of the device
-.TP
-.B addresses
-a pointer to the first element of a list of addresses for the interface
-.TP
-.B flags
-interface flags:
-.RS
-.TP
-.B PCAP_IF_LOOPBACK
-set if the interface is a loopback interface
-.RE
-.RE
-.PP
-Each element of the list of addresses is of type
-.BR pcap_addr_t ,
-and has the following members:
-.RS
-.TP
-.B next
-if not
-.BR NULL ,
-a pointer to the next element in the list;
-.B NULL
-for the last element of the list
-.TP
-.B addr
-a pointer to a
-.B "struct sockaddr"
-containing an address
-.TP
-.B netmask
-if not
-.BR NULL ,
-a pointer to a
-.B "struct sockaddr"
-that contains the netmask corresponding to the address pointed to by
-.B addr
-.TP
-.B broadaddr
-if not
-.BR NULL ,
-a pointer to a
-.B "struct sockaddr"
-that contains the broadcast address corresponding to the address pointed
-to by
-.BR addr ;
-may be null if the interface doesn't support broadcasts
-.TP
-.B dstaddr
-if not
-.BR NULL ,
-a pointer to a
-.B "struct sockaddr"
-that contains the destination address corresponding to the address pointed
-to by
-.BR addr ;
-may be null if the interface isn't a point-to-point interface
-.RE
-.PP
-Note that not all the addresses in the list of addresses are
-necessarily IPv4 or IPv6 addresses - you must check the
-.B sa_family
-member of the
-.B "struct sockaddr"
-before interpreting the contents of the address.
-.PP
-.B \-1
-is returned on failure, in which case
-.B errbuf
-is filled in with an appropriate error message;
-.B 0
-is returned on success.
-.PP
-.B pcap_freealldevs()
-is used to free a list allocated by
-.BR pcap_findalldevs() .
-.PP
-.B pcap_lookupdev()
-returns a pointer to a network device suitable for use with
-.B pcap_open_live()
-and
-.BR pcap_lookupnet() .
-If there is an error,
-.B NULL
-is returned and
-.I errbuf
-is filled in with an appropriate error message.
-.PP
-.B pcap_lookupnet()
-is used to determine the network number and mask
-associated with the network device
-.BR device .
-Both
-.I netp
-and
-.I maskp
-are
-.I bpf_u_int32
-pointers.
-A return of \-1 indicates an error in which case
-.I errbuf
-is filled in with an appropriate error message.
-.PP
-.B pcap_dispatch()
-is used to collect and process packets.
-.I cnt
-specifies the maximum number of packets to process before returning.
-This is not a minimum number; when reading a live capture, only one
-bufferful of packets is read at a time, so fewer than
-.I cnt
-packets may be processed. A
-.I cnt
-of \-1 processes all the packets received in one buffer when reading a
-live capture, or all the packets in the file when reading a
-``savefile''.
-.I callback
-specifies a routine to be called with three arguments:
-a
-.I u_char
-pointer which is passed in from
-.BR pcap_dispatch() ,
-a
-.I const struct pcap_pkthdr
-pointer to a structure with the following members:
-.RS
-.TP
-.B ts
-a
-.I struct timeval
-containing the time when the packet was captured
-.TP
-.B caplen
-a
-.I bpf_u_int32
-giving the number of bytes of the packet that are available from the
-capture
-.TP
-.B len
-a
-.I bpf_u_int32
-giving the length of the packet, in bytes (which might be more than the
-number of bytes available from the capture, if the length of the packet
-is larger than the maximum number of bytes to capture)
-.RE
-.PP
-and a
-.I const u_char
-pointer to the first
-.B caplen
-(as given in the
-.I struct pcap_pkthdr
-a pointer to which is passed to the callback routine)
-bytes of data from the packet (which won't necessarily be the entire
-packet; to capture the entire packet, you will have to provide a value
-for
-.I snaplen
-in your call to
-.B pcap_open_live()
-that is sufficiently large to get all of the packet's data - a value of
-65535 should be sufficient on most if not all networks).
-.PP
-The number of packets read is returned.
-0 is returned if no packets were read from a live capture (if, for
-example, they were discarded because they didn't pass the packet filter,
-or if, on platforms that support a read timeout that starts before any
-packets arrive, the timeout expires before any packets arrive, or if the
-file descriptor for the capture device is in non-blocking mode and no
-packets were available to be read) or if no more packets are available
-in a ``savefile.'' A return of \-1 indicates
-an error in which case
-.B pcap_perror()
-or
-.B pcap_geterr()
-may be used to display the error text.
-A return of \-2 indicates that the loop terminated due to a call to
-.B pcap_breakloop()
-before any packets were processed.
-.ft B
-If your application uses pcap_breakloop(),
-make sure that you explicitly check for \-1 and \-2, rather than just
-checking for a return value < 0.
-.ft R
-.PP
-.BR NOTE :
-when reading a live capture,
-.B pcap_dispatch()
-will not necessarily return when the read times out; on some platforms,
-the read timeout isn't supported, and, on other platforms, the timer
-doesn't start until at least one packet arrives.  This means that the
-read timeout should
-.B NOT
-be used in, for example, an interactive application, to allow the packet
-capture loop to ``poll'' for user input periodically, as there's no
-guarantee that
-.B pcap_dispatch()
-will return after the timeout expires.
-.PP
-.B pcap_loop()
-is similar to
-.B pcap_dispatch()
-except it keeps reading packets until
-.I cnt
-packets are processed or an error occurs.
-It does
-.B not
-return when live read timeouts occur.
-Rather, specifying a non-zero read timeout to
-.B pcap_open_live()
-and then calling
-.B pcap_dispatch()
-allows the reception and processing of any packets that arrive when the
-timeout occurs.
-A negative
-.I cnt
-causes
-.B pcap_loop()
-to loop forever (or at least until an error occurs).  \-1 is returned on
-an error; 0 is returned if
-.I cnt
-is exhausted; \-2 is returned if the loop terminated due to a call to
-.B pcap_breakloop()
-before any packets were processed.
-.ft B
-If your application uses pcap_breakloop(),
-make sure that you explicitly check for \-1 and \-2, rather than just
-checking for a return value < 0.
-.ft R
-.PP
-.B pcap_next()
-reads the next packet (by calling
-.B pcap_dispatch()
-with a
-.I cnt
-of 1) and returns a
-.I u_char
-pointer to the data in that packet.  (The
-.I pcap_pkthdr
-struct for that packet is not supplied.)
-.B NULL
-is returned if an error occured, or if no packets were read from a live
-capture (if, for example, they were discarded because they didn't pass
-the packet filter, or if, on platforms that support a read timeout that
-starts before any packets arrive, the timeout expires before any packets
-arrive, or if the file descriptor for the capture device is in
-non-blocking mode and no packets were available to be read), or if no
-more packets are available in a ``savefile.''  Unfortunately, there is
-no way to determine whether an error occured or not.
-.PP
-.B pcap_next_ex()
-reads the next packet and returns a success/failure indication:
-.RS
-.TP
-1
-the packet was read without problems
-.TP
-0
-packets are being read from a live capture, and the timeout expired
-.TP
-\-1
-an error occurred while reading the packet
-.TP
-\-2
-packets are being read from a ``savefile'', and there are no more
-packets to read from the savefile.
-.RE
-.PP
-If the packet was read without problems, the pointer pointed to by the
-.I pkt_header
-argument is set to point to the
-.I pcap_pkthdr
-struct for the packet, and the
-pointer pointed to by the
-.I pkt_data
-argument is set to point to the data in the packet.
-.PP
-.B pcap_breakloop()
-sets a flag that will force
-.B pcap_dispatch()
-or
-.B pcap_loop()
-to return rather than looping; they will return the number of packets
-that have been processed so far, or \-2 if no packets have been
-processed so far.
-.PP
-This routine is safe to use inside a signal handler on UNIX or a console
-control handler on Windows, as it merely sets a flag that is checked
-within the loop.
-.PP
-The flag is checked in loops reading packets from the OS - a signal by
-itself will not necessarily terminate those loops - as well as in loops
-processing a set of packets returned by the OS.
-.ft B
-Note that if you are catching signals on UNIX systems that support
-restarting system calls after a signal, and calling pcap_breakloop()
-in the signal handler, you must specify, when catching those signals,
-that system calls should NOT be restarted by that signal.  Otherwise,
-if the signal interrupted a call reading packets in a live capture,
-when your signal handler returns after calling pcap_breakloop(), the
-call will be restarted, and the loop will not terminate until more
-packets arrive and the call completes.
-.PP
-Note also that, in a multi-threaded application, if one thread is
-blocked in
-.BR pcap_dispatch() ,
-.BR pcap_loop() ,
-.BR pcap_next() ,
-or
-.BR pcap_next_ex() ,
-a call to
-.B pcap_breakloop()
-in a different thread will not unblock that thread; you will need to use
-whatever mechanism the OS provides for breaking a thread out of blocking
-calls in order to unblock the thread, such as thread cancellation in
-systems that support POSIX threads.
-.ft R
-.PP
-Note that
-.B pcap_next()
-will, on some platforms, loop reading packets from the OS; that loop
-will not necessarily be terminated by a signal, so
-.B pcap_breakloop()
-should be used to terminate packet processing even if
-.B pcap_next()
-is being used.
-.PP
-.B pcap_breakloop()
-does not guarantee that no further packets will be processed by
-.B pcap_dispatch()
-or
-.B pcap_loop()
-after it is called; at most one more packet might be processed.
-.PP
-If \-2 is returned from
-.B pcap_dispatch()
-or
-.BR pcap_loop() ,
-the flag is cleared, so a subsequent call will resume reading packets. 
-If a positive number is returned, the flag is not cleared, so a
-subsequent call will return \-2 and clear the flag.
-.PP
-.B pcap_inject()
-sends a raw packet through the network interface;
-.I buf
-points to the data of the packet, including the link-layer header, and
-.I size
-is the number of bytes in the packet.
-It returns the number of bytes written on success.  A return of \-1
-indicates an error in which case
-.B pcap_perror()
-or
-.B pcap_geterr()
-may be used to display the error text.
-Note that, even if you successfully open the network interface, you
-might not have permission to send packets on it, or it might not support
-sending packets; as
-.I pcap_open_live()
-doesn't have a flag to indicate whether to open for capturing, sending,
-or capturing and sending, you cannot request an open that supports
-sending and be notified at open time whether sending will be possible.
-Note also that some devices might not support sending packets.
-.PP
-Note that, on some platforms, the link-layer header of the packet that's
-sent might not be the same as the link-layer header of the packet
-supplied to
-.BR pcap_inject() ,
-as the source link-layer address, if the header contains such an
-address, might be changed to be the address assigned to the interface on
-which the packet it sent, if the platform doesn't support sending
-completely raw and unchanged packets.  Even worse, some drivers on some
-platforms might change the link-layer type field to whatever value
-libpcap used when attaching to the device, even on platforms that
-.I do
-nominally support sending completely raw and unchanged packets.
-.PP
-.B pcap_sendpacket()
-is like
-.BR pcap_inject() ,
-but it returns 0 on success and \-1 on failure.
-.RB ( pcap_inject()
-comes from OpenBSD;
-.B pcap_sendpacket()
-comes from WinPcap.  Both are provided for compatibility.)
-.PP
-.B pcap_dump()
-outputs a packet to the ``savefile'' opened with
-.BR pcap_dump_open() .
-Note that its calling arguments are suitable for use with
-.B pcap_dispatch()
-or
-.BR pcap_loop() .
-If called directly, the 
-.I user
-parameter is of type 
-.I pcap_dumper_t
-as returned by
-.BR pcap_dump_open() .
-.PP
-.B pcap_compile()
-is used to compile the string
-.I str
-into a filter program.
-.I program
-is a pointer to a
-.I bpf_program
-struct and is filled in by
-.BR pcap_compile() .
-.I optimize
-controls whether optimization on the resulting code is performed.
-.I netmask
-specifies the IPv4 netmask of the network on which packets are being
-captured; it is used only when checking for IPv4 broadcast addresses in
-the filter program.  If the netmask of the network on which packets are
-being captured isn't known to the program, or if packets are being
-captured on the Linux "any" pseudo-interface that can capture on more
-than one network, a value of 0 can be supplied; tests for IPv4 broadcast
-addreses won't be done correctly, but all other tests in the filter
-program will be OK.  A return of \-1 indicates an error in which case
-.BR pcap_geterr()
-may be used to display the error text.
-.PP
-.B pcap_compile_nopcap()
-is similar to
-.B pcap_compile()
-except that instead of passing a pcap structure, one passes the
-snaplen and linktype explicitly.  It is intended to be used for
-compiling filters for direct BPF usage, without necessarily having
-called
-.BR pcap_open() .
-A return of \-1 indicates an error; the error text is unavailable.
-.RB ( pcap_compile_nopcap()
-is a wrapper around
-.BR pcap_open_dead() ,
-.BR pcap_compile() ,
-and
-.BR pcap_close() ;
-the latter three routines can be used directly in order to get the error
-text for a compilation error.)
-.B
-.PP
-.B pcap_setfilter()
-is used to specify a filter program.
-.I fp
-is a pointer to a
-.I bpf_program
-struct, usually the result of a call to
-.BR pcap_compile() .
-.B \-1
-is returned on failure, in which case
-.BR pcap_geterr()
-may be used to display the error text;
-.B 0
-is returned on success.
-.PP
-.B pcap_freecode()
-is used to free up allocated memory pointed to by a
-.I bpf_program
-struct generated by
-.B pcap_compile()
-when that BPF program is no longer needed, for example after it
-has been made the filter program for a pcap structure by a call to
-.BR pcap_setfilter() .
-.PP
-.B pcap_setdirection()
-is used to specify a direction that packets will be captured.
-.I pcap_direction_t 
-is one of the constants
-.BR PCAP_D_IN ,
-.B PCAP_D_OUT
-or 
-.BR PCAP_D_INOUT .
-.B PCAP_D_IN
-will only capture packets received by the device,
-.B PCAP_D_OUT
-will only capture packets sent by the device and
-.B PCAP_D_INOUT
-will capture packets received by or sent by the device.
-.B PCAP_D_INOUT
-is the default setting if this function is not called.  This isn't
-necessarily supported on all platforms; some platforms might return an
-error, and some other platforms might not support
-.BR PCAP_D_OUT .
-This operation is not supported if a ``savefile'' is being read.
-.B \-1
-is returned on failure,
-.B 0
-is returned on success.
-.PP
-.B pcap_datalink()
-returns the link layer type; link layer types it can return include:
-.PP
-.RS 5
-.TP 5
-.B DLT_NULL
-BSD loopback encapsulation; the link layer header is a 4-byte field, in
-.I host
-byte order, containing a PF_ value from
-.B socket.h
-for the network-layer protocol of the packet.
-.IP
-Note that ``host byte order'' is the byte order of the machine on which
-the packets are captured, and the PF_ values are for the OS of the
-machine on which the packets are captured; if a live capture is being
-done, ``host byte order'' is the byte order of the machine capturing the
-packets, and the PF_ values are those of the OS of the machine capturing
-the packets, but if a ``savefile'' is being read, the byte order and PF_
-values are
-.I not
-necessarily those of the machine reading the capture file.
-.TP 5
-.B DLT_EN10MB
-Ethernet (10Mb, 100Mb, 1000Mb, and up)
-.TP 5
-.B DLT_IEEE802
-IEEE 802.5 Token Ring
-.TP 5
-.B DLT_ARCNET
-ARCNET
-.TP 5
-.B DLT_SLIP
-SLIP; the link layer header contains, in order:
-.RS 10
-.LP
-a 1-byte flag, which is 0 for packets received by the machine and 1 for
-packets sent by the machine;
-.LP
-a 1-byte field, the upper 4 bits of which indicate the type of packet,
-as per RFC 1144:
-.RS 5
-.TP 5
-0x40
-an unmodified IP datagram (TYPE_IP);
-.TP 5
-0x70
-an uncompressed-TCP IP datagram (UNCOMPRESSED_TCP), with that byte being
-the first byte of the raw IP header on the wire, containing the
-connection number in the protocol field;
-.TP 5
-0x80
-a compressed-TCP IP datagram (COMPRESSED_TCP), with that byte being the
-first byte of the compressed TCP/IP datagram header;
-.RE
-.LP
-for UNCOMPRESSED_TCP, the rest of the modified IP header, and for
-COMPRESSED_TCP, the compressed TCP/IP datagram header;
-.RE
-.RS 5
-.LP
-for a total of 16 bytes; the uncompressed IP datagram follows the header.
-.RE
-.TP 5
-.B DLT_PPP
-PPP; if the first 2 bytes are 0xff and 0x03, it's PPP in HDLC-like
-framing, with the PPP header following those two bytes, otherwise it's
-PPP without framing, and the packet begins with the PPP header.
-.TP 5
-.B DLT_FDDI
-FDDI
-.TP 5
-.B DLT_ATM_RFC1483
-RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an IEEE 802.2
-LLC header.
-.TP 5
-.B DLT_RAW
-raw IP; the packet begins with an IP header.
-.TP 5
-.B DLT_PPP_SERIAL
-PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC
-framing, as per section 4.3.1 of RFC 1547; the first byte will be 0xFF
-for PPP in HDLC-like framing, and will be 0x0F or 0x8F for Cisco PPP
-with HDLC framing.
-.TP 5
-.B DLT_PPP_ETHER
-PPPoE; the packet begins with a PPPoE header, as per RFC 2516.
-.TP 5
-.B DLT_C_HDLC
-Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.
-.TP 5
-.B DLT_IEEE802_11
-IEEE 802.11 wireless LAN
-.TP 5
-.B DLT_FRELAY
-Frame Relay
-.TP 5
-.B DLT_LOOP
-OpenBSD loopback encapsulation; the link layer header is a 4-byte field, in
-.I network
-byte order, containing a PF_ value from OpenBSD's
-.B socket.h
-for the network-layer protocol of the packet.
-.IP
-Note that, if a ``savefile'' is being read, those PF_ values are
-.I not
-necessarily those of the machine reading the capture file.
-.TP 5
-.B DLT_LINUX_SLL
-Linux "cooked" capture encapsulation; the link layer header contains, in
-order:
-.RS 10
-.LP
-a 2-byte "packet type", in network byte order, which is one of:
-.RS 5
-.TP 5
-0
-packet was sent to us by somebody else
-.TP 5
-1
-packet was broadcast by somebody else
-.TP 5
-2
-packet was multicast, but not broadcast, by somebody else
-.TP 5
-3
-packet was sent by somebody else to somebody else
-.TP 5
-4
-packet was sent by us
-.RE
-.LP
-a 2-byte field, in network byte order, containing a Linux ARPHRD_ value
-for the link layer device type;
-.LP
-a 2-byte field, in network byte order, containing the length of the
-link layer address of the sender of the packet (which could be 0);
-.LP
-an 8-byte field containing that number of bytes of the link layer header
-(if there are more than 8 bytes, only the first 8 are present);
-.LP
-a 2-byte field containing an Ethernet protocol type, in network byte
-order, or containing 1 for Novell 802.3 frames without an 802.2 LLC
-header or 4 for frames beginning with an 802.2 LLC header.
-.RE
-.TP 5
-.B DLT_LTALK
-Apple LocalTalk; the packet begins with an AppleTalk LLAP header.
-.TP 5
-.B DLT_PFLOG
-OpenBSD pflog; the link layer header contains, in order:
-.RS 10
-.LP
-a 1-byte header length, in host byte order;
-.LP
-a 4-byte PF_ value, in host byte order;
-.LP
-a 2-byte action code, in network byte order, which is one of:
-.RS 5
-.TP 5
-0
-passed
-.TP 5
-1
-dropped
-.TP 5
-2
-scrubbed
-.RE
-.LP
-a 2-byte reason code, in network byte order, which is one of:
-.RS 5
-.TP 5
-0
-match
-.TP 5
-1
-bad offset
-.TP 5
-2
-fragment
-.TP 5
-3
-short
-.TP 5
-4
-normalize
-.TP 5
-5
-memory
-.RE
-.LP
-a 16-character interface name;
-.LP
-a 16-character ruleset name (only meaningful if subrule is set);
-.LP
-a 4-byte rule number, in network byte order;
-.LP
-a 4-byte subrule number, in network byte order;
-.LP
-a 1-byte direction, in network byte order, which is one of:
-.RS 5
-.TP 5
-0
-incoming or outgoing
-.TP 5
-1
-incoming
-.TP 5
-2
-outgoing
-.RE
-.RE
-.TP 5
-.B DLT_PRISM_HEADER
-Prism monitor mode information followed by an 802.11 header.
-.TP 5
-.B DLT_IP_OVER_FC
-RFC 2625 IP-over-Fibre Channel, with the link-layer header being the
-Network_Header as described in that RFC.
-.TP 5
-.B DLT_SUNATM
-SunATM devices; the link layer header contains, in order:
-.RS 10
-.LP
-a 1-byte flag field, containing a direction flag in the uppermost bit,
-which is set for packets transmitted by the machine and clear for
-packets received by the machine, and a 4-byte traffic type in the
-low-order 4 bits, which is one of:
-.RS 5
-.TP 5
-0
-raw traffic
-.TP 5
-1
-LANE traffic
-.TP 5
-2
-LLC-encapsulated traffic
-.TP 5
-3
-MARS traffic
-.TP 5
-4
-IFMP traffic
-.TP 5
-5
-ILMI traffic
-.TP 5
-6
-Q.2931 traffic
-.RE
-.LP
-a 1-byte VPI value;
-.LP
-a 2-byte VCI field, in network byte order.
-.RE
-.TP 5
-.B DLT_IEEE802_11_RADIO
-link-layer information followed by an 802.11 header - see
-http://www.shaftnet.org/~pizza/software/capturefrm.txt for a description
-of the link-layer information.
-.TP 5
-.B DLT_ARCNET_LINUX
-ARCNET, with no exception frames, reassembled packets rather than raw
-frames, and an extra 16-bit offset field between the destination host
-and type bytes.
-.TP 5
-.B DLT_LINUX_IRDA
-Linux-IrDA packets, with a
-.B DLT_LINUX_SLL
-header followed by the IrLAP header.
-.TP 5
-.B DLT_LINUX_LAPD
-LAPD (Q.921) frames, with a
-.B DLT_LINUX_SLL
-header captured via vISDN.
-.RE
-.PP
-.B pcap_list_datalinks()
-is used to get a list of the supported data link types of the interface
-associated with the pcap descriptor.
-.B pcap_list_datalinks()
-allocates an array to hold the list and sets
-.IR *dlt_buf .
-The caller is responsible for freeing the array.
-.B \-1
-is returned on failure;
-otherwise, the number of data link types in the array is returned.
-.PP
-.B pcap_set_datalink()
-is used to set the current data link type of the pcap descriptor
-to the type specified by
-.IR dlt .
-.B \-1
-is returned on failure.
-.PP
-.B pcap_datalink_name_to_val()
-translates a data link type name, which is a
-.B DLT_
-name with the
-.B DLT_
-removed, to the corresponding data link type value.  The translation
-is case-insensitive.  
-.B \-1
-is returned on failure.
-.PP
-.B pcap_datalink_val_to_name()
-translates a data link type value to the corresponding data link type
-name.  NULL is returned on failure.
-.PP
-.B pcap_datalink_val_to_description()
-translates a data link type value to a short description of that data
-link type.  NULL is returned on failure.
-.PP
-.B pcap_list_datalinks()
-is used to get a list of the supported data link types of the interface
-associated with the pcap descriptor.
-.B pcap_list_datalinks()
-allocates an array to hold the list and sets
-.IR *dlt_buf .
-The caller is responsible for freeing the array.
-.B \-1
-is returned on failure;
-otherwise, the number of data link types in the array is returned.
-.PP
-.B pcap_set_datalink()
-is used to set the current data link type of the pcap descriptor
-to the type specified by
-.IR dlt .
-.B \-1
-is returned on failure.
-.PP
-.B pcap_snapshot()
-returns the snapshot length specified when
-.B pcap_open_live()
-was called.
-.PP
-.B pcap_is_swapped()
-returns true if the current ``savefile'' uses a different byte order
-than the current system.
-.PP
-.B pcap_major_version()
-returns the major number of the file format of the savefile;
-.B pcap_minor_version()
-returns the minor number of the file format of the savefile.  The
-version number is stored in the header of the savefile.
-.PP
-.B pcap_file()
-returns the standard I/O stream of the ``savefile,'' if a ``savefile''
-was opened with
-.BR pcap_open_offline() ,
-or NULL, if a network device was opened with
-.BR pcap_open_live() .
-.PP
-.B pcap_stats()
-returns 0 and fills in the
-.B pcap_stat
-structure pointed to by its second argument.  The values represent
-packet statistics from the start of the run to the time of the call.  If
-there is an error or the underlying packet capture doesn't support
-packet statistics, \-1 is returned and the error text can be obtained
-with
-.B pcap_perror()
-or
-.BR pcap_geterr() .
-.B pcap_stats()
-is supported only on live captures, not on ``savefiles''; no statistics
-are stored in ``savefiles'', so no statistics are available when reading
-from a ``savefile''.
-.PP
-.B pcap_fileno()
-returns the file descriptor number from which captured packets are read,
-if a network device was opened with
-.BR pcap_open_live() ,
-or \-1, if a ``savefile'' was opened with
-.BR pcap_open_offline() .
-.PP
-.B pcap_get_selectable_fd()
-returns, on UNIX, a file descriptor number for a file descriptor on
-which one can
-do a
-.B select()
-or
-.B poll()
-to wait for it to be possible to read packets without blocking, if such
-a descriptor exists, or \-1, if no such descriptor exists.  Some network
-devices opened with
-.B pcap_open_live()
-do not support
-.B select()
-or
-.B poll()
-(for example, regular network devices on FreeBSD 4.3 and 4.4, and Endace
-DAG devices), so \-1 is returned for those devices.
-.PP
-Note that on most versions of most BSDs (including Mac OS X)
-.B select()
-and
-.B poll()
-do not work correctly on BPF devices;
-.B pcap_get_selectable_fd()
-will return a file descriptor on most of those versions (the exceptions
-being FreeBSD 4.3 and 4.4), a simple
-.B select()
-or
-.B poll()
-will not return even after a timeout specified in
-.B pcap_open_live()
-expires.  To work around this, an application that uses
-.B select()
-or
-.B poll()
-to wait for packets to arrive must put the
-.B pcap_t
-in non-blocking mode, and must arrange that the
-.B select()
-or
-.B poll()
-have a timeout less than or equal to the timeout specified in
-.BR pcap_open_live() ,
-and must try to read packets after that timeout expires, regardless of
-whether
-.B select()
-or
-.B poll()
-indicated that the file descriptor for the
-.B pcap_t
-is ready to be read or not.  (That workaround will not work in FreeBSD
-4.3 and later; however, in FreeBSD 4.6 and later,
-.B select()
-and
-.B poll()
-work correctly on BPF devices, so the workaround isn't necessary,
-although it does no harm.)
-.PP
-.B pcap_get_selectable_fd()
-is not available on Windows.
-.PP
-.B pcap_perror()
-prints the text of the last pcap library error on
-.BR stderr ,
-prefixed by
-.IR prefix .
-.PP
-.B pcap_geterr()
-returns the error text pertaining to the last pcap library error.
-.BR NOTE :
-the pointer it returns will no longer point to a valid error message
-string after the
-.B pcap_t
-passed to it is closed; you must use or copy the string before closing
-the
-.BR pcap_t .
-.PP
-.B pcap_strerror()
-is provided in case
-.BR strerror (1)
-isn't available.
-.PP
-.B pcap_lib_version()
-returns a pointer to a string giving information about the version of
-the libpcap library being used; note that it contains more information
-than just a version number.
-.PP
-.B pcap_close()
-closes the files associated with
-.I p
-and deallocates resources.
-.PP
-.B pcap_dump_file()
-returns the standard I/O stream of the ``savefile'' opened by
-.BR pcap_dump_open().
-.PP
-.B pcap_dump_flush()
-flushes the output buffer to the ``savefile,'' so that any packets
-written with
-.B pcap_dump()
-but not yet written to the ``savefile'' will be written.
-.B \-1
-is returned on error, 0 on success.
-.PP
-.B pcap_dump_ftell()
-returns the current file position for the ``savefile'', representing the
-number of bytes written by
-.B pcap_dump_open()
-and
-.BR pcap_dump() .
-.B \-1
-is returned on error.
-.PP
-.B pcap_dump_close()
-closes the ``savefile.''
-.PP
-.SH SEE ALSO
-tcpdump(1), tcpslice(1)
-.SH AUTHORS
-The original authors are:
-.LP
-Van Jacobson,
-Craig Leres and
-Steven McCanne, all of the
-Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
-.LP
-The current version is available from "The Tcpdump Group"'s Web site at
-.LP
-.RS
-.I http://www.tcpdump.org/
-.RE
-.SH BUGS
-Please send problems, bugs, questions, desirable enhancements, etc. to:
-.LP
-.RS
-tcpdump-workers@tcpdump.org
-.RE
-.LP
-Please send source code contributions, etc. to:
-.LP
-.RS
-patches@tcpdump.org
-.RE
diff --git a/contrib/libpcap/pcap.3pcap b/contrib/libpcap/pcap.3pcap
new file mode 100644
index 0000000..b694714
--- /dev/null
+++ b/contrib/libpcap/pcap.3pcap
@@ -0,0 +1,386 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP 3PCAP "4 April 2008"
+.SH NAME
+pcap \- Packet Capture library
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+.ft
+.fi
+.SH DESCRIPTION
+The Packet Capture library
+provides a high level interface to packet capture systems. All packets
+on the network, even those destined for other hosts, are accessible
+through this mechanism.
+It also supports saving captured packets to a ``savefile'', and reading
+packets from a ``savefile''.
+.PP
+To open a handle for a live capture, call
+.BR pcap_create() ,
+set the appropriate options on the handle, and then activate it with
+.BR pcap_activate() .
+To open a handle for a ``savefile'' with captured packets, call
+.BR pcap_open_offline() .
+Both
+.B pcap_create()
+and
+.B pcap_open_offline()
+return a pointer to a
+.BR pcap_t ,
+which is the handle used for reading packets from the capture stream or
+the ``savefile'', and for finding out information about the capture
+stream or ``savefile''.
+.PP
+The options that can be set on a capture handle include
+.IP "snapshot length"
+If, when capturing, you capture the entire contents of the packet, that
+requires more CPU time to copy the packet to your application, more disk
+and possibly network bandwidth to write the packet data to a file, and
+more disk space to save the packet.  If you don't need the entire
+contents of the packet - for example, if you are only interested in the
+TCP headers of packets - you can set the "snapshot length" for the
+capture to an appropriate value.  If the snapshot length is set to
+.IR snaplen ,
+and
+.I snaplen
+is less
+than the size of a packet that is captured, only the first
+.I snaplen
+bytes of that packet will be captured and provided as packet data.
+.IP
+A snapshot length of 65535 should be sufficient, on most if not all
+networks, to capture all the data available from the packet.
+.IP
+The snapshot length is set with
+.BR pcap_set_snaplen() .
+.IP "promiscuous mode"
+On broadcast LANs such as Ethernet, if the network isn't switched, or if
+the adapter is connected to a "mirror port" on a switch to which all
+packets passing through the switch are sent, a network adapter receives
+all packets on the LAN, including unicast or multicast packets not sent
+to a network address that the network adapter isn't configured to
+recognize.
+.IP
+Normally, the adapter will discard those packets; however, many network
+adapters support "promiscuous mode", which is a mode in which all
+packets, even if they are not sent to an address that the adapter
+recognizes, are provided to the host.  This is useful for passively
+capturing traffic between two or more other hosts for analysis.
+.IP
+Note that even if an application does not set promiscuous mode, the
+adapter could well be in promiscuous mode for some other reason.
+.IP
+For now, this doesn't work on the "any" device; if an argument of "any"
+or NULL is supplied, the setting of promiscuous mode is ignored.
+.IP
+Promiscuous mode is set with
+.BR pcap_set_promisc() .
+.IP "monitor mode"
+On IEEE 802.11 wireless LANs, even if an adapter is in promiscuous mode,
+it will supply to the host only frames for the network with which it's
+associated.  It might also supply only data frames, not management or
+control frames, and might not provide the 802.11 header or radio
+information pseudo-header for those frames.
+.IP
+In "monitor mode", sometimes also called "rfmon mode" (for "Radio
+Frequency MONitor"), the adapter will supply all frames that it
+receives, with 802.11 headers, and might supply a pseudo-header with
+radio information about the frame as well.
+.IP
+Note that in monitor mode the adapter might disassociate from the
+network with which it's associated, so that you will not be able to use
+any wireless networks with that adapter.  This could prevent accessing
+files on a network server, or resolving host names or network addresses,
+if you are capturing in monitor mode and are not connected to another
+network with another adapter.
+.IP
+Monitor mode is set with
+.BR pcap_set_rfmon() ,
+and
+.B pcap_can_set_rfmon()
+can be used to determine whether an adapter can be put into monitor
+mode.
+.IP "read timeout"
+If, when capturing, packets are delivered as soon as they arrive, the
+application capturing the packets will be woken up for each packet as it
+arrives, and might have to make one or more calls to the operating
+system to fetch each packet.
+.IP
+If, instead, packets are not delivered as soon as they arrive, but are
+delivered after a short delay (called a "read timeout"), more than one
+packet can be accumulated before the packets are delivered, so that a
+single wakeup would be done for multiple packets, and each set of calls
+made to the operating system would supply multiple packets, rather than
+a single packet.  This reduces the per-packet CPU overhead if packets
+are arriving at a high rate, increasing the number of packets per second
+that can be captured.
+.IP
+The read timeout is required so that an application won't wait for the
+operating system's capture buffer to fill up before packets are
+delivered; if packets are arriving slowly, that wait could take an
+arbitrarily long period of time.
+.IP
+Not all platforms support a read timeout; on platforms that
+don't, the read timeout is ignored.  A zero value for the timeout,
+on platforms that support a read timeout,
+will cause a read to wait forever to allow enough packets to
+arrive, with no timeout.
+.IP
+.BR NOTE :
+the read timeout cannot be used to cause calls that read
+packets to return within a limited period of time, because, on some
+platforms, the read timeout isn't supported, and, on other platforms,
+the timer doesn't start until at least one packet arrives.  This means
+that the read timeout should
+.B NOT
+be used, for example, in an interactive application to allow the packet
+capture loop to ``poll'' for user input periodically, as there's no
+guarantee that a call reading packets will return after the timeout
+expires even if no packets have arrived.
+.IP
+The read timeout is set with
+.BR pcap_set_timeout() .
+.IP "buffer size"
+Packets that arrive for a capture are stored in a buffer, so that they
+do not have to be read by the application as soon as they arrive.  On
+some platforms, the buffer's size can be set; a size that's too small
+could mean that, if too many packets are being captured and the snapshot
+length doesn't limit the amount of data that's buffered, packets could
+be dropped if the buffer fills up before the application can read
+packets from it, while a size that's too large could use more
+non-pageable operating system memory than is necessary to prevent
+packets from being dropped.
+.IP
+The buffer size is set with
+.BR pcap_set_buffer_size() .
+.PP
+Reading packets from a network interface may require that you have
+special privileges:
+.TP
+.B Under SunOS 3.x or 4.x with NIT or BPF:
+You must have read access to
+.I /dev/nit
+or
+.IR /dev/bpf* .
+.TP
+.B Under Solaris with DLPI:
+You must have read/write access to the network pseudo device, e.g.
+.IR /dev/le .
+On at least some versions of Solaris, however, this is not sufficient to
+allow
+.I tcpdump
+to capture in promiscuous mode; on those versions of Solaris, you must
+be root, or the application capturing packets
+must be installed setuid to root, in order to capture in promiscuous
+mode.  Note that, on many (perhaps all) interfaces, if you don't capture
+in promiscuous mode, you will not see any outgoing packets, so a capture
+not done in promiscuous mode may not be very useful.
+.IP
+In newer versions of Solaris, you must have been given the
+.B net_rawaccess
+privilege; this is both necessary and sufficient to give you access to the
+network pseudo-device - there is no need to change the privileges on
+that device.  A user can be given that privilege by, for example, adding
+that privilege to the user's
+.B defaultpriv
+key with the
+.B usermod (1M)
+command.
+.TP
+.B Under HP-UX with DLPI:
+You must be root or the application capturing packets must be installed
+setuid to root.
+.TP
+.B Under IRIX with snoop:
+You must be root or the application capturing packets must be installed
+setuid to root.
+.TP
+.B Under Linux:
+You must be root or the application capturing packets must be installed
+setuid to root (unless your distribution has a kernel
+that supports capability bits such as CAP_NET_RAW and code to allow
+those capability bits to be given to particular accounts and to cause
+those bits to be set on a user's initial processes when they log in, in
+which case you  must have CAP_NET_RAW in order to capture and
+CAP_NET_ADMIN to enumerate network devices with, for example, the
+.B \-D
+flag).
+.TP
+.B Under ULTRIX and Digital UNIX/Tru64 UNIX:
+Any user may capture network traffic.
+However, no user (not even the super-user) can capture in promiscuous
+mode on an interface unless the super-user has enabled promiscuous-mode
+operation on that interface using
+.IR pfconfig (8),
+and no user (not even the super-user) can capture unicast traffic
+received by or sent by the machine on an interface unless the super-user
+has enabled copy-all-mode operation on that interface using
+.IR pfconfig ,
+so
+.I useful
+packet capture on an interface probably requires that either
+promiscuous-mode or copy-all-mode operation, or both modes of
+operation, be enabled on that interface.
+.TP
+.B Under BSD (this includes Mac OS X):
+You must have read access to
+.I /dev/bpf*
+on systems that don't have a cloning BPF device, or to
+.I /dev/bpf
+on systems that do.
+On BSDs with a devfs (this includes Mac OS X), this might involve more
+than just having somebody with super-user access setting the ownership
+or permissions on the BPF devices - it might involve configuring devfs
+to set the ownership or permissions every time the system is booted,
+if the system even supports that; if it doesn't support that, you might
+have to find some other way to make that happen at boot time.
+.PP
+Reading a saved packet file doesn't require special privileges.
+.PP
+To open a ``savefile`` to which to write packets, call
+.BR pcap_dump_open() .
+It returns a pointer to a
+.BR pcap_dumper_t ,
+which is the handle used for writing packets to the ``savefile''.
+.PP
+Packets are read with
+.B pcap_dispatch()
+or
+.BR pcap_loop() ,
+which process one or more packets, calling a callback routine for each
+packet, or with
+.B pcap_next()
+or
+.BR pcap_next_ex() ,
+which return the next packet.
+The callback for
+.B pcap_dispatch()
+and
+.BR pcap_loop()
+is supplied a pointer to a
+.IR "struct pcap_pkthdr" ,
+which includes the following members:
+.RS
+.TP
+.B ts
+a
+.I struct timeval
+containing the time when the packet was captured
+.TP
+.B caplen
+a
+.I bpf_u_int32
+giving the number of bytes of the packet that are available from the
+capture
+.TP
+.B len
+a
+.I bpf_u_int32
+giving the length of the packet, in bytes (which might be more than the
+number of bytes available from the capture, if the length of the packet
+is larger than the maximum number of bytes to capture).
+.RE
+.PP
+.B pcap_next_ex()
+supplies that pointer through a pointer argument.
+.B pcap_next()
+is passed an argument that points to a
+.I struct pcap_pkthdr
+structure, and fills it in.
+.PP
+The callback is also supplied a
+.I const u_char
+pointer to the first
+.B caplen
+(as given in the
+.I struct pcap_pkthdr
+a pointer to which is passed to the callback routine)
+bytes of data from the packet.  This won't necessarily be the entire
+packet; to capture the entire packet, you will have to provide a value
+for
+.I snaplen
+in your call to
+.B pcap_open_live()
+that is sufficiently large to get all of the packet's data - a value of
+65535 should be sufficient on most if not all networks).  When reading
+from a ``savefile'', the snapshot length specified when the capture was
+performed will limit the amount of packet data available.
+.B pcap_next()
+returns that pointer;
+.B pcap_next_ex()
+supplies that pointer through a pointer argument.
+.SH BACKWARDS COMPATIBILITY
+.PP
+In versions of libpcap prior to 1.0, the
+.B pcap.h
+header file was not in a
+.B pcap
+directory on most platforms; if you are writing an application that must
+work on versions of libpcap prior to 1.0, include
+.BR <pcap.h> ,
+which will include
+.B <pcap/pcap.h>
+for you, rather than including
+.BR <pcap/pcap.h> .
+.PP
+.B pcap_create()
+and
+.B pcap_activate()
+were not available in versions of libpcap prior to 1.0; if you are
+writing an application that must work on versions of libpcap prior to
+1.0, either use
+.B pcap_open_live()
+to get a handle for a live capture or, if you want to be able to use the
+additional capabilities offered by using
+.B pcap_create()
+and
+.BR pcap_activate() ,
+use an
+.BR autoconf (1)
+script or some other configuration script to check whether the libpcap
+1.0 APIs are available and use them only if they are.
+.SH SEE ALSO
+autoconf(1), tcpdump(1), tcpslice(1), pcap-filter(7), pfconfig(8),
+usermod(1M)
+.SH AUTHORS
+The original authors of libpcap are:
+.LP
+Van Jacobson,
+Craig Leres and
+Steven McCanne, all of the
+Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
+.LP
+The current version is available from "The Tcpdump Group"'s Web site at
+.LP
+.RS
+.I http://www.tcpdump.org/
+.RE
+.SH BUGS
+Please send problems, bugs, questions, desirable enhancements, etc. to:
+.LP
+.RS
+tcpdump-workers@lists.tcpdump.org
+.RE
diff --git a/contrib/libpcap/pcap.3pcap.in b/contrib/libpcap/pcap.3pcap.in
new file mode 100644
index 0000000..1c66508
--- /dev/null
+++ b/contrib/libpcap/pcap.3pcap.in
@@ -0,0 +1,386 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP 3PCAP "4 April 2008"
+.SH NAME
+pcap \- Packet Capture library
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+.ft
+.fi
+.SH DESCRIPTION
+The Packet Capture library
+provides a high level interface to packet capture systems. All packets
+on the network, even those destined for other hosts, are accessible
+through this mechanism.
+It also supports saving captured packets to a ``savefile'', and reading
+packets from a ``savefile''.
+.PP
+To open a handle for a live capture, call
+.BR pcap_create() ,
+set the appropriate options on the handle, and then activate it with
+.BR pcap_activate() .
+To open a handle for a ``savefile'' with captured packets, call
+.BR pcap_open_offline() .
+Both
+.B pcap_create()
+and
+.B pcap_open_offline()
+return a pointer to a
+.BR pcap_t ,
+which is the handle used for reading packets from the capture stream or
+the ``savefile'', and for finding out information about the capture
+stream or ``savefile''.
+.PP
+The options that can be set on a capture handle include
+.IP "snapshot length"
+If, when capturing, you capture the entire contents of the packet, that
+requires more CPU time to copy the packet to your application, more disk
+and possibly network bandwidth to write the packet data to a file, and
+more disk space to save the packet.  If you don't need the entire
+contents of the packet - for example, if you are only interested in the
+TCP headers of packets - you can set the "snapshot length" for the
+capture to an appropriate value.  If the snapshot length is set to
+.IR snaplen ,
+and
+.I snaplen
+is less
+than the size of a packet that is captured, only the first
+.I snaplen
+bytes of that packet will be captured and provided as packet data.
+.IP
+A snapshot length of 65535 should be sufficient, on most if not all
+networks, to capture all the data available from the packet.
+.IP
+The snapshot length is set with
+.BR pcap_set_snaplen() .
+.IP "promiscuous mode"
+On broadcast LANs such as Ethernet, if the network isn't switched, or if
+the adapter is connected to a "mirror port" on a switch to which all
+packets passing through the switch are sent, a network adapter receives
+all packets on the LAN, including unicast or multicast packets not sent
+to a network address that the network adapter isn't configured to
+recognize.
+.IP
+Normally, the adapter will discard those packets; however, many network
+adapters support "promiscuous mode", which is a mode in which all
+packets, even if they are not sent to an address that the adapter
+recognizes, are provided to the host.  This is useful for passively
+capturing traffic between two or more other hosts for analysis.
+.IP
+Note that even if an application does not set promiscuous mode, the
+adapter could well be in promiscuous mode for some other reason.
+.IP
+For now, this doesn't work on the "any" device; if an argument of "any"
+or NULL is supplied, the setting of promiscuous mode is ignored.
+.IP
+Promiscuous mode is set with
+.BR pcap_set_promisc() .
+.IP "monitor mode"
+On IEEE 802.11 wireless LANs, even if an adapter is in promiscuous mode,
+it will supply to the host only frames for the network with which it's
+associated.  It might also supply only data frames, not management or
+control frames, and might not provide the 802.11 header or radio
+information pseudo-header for those frames.
+.IP
+In "monitor mode", sometimes also called "rfmon mode" (for "Radio
+Frequency MONitor"), the adapter will supply all frames that it
+receives, with 802.11 headers, and might supply a pseudo-header with
+radio information about the frame as well.
+.IP
+Note that in monitor mode the adapter might disassociate from the
+network with which it's associated, so that you will not be able to use
+any wireless networks with that adapter.  This could prevent accessing
+files on a network server, or resolving host names or network addresses,
+if you are capturing in monitor mode and are not connected to another
+network with another adapter.
+.IP
+Monitor mode is set with
+.BR pcap_set_rfmon() ,
+and
+.B pcap_can_set_rfmon()
+can be used to determine whether an adapter can be put into monitor
+mode.
+.IP "read timeout"
+If, when capturing, packets are delivered as soon as they arrive, the
+application capturing the packets will be woken up for each packet as it
+arrives, and might have to make one or more calls to the operating
+system to fetch each packet.
+.IP
+If, instead, packets are not delivered as soon as they arrive, but are
+delivered after a short delay (called a "read timeout"), more than one
+packet can be accumulated before the packets are delivered, so that a
+single wakeup would be done for multiple packets, and each set of calls
+made to the operating system would supply multiple packets, rather than
+a single packet.  This reduces the per-packet CPU overhead if packets
+are arriving at a high rate, increasing the number of packets per second
+that can be captured.
+.IP
+The read timeout is required so that an application won't wait for the
+operating system's capture buffer to fill up before packets are
+delivered; if packets are arriving slowly, that wait could take an
+arbitrarily long period of time.
+.IP
+Not all platforms support a read timeout; on platforms that
+don't, the read timeout is ignored.  A zero value for the timeout,
+on platforms that support a read timeout,
+will cause a read to wait forever to allow enough packets to
+arrive, with no timeout.
+.IP
+.BR NOTE :
+the read timeout cannot be used to cause calls that read
+packets to return within a limited period of time, because, on some
+platforms, the read timeout isn't supported, and, on other platforms,
+the timer doesn't start until at least one packet arrives.  This means
+that the read timeout should
+.B NOT
+be used, for example, in an interactive application to allow the packet
+capture loop to ``poll'' for user input periodically, as there's no
+guarantee that a call reading packets will return after the timeout
+expires even if no packets have arrived.
+.IP
+The read timeout is set with
+.BR pcap_set_timeout() .
+.IP "buffer size"
+Packets that arrive for a capture are stored in a buffer, so that they
+do not have to be read by the application as soon as they arrive.  On
+some platforms, the buffer's size can be set; a size that's too small
+could mean that, if too many packets are being captured and the snapshot
+length doesn't limit the amount of data that's buffered, packets could
+be dropped if the buffer fills up before the application can read
+packets from it, while a size that's too large could use more
+non-pageable operating system memory than is necessary to prevent
+packets from being dropped.
+.IP
+The buffer size is set with
+.BR pcap_set_buffer_size() .
+.PP
+Reading packets from a network interface may require that you have
+special privileges:
+.TP
+.B Under SunOS 3.x or 4.x with NIT or BPF:
+You must have read access to
+.I /dev/nit
+or
+.IR /dev/bpf* .
+.TP
+.B Under Solaris with DLPI:
+You must have read/write access to the network pseudo device, e.g.
+.IR /dev/le .
+On at least some versions of Solaris, however, this is not sufficient to
+allow
+.I tcpdump
+to capture in promiscuous mode; on those versions of Solaris, you must
+be root, or the application capturing packets
+must be installed setuid to root, in order to capture in promiscuous
+mode.  Note that, on many (perhaps all) interfaces, if you don't capture
+in promiscuous mode, you will not see any outgoing packets, so a capture
+not done in promiscuous mode may not be very useful.
+.IP
+In newer versions of Solaris, you must have been given the
+.B net_rawaccess
+privilege; this is both necessary and sufficient to give you access to the
+network pseudo-device - there is no need to change the privileges on
+that device.  A user can be given that privilege by, for example, adding
+that privilege to the user's
+.B defaultpriv
+key with the
+.B usermod (1M)
+command.
+.TP
+.B Under HP-UX with DLPI:
+You must be root or the application capturing packets must be installed
+setuid to root.
+.TP
+.B Under IRIX with snoop:
+You must be root or the application capturing packets must be installed
+setuid to root.
+.TP
+.B Under Linux:
+You must be root or the application capturing packets must be installed
+setuid to root (unless your distribution has a kernel
+that supports capability bits such as CAP_NET_RAW and code to allow
+those capability bits to be given to particular accounts and to cause
+those bits to be set on a user's initial processes when they log in, in
+which case you  must have CAP_NET_RAW in order to capture and
+CAP_NET_ADMIN to enumerate network devices with, for example, the
+.B \-D
+flag).
+.TP
+.B Under ULTRIX and Digital UNIX/Tru64 UNIX:
+Any user may capture network traffic.
+However, no user (not even the super-user) can capture in promiscuous
+mode on an interface unless the super-user has enabled promiscuous-mode
+operation on that interface using
+.IR pfconfig (8),
+and no user (not even the super-user) can capture unicast traffic
+received by or sent by the machine on an interface unless the super-user
+has enabled copy-all-mode operation on that interface using
+.IR pfconfig ,
+so
+.I useful
+packet capture on an interface probably requires that either
+promiscuous-mode or copy-all-mode operation, or both modes of
+operation, be enabled on that interface.
+.TP
+.B Under BSD (this includes Mac OS X):
+You must have read access to
+.I /dev/bpf*
+on systems that don't have a cloning BPF device, or to
+.I /dev/bpf
+on systems that do.
+On BSDs with a devfs (this includes Mac OS X), this might involve more
+than just having somebody with super-user access setting the ownership
+or permissions on the BPF devices - it might involve configuring devfs
+to set the ownership or permissions every time the system is booted,
+if the system even supports that; if it doesn't support that, you might
+have to find some other way to make that happen at boot time.
+.PP
+Reading a saved packet file doesn't require special privileges.
+.PP
+To open a ``savefile`` to which to write packets, call
+.BR pcap_dump_open() .
+It returns a pointer to a
+.BR pcap_dumper_t ,
+which is the handle used for writing packets to the ``savefile''.
+.PP
+Packets are read with
+.B pcap_dispatch()
+or
+.BR pcap_loop() ,
+which process one or more packets, calling a callback routine for each
+packet, or with
+.B pcap_next()
+or
+.BR pcap_next_ex() ,
+which return the next packet.
+The callback for
+.B pcap_dispatch()
+and
+.BR pcap_loop()
+is supplied a pointer to a
+.IR "struct pcap_pkthdr" ,
+which includes the following members:
+.RS
+.TP
+.B ts
+a
+.I struct timeval
+containing the time when the packet was captured
+.TP
+.B caplen
+a
+.I bpf_u_int32
+giving the number of bytes of the packet that are available from the
+capture
+.TP
+.B len
+a
+.I bpf_u_int32
+giving the length of the packet, in bytes (which might be more than the
+number of bytes available from the capture, if the length of the packet
+is larger than the maximum number of bytes to capture).
+.RE
+.PP
+.B pcap_next_ex()
+supplies that pointer through a pointer argument.
+.B pcap_next()
+is passed an argument that points to a
+.I struct pcap_pkthdr
+structure, and fills it in.
+.PP
+The callback is also supplied a
+.I const u_char
+pointer to the first
+.B caplen
+(as given in the
+.I struct pcap_pkthdr
+a pointer to which is passed to the callback routine)
+bytes of data from the packet.  This won't necessarily be the entire
+packet; to capture the entire packet, you will have to provide a value
+for
+.I snaplen
+in your call to
+.B pcap_open_live()
+that is sufficiently large to get all of the packet's data - a value of
+65535 should be sufficient on most if not all networks).  When reading
+from a ``savefile'', the snapshot length specified when the capture was
+performed will limit the amount of packet data available.
+.B pcap_next()
+returns that pointer;
+.B pcap_next_ex()
+supplies that pointer through a pointer argument.
+.SH BACKWARDS COMPATIBILITY
+.PP
+In versions of libpcap prior to 1.0, the
+.B pcap.h
+header file was not in a
+.B pcap
+directory on most platforms; if you are writing an application that must
+work on versions of libpcap prior to 1.0, include
+.BR <pcap.h> ,
+which will include
+.B <pcap/pcap.h>
+for you, rather than including
+.BR <pcap/pcap.h> .
+.PP
+.B pcap_create()
+and
+.B pcap_activate()
+were not available in versions of libpcap prior to 1.0; if you are
+writing an application that must work on versions of libpcap prior to
+1.0, either use
+.B pcap_open_live()
+to get a handle for a live capture or, if you want to be able to use the
+additional capabilities offered by using
+.B pcap_create()
+and
+.BR pcap_activate() ,
+use an
+.BR autoconf (1)
+script or some other configuration script to check whether the libpcap
+1.0 APIs are available and use them only if they are.
+.SH SEE ALSO
+autoconf(1), tcpdump(1), tcpslice(1), pcap-filter(@MAN_MISC_INFO@), pfconfig(8),
+usermod(1M)
+.SH AUTHORS
+The original authors of libpcap are:
+.LP
+Van Jacobson,
+Craig Leres and
+Steven McCanne, all of the
+Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
+.LP
+The current version is available from "The Tcpdump Group"'s Web site at
+.LP
+.RS
+.I http://www.tcpdump.org/
+.RE
+.SH BUGS
+Please send problems, bugs, questions, desirable enhancements, etc. to:
+.LP
+.RS
+tcpdump-workers@lists.tcpdump.org
+.RE
diff --git a/contrib/libpcap/pcap.c b/contrib/libpcap/pcap.c
index 1a3c6b8..c763093 100644
--- a/contrib/libpcap/pcap.c
+++ b/contrib/libpcap/pcap.c
@@ -33,7 +33,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.88.2.19 2007/09/19 02:50:52 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.112.2.12 2008-09-22 20:16:01 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -71,10 +71,205 @@ static const char rcsid[] _U_ =
 #include <dagapi.h>
 #endif
 
+int 
+pcap_not_initialized(pcap_t *pcap)
+{
+	/* this means 'not initialized' */
+	return PCAP_ERROR_NOT_ACTIVATED;
+}
+
+/*
+ * Returns 1 if rfmon mode can be set on the pcap_t, 0 if it can't,
+ * a PCAP_ERROR value on an error.
+ */
 int
-pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
+pcap_can_set_rfmon(pcap_t *p)
+{
+	return (p->can_set_rfmon_op(p));
+}
+
+/*
+ * For systems where rfmon mode is never supported.
+ */
+static int
+pcap_cant_set_rfmon(pcap_t *p _U_)
+{
+	return (0);
+}
+
+pcap_t *
+pcap_create_common(const char *source, char *ebuf)
+{
+	pcap_t *p;
+
+	p = malloc(sizeof(*p));
+	if (p == NULL) {
+		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
+		    pcap_strerror(errno));
+		return (NULL);
+	}
+	memset(p, 0, sizeof(*p));
+#ifndef WIN32
+	p->fd = -1;	/* not opened yet */
+#endif 
+
+	p->opt.source = strdup(source);
+	if (p->opt.source == NULL) {
+		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
+		    pcap_strerror(errno));
+		free(p);
+		return (NULL);
+	}
+
+	/*
+	 * Default to "can't set rfmon mode"; if it's supported by
+	 * a platform, it can set the op to its routine to check
+	 * whether a particular device supports it.
+	 */
+	p->can_set_rfmon_op = pcap_cant_set_rfmon;
+
+	/*
+	 * Some operations can be performed only on activated pcap_t's;
+	 * have those operations handled by a "not supported" handler
+	 * until the pcap_t is activated.
+	 */
+	p->read_op = (read_op_t)pcap_not_initialized;
+	p->inject_op = (inject_op_t)pcap_not_initialized;
+	p->setfilter_op = (setfilter_op_t)pcap_not_initialized;
+	p->setdirection_op = (setdirection_op_t)pcap_not_initialized;
+	p->set_datalink_op = (set_datalink_op_t)pcap_not_initialized;
+	p->getnonblock_op = (getnonblock_op_t)pcap_not_initialized;
+	p->setnonblock_op = (setnonblock_op_t)pcap_not_initialized;
+	p->stats_op = (stats_op_t)pcap_not_initialized;
+#ifdef WIN32
+	p->setbuff_op = (setbuff_op_t)pcap_not_initialized;
+	p->setmode_op = (setmode_op_t)pcap_not_initialized;
+	p->setmintocopy_op = (setmintocopy_op_t)pcap_not_initialized;
+#endif
+	p->cleanup_op = pcap_cleanup_live_common;
+
+	/* put in some defaults*/
+	pcap_set_timeout(p, 0);
+	pcap_set_snaplen(p, 65535);	/* max packet size */
+	p->opt.promisc = 0;
+	p->opt.buffer_size = 0;
+	return (p);
+}
+
+int
+pcap_check_activated(pcap_t *p)
+{
+	if (p->activated) {
+		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't perform "
+			" operation on activated capture");
+		return -1;
+	}
+	return 0;
+}
+
+int
+pcap_set_snaplen(pcap_t *p, int snaplen)
+{
+	if (pcap_check_activated(p))
+		return PCAP_ERROR_ACTIVATED;
+	p->snapshot = snaplen;
+	return 0;
+}
+
+int
+pcap_set_promisc(pcap_t *p, int promisc)
+{
+	if (pcap_check_activated(p))
+		return PCAP_ERROR_ACTIVATED;
+	p->opt.promisc = promisc;
+	return 0;
+}
+
+int
+pcap_set_rfmon(pcap_t *p, int rfmon)
+{
+	if (pcap_check_activated(p))
+		return PCAP_ERROR_ACTIVATED;
+	p->opt.rfmon = rfmon;
+	return 0;
+}
+
+int
+pcap_set_timeout(pcap_t *p, int timeout_ms)
+{
+	if (pcap_check_activated(p))
+		return PCAP_ERROR_ACTIVATED;
+	p->md.timeout = timeout_ms;
+	return 0;
+}
+
+int
+pcap_set_buffer_size(pcap_t *p, int buffer_size)
+{
+	if (pcap_check_activated(p))
+		return PCAP_ERROR_ACTIVATED;
+	p->opt.buffer_size = buffer_size;
+	return 0;
+}
+
+int
+pcap_activate(pcap_t *p)
 {
+	int status;
+
+	status = p->activate_op(p);
+	if (status >= 0)
+		p->activated = 1;
+	return (status);
+}
+
+pcap_t *
+pcap_open_live(const char *source, int snaplen, int promisc, int to_ms, char *errbuf)
+{
+	pcap_t *p;
+	int status;
+
+	p = pcap_create(source, errbuf);
+	if (p == NULL)
+		return (NULL);
+	status = pcap_set_snaplen(p, snaplen);
+	if (status < 0)
+		goto fail;
+	status = pcap_set_promisc(p, promisc);
+	if (status < 0)
+		goto fail;
+	status = pcap_set_timeout(p, to_ms);
+	if (status < 0)
+		goto fail;
+	/*
+	 * Mark this as opened with pcap_open_live(), so that, for
+	 * example, we show the full list of DLT_ values, rather
+	 * than just the ones that are compatible with capturing
+	 * when not in monitor mode.  That allows existing applications
+	 * to work the way they used to work, but allows new applications
+	 * that know about the new open API to, for example, find out the
+	 * DLT_ values that they can select without changing whether
+	 * the adapter is in monitor mode or not.
+	 */
+	p->oldstyle = 1;
+	status = pcap_activate(p);
+	if (status < 0)
+		goto fail;
+	return (p);
+fail:
+	if (status == PCAP_ERROR || status == PCAP_ERROR_NO_SUCH_DEVICE ||
+	    status == PCAP_ERROR_PERM_DENIED)
+		strlcpy(errbuf, p->errbuf, PCAP_ERRBUF_SIZE);
+	else
+		snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", source,
+		    pcap_statustostr(status));
+	pcap_close(p);
+	return (NULL);
+}
 
+int
+pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
+{
 	return p->read_op(p, cnt, callback, user);
 }
 
@@ -223,6 +418,12 @@ pcap_datalink(pcap_t *p)
 }
 
 int
+pcap_datalink_ext(pcap_t *p)
+{
+	return (p->linktype_ext);
+}
+
+int
 pcap_list_datalinks(pcap_t *p, int **dlt_buffer)
 {
 	if (p->dlt_count == 0) {
@@ -253,6 +454,23 @@ pcap_list_datalinks(pcap_t *p, int **dlt_buffer)
 	}
 }
 
+/*
+ * In Windows, you might have a library built with one version of the
+ * C runtime library and an application built with another version of
+ * the C runtime library, which means that the library might use one
+ * version of malloc() and free() and the application might use another
+ * version of malloc() and free().  If so, that means something
+ * allocated by the library cannot be freed by the application, so we
+ * need to have a pcap_free_datalinks() routine to free up the list
+ * allocated by pcap_list_datalinks(), even though it's just a wrapper
+ * around free().
+ */
+void
+pcap_free_datalinks(int *dlt_list)
+{
+	free(dlt_list);
+}
+
 int
 pcap_set_datalink(pcap_t *p, int dlt)
 {
@@ -328,7 +546,7 @@ static struct dlt_choice dlt_choices[] = {
 	DLT_CHOICE(DLT_NULL, "BSD loopback"),
 	DLT_CHOICE(DLT_EN10MB, "Ethernet"),
 	DLT_CHOICE(DLT_IEEE802, "Token ring"),
-	DLT_CHOICE(DLT_ARCNET, "ARCNET"),
+	DLT_CHOICE(DLT_ARCNET, "BSD ARCNET"),
 	DLT_CHOICE(DLT_SLIP, "SLIP"),
 	DLT_CHOICE(DLT_PPP, "PPP"),
 	DLT_CHOICE(DLT_FDDI, "FDDI"),
@@ -339,6 +557,7 @@ static struct dlt_choice dlt_choices[] = {
 	DLT_CHOICE(DLT_ATM_CLIP, "Linux Classical IP-over-ATM"),
 	DLT_CHOICE(DLT_PPP_SERIAL, "PPP over serial"),
 	DLT_CHOICE(DLT_PPP_ETHER, "PPPoE"),
+        DLT_CHOICE(DLT_SYMANTEC_FIREWALL, "Symantec Firewall"),
 	DLT_CHOICE(DLT_C_HDLC, "Cisco HDLC"),
 	DLT_CHOICE(DLT_IEEE802_11, "802.11"),
 	DLT_CHOICE(DLT_FRELAY, "Frame Relay"),
@@ -350,17 +569,25 @@ static struct dlt_choice dlt_choices[] = {
 	DLT_CHOICE(DLT_PRISM_HEADER, "802.11 plus Prism header"),
 	DLT_CHOICE(DLT_IP_OVER_FC, "RFC 2625 IP-over-Fibre Channel"),
 	DLT_CHOICE(DLT_SUNATM, "Sun raw ATM"),
-	DLT_CHOICE(DLT_IEEE802_11_RADIO, "802.11 plus BSD radio information header"),
-	DLT_CHOICE(DLT_APPLE_IP_OVER_IEEE1394, "Apple IP-over-IEEE 1394"),
+	DLT_CHOICE(DLT_IEEE802_11_RADIO, "802.11 plus radiotap header"),
 	DLT_CHOICE(DLT_ARCNET_LINUX, "Linux ARCNET"),
+        DLT_CHOICE(DLT_JUNIPER_MLPPP, "Juniper Multi-Link PPP"),
+	DLT_CHOICE(DLT_JUNIPER_MLFR, "Juniper Multi-Link Frame Relay"),
+        DLT_CHOICE(DLT_JUNIPER_ES, "Juniper Encryption Services PIC"),
+        DLT_CHOICE(DLT_JUNIPER_GGSN, "Juniper GGSN PIC"),
+	DLT_CHOICE(DLT_JUNIPER_MFR, "Juniper FRF.16 Frame Relay"),
+        DLT_CHOICE(DLT_JUNIPER_ATM2, "Juniper ATM2 PIC"),
+        DLT_CHOICE(DLT_JUNIPER_SERVICES, "Juniper Advanced Services PIC"),
+        DLT_CHOICE(DLT_JUNIPER_ATM1, "Juniper ATM1 PIC"),
+	DLT_CHOICE(DLT_APPLE_IP_OVER_IEEE1394, "Apple IP-over-IEEE 1394"),
+	DLT_CHOICE(DLT_MTP2_WITH_PHDR, "SS7 MTP2 with Pseudo-header"),
+	DLT_CHOICE(DLT_MTP2, "SS7 MTP2"),
+	DLT_CHOICE(DLT_MTP3, "SS7 MTP3"),
+	DLT_CHOICE(DLT_SCCP, "SS7 SCCP"),
 	DLT_CHOICE(DLT_DOCSIS, "DOCSIS"),
 	DLT_CHOICE(DLT_LINUX_IRDA, "Linux IrDA"),
-	DLT_CHOICE(DLT_LINUX_LAPD, "Linux vISDN LAPD"),
 	DLT_CHOICE(DLT_IEEE802_11_RADIO_AVS, "802.11 plus AVS radio information header"),
-        DLT_CHOICE(DLT_SYMANTEC_FIREWALL, "Symantec Firewall"),
-        DLT_CHOICE(DLT_JUNIPER_ATM1, "Juniper ATM1 PIC"),
-        DLT_CHOICE(DLT_JUNIPER_ATM2, "Juniper ATM2 PIC"),
-        DLT_CHOICE(DLT_JUNIPER_MLPPP, "Juniper Multi-Link PPP"),
+        DLT_CHOICE(DLT_JUNIPER_MONITOR, "Juniper Passive Monitor PIC"),
 	DLT_CHOICE(DLT_PPP_PPPD, "PPP for pppd, with direction flag"),
 	DLT_CHOICE(DLT_JUNIPER_PPPOE, "Juniper PPPoE"),
 	DLT_CHOICE(DLT_JUNIPER_PPPOE_ATM, "Juniper PPPoE/ATM"),
@@ -368,27 +595,35 @@ static struct dlt_choice dlt_choices[] = {
 	DLT_CHOICE(DLT_GPF_T, "GPF-T"),
 	DLT_CHOICE(DLT_GPF_F, "GPF-F"),
 	DLT_CHOICE(DLT_JUNIPER_PIC_PEER, "Juniper PIC Peer"),
-	DLT_CHOICE(DLT_JUNIPER_MLFR, "Juniper Multi-Link Frame Relay"),
 	DLT_CHOICE(DLT_ERF_ETH,	"Ethernet with Endace ERF header"),
 	DLT_CHOICE(DLT_ERF_POS, "Packet-over-SONET with Endace ERF header"),
-        DLT_CHOICE(DLT_JUNIPER_GGSN, "Juniper GGSN PIC"),
-        DLT_CHOICE(DLT_JUNIPER_ES, "Juniper Encryption Services PIC"),
-        DLT_CHOICE(DLT_JUNIPER_MONITOR, "Juniper Passive Monitor PIC"),
-        DLT_CHOICE(DLT_JUNIPER_SERVICES, "Juniper Advanced Services PIC"),
-	DLT_CHOICE(DLT_JUNIPER_MFR, "Juniper FRF.16 Frame Relay"),
+	DLT_CHOICE(DLT_LINUX_LAPD, "Linux vISDN LAPD"),
 	DLT_CHOICE(DLT_JUNIPER_ETHER, "Juniper Ethernet"),
 	DLT_CHOICE(DLT_JUNIPER_PPP, "Juniper PPP"),
 	DLT_CHOICE(DLT_JUNIPER_FRELAY, "Juniper Frame Relay"),
 	DLT_CHOICE(DLT_JUNIPER_CHDLC, "Juniper C-HDLC"),
 	DLT_CHOICE(DLT_MFR, "FRF.16 Frame Relay"),
 	DLT_CHOICE(DLT_JUNIPER_VP, "Juniper Voice PIC"),
-	DLT_CHOICE(DLT_MTP2, "SS7 MTP2"),
 	DLT_CHOICE(DLT_A429, "Arinc 429"),
 	DLT_CHOICE(DLT_A653_ICM, "Arinc 653 Interpartition Communication"),
 	DLT_CHOICE(DLT_USB, "USB"),
 	DLT_CHOICE(DLT_BLUETOOTH_HCI_H4, "Bluetooth HCI UART transport layer"),
+	DLT_CHOICE(DLT_IEEE802_16_MAC_CPS, "IEEE 802.16 MAC Common Part Sublayer"),
+	DLT_CHOICE(DLT_USB_LINUX, "USB with Linux header"),
 	DLT_CHOICE(DLT_CAN20B, "Controller Area Network (CAN) v. 2.0B"),
-	DLT_CHOICE(DLT_MTP2_WITH_PHDR, "SS7 MTP2 with Pseudo-header"),
+	DLT_CHOICE(DLT_IEEE802_15_4_LINUX, "IEEE 802.15.4 with Linux padding"),
+	DLT_CHOICE(DLT_PPI, "Per-Packet Information"),
+	DLT_CHOICE(DLT_IEEE802_16_MAC_CPS_RADIO, "IEEE 802.16 MAC Common Part Sublayer plus radiotap header"),
+	DLT_CHOICE(DLT_JUNIPER_ISM, "Juniper Integrated Service Module"),
+	DLT_CHOICE(DLT_IEEE802_15_4, "IEEE 802.15.4"),
+	DLT_CHOICE(DLT_SITA, "SITA pseudo-header"),
+	DLT_CHOICE(DLT_ERF, "Endace ERF header"),
+	DLT_CHOICE(DLT_RAIF1, "Ethernet with u10 Networks pseudo-header"),
+	DLT_CHOICE(DLT_IPMB, "IPMB"),
+	DLT_CHOICE(DLT_JUNIPER_ST, "Juniper Secure Tunnel"),
+	DLT_CHOICE(DLT_BLUETOOTH_HCI_H4_WITH_PHDR, "Bluetooth HCI UART transport layer plus pseudo-header"),
+	DLT_CHOICE(DLT_AX25_KISS, "AX.25 with KISS header"),
+	DLT_CHOICE(DLT_IEEE802_15_4_NONASK_PHY, "IEEE 802.15.4 with non-ASK PHY data"),
 	DLT_CHOICE_SENTINEL
 };
 
@@ -680,6 +915,53 @@ pcap_win32strerror(void)
 #endif
 
 /*
+ * Generate error strings for PCAP_ERROR_ and PCAP_WARNING_ values.
+ */
+const char *
+pcap_statustostr(int errnum)
+{
+	static char ebuf[15+10+1];
+
+	switch (errnum) {
+
+	case PCAP_WARNING:
+		return("Generic warning");
+
+	case PCAP_WARNING_PROMISC_NOTSUP:
+		return ("That device doesn't support promiscuous mode");
+
+	case PCAP_ERROR:
+		return("Generic error");
+
+	case PCAP_ERROR_BREAK:
+		return("Loop terminated by pcap_breakloop");
+
+	case PCAP_ERROR_NOT_ACTIVATED:
+		return("The pcap_t has not been activated");
+
+	case PCAP_ERROR_ACTIVATED:
+		return ("The setting can't be changed after the pcap_t is activated");
+
+	case PCAP_ERROR_NO_SUCH_DEVICE:
+		return ("No such device exists");
+
+	case PCAP_ERROR_RFMON_NOTSUP:
+		return ("That device doesn't support monitor mode");
+
+	case PCAP_ERROR_NOT_RFMON:
+		return ("That operation is supported only in monitor mode");
+
+	case PCAP_ERROR_PERM_DENIED:
+		return ("You don't have permission to capture on that device");
+
+	case PCAP_ERROR_IFACE_NOT_UP:
+		return ("That device is not up");
+	}
+	(void)snprintf(ebuf, sizeof ebuf, "Unknown error: %d", errnum);
+	return(ebuf);
+}
+
+/*
  * Not all systems have strerror().
  */
 const char *
@@ -690,7 +972,7 @@ pcap_strerror(int errnum)
 #else
 	extern int sys_nerr;
 	extern const char *const sys_errlist[];
-	static char ebuf[20];
+	static char ebuf[15+10+1];
 
 	if ((unsigned int)errnum < sys_nerr)
 		return ((char *)sys_errlist[errnum]);
@@ -736,37 +1018,162 @@ pcap_stats_dead(pcap_t *p, struct pcap_stat *ps _U_)
 	return (-1);
 }
 
-void
-pcap_close_common(pcap_t *p)
+#ifdef WIN32
+int
+pcap_setbuff(pcap_t *p, int dim)
+{
+	return p->setbuff_op(p, dim);
+}
+
+static int
+pcap_setbuff_dead(pcap_t *p, int dim)
+{
+	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+	    "The kernel buffer size cannot be set on a pcap_open_dead pcap_t");
+	return (-1);
+}
+
+int
+pcap_setmode(pcap_t *p, int mode)
+{
+	return p->setmode_op(p, mode);
+}
+
+static int
+pcap_setmode_dead(pcap_t *p, int mode)
+{
+	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+	    "impossible to set mode on a pcap_open_dead pcap_t");
+	return (-1);
+}
+
+int
+pcap_setmintocopy(pcap_t *p, int size)
+{
+	return p->setmintocopy_op(p, size);
+}
+
+static int
+pcap_setmintocopy_dead(pcap_t *p, int size)
+{
+	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+	    "The mintocopy parameter cannot be set on a pcap_open_dead pcap_t");
+	return (-1);
+}
+#endif
+
+/*
+ * On some platforms, we need to clean up promiscuous or monitor mode
+ * when we close a device - and we want that to happen even if the
+ * application just exits without explicitl closing devices.
+ * On those platforms, we need to register a "close all the pcaps"
+ * routine to be called when we exit, and need to maintain a list of
+ * pcaps that need to be closed to clean up modes.
+ *
+ * XXX - not thread-safe.
+ */
+
+/*
+ * List of pcaps on which we've done something that needs to be
+ * cleaned up.
+ * If there are any such pcaps, we arrange to call "pcap_close_all()"
+ * when we exit, and have it close all of them.
+ */
+static struct pcap *pcaps_to_close;
+
+/*
+ * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to
+ * be called on exit.
+ */
+static int did_atexit;
+
+static void
+pcap_close_all(void)
+{
+	struct pcap *handle;
+
+	while ((handle = pcaps_to_close) != NULL)
+		pcap_close(handle);
+}
+
+int
+pcap_do_addexit(pcap_t *p)
 {
-#ifdef BIOCSETBUFMODE
 	/*
-	 * Check to see if this pcap instance was using the zerocopy buffer
-	 * mode.  If it was, delete the mappings.  Note that p->buffer
-	 * gets initialized to one of the mmaped regions in this case, so
-	 * do not try and free it directly.
-	 *
-	 * If the regular buffer mode was selected, then it is safe to free
-	 * this memory.
+	 * If we haven't already done so, arrange to have
+	 * "pcap_close_all()" called when we exit.
 	 */
-	if (p->zerocopy) {
-		if (p->zbuf1 != MAP_FAILED && p->zbuf1 != NULL)
-			munmap(p->zbuf1, p->zbufsize);
-		if (p->zbuf2 != MAP_FAILED && p->zbuf2 != NULL)
-			munmap(p->zbuf2, p->zbufsize);
-		p->buffer = NULL;
-	} else
-#endif
-	if (p->buffer != NULL)
+	if (!did_atexit) {
+		if (atexit(pcap_close_all) == -1) {
+			/*
+			 * "atexit()" failed; let our caller know.
+			 */
+			strncpy(p->errbuf, "atexit failed",
+			    PCAP_ERRBUF_SIZE);
+			return (0);
+		}
+		did_atexit = 1;
+	}
+	return (1);
+}
+
+void
+pcap_add_to_pcaps_to_close(pcap_t *p)
+{
+	p->md.next = pcaps_to_close;
+	pcaps_to_close = p;
+}
+
+void
+pcap_remove_from_pcaps_to_close(pcap_t *p)
+{
+	pcap_t *pc, *prevpc;
+
+	for (pc = pcaps_to_close, prevpc = NULL; pc != NULL;
+	    prevpc = pc, pc = pc->md.next) {
+		if (pc == p) {
+			/*
+			 * Found it.  Remove it from the list.
+			 */
+			if (prevpc == NULL) {
+				/*
+				 * It was at the head of the list.
+				 */
+				pcaps_to_close = pc->md.next;
+			} else {
+				/*
+				 * It was in the middle of the list.
+				 */
+				prevpc->md.next = pc->md.next;
+			}
+			break;
+		}
+	}
+}
+
+void
+pcap_cleanup_live_common(pcap_t *p)
+{
+	if (p->buffer != NULL) {
 		free(p->buffer);
+		p->buffer = NULL;
+	}
+	if (p->dlt_list != NULL) {
+		free(p->dlt_list);
+		p->dlt_list = NULL;
+		p->dlt_count = 0;
+	}
+	pcap_freecode(&p->fcode);
 #if !defined(WIN32) && !defined(MSDOS)
-	if (p->fd >= 0)
+	if (p->fd >= 0) {
 		close(p->fd);
+		p->fd = -1;
+	}
 #endif
 }
 
 static void
-pcap_close_dead(pcap_t *p _U_)
+pcap_cleanup_dead(pcap_t *p _U_)
 {
 	/* Nothing to do. */
 }
@@ -783,7 +1190,13 @@ pcap_open_dead(int linktype, int snaplen)
 	p->snapshot = snaplen;
 	p->linktype = linktype;
 	p->stats_op = pcap_stats_dead;
-	p->close_op = pcap_close_dead;
+#ifdef WIN32
+	p->setbuff_op = pcap_setbuff_dead;
+	p->setmode_op = pcap_setmode_dead;
+	p->setmintocopy_op = pcap_setmintocopy_dead;
+#endif
+	p->cleanup_op = pcap_cleanup_dead;
+	p->activated = 1;
 	return p;
 }
 
@@ -814,14 +1227,31 @@ pcap_inject(pcap_t *p, const void *buf, size_t size)
 void
 pcap_close(pcap_t *p)
 {
-	p->close_op(p);
-	if (p->dlt_list != NULL)
-		free(p->dlt_list);
-	pcap_freecode(&p->fcode);
+	if (p->opt.source != NULL)
+		free(p->opt.source);
+	p->cleanup_op(p);
 	free(p);
 }
 
 /*
+ * Given a BPF program, a pcap_pkthdr structure for a packet, and the raw
+ * data for the packet, check whether the packet passes the filter.
+ * Returns the return value of the filter program, which will be zero if
+ * the packet doesn't pass and non-zero if the packet does pass.
+ */
+int
+pcap_offline_filter(struct bpf_program *fp, const struct pcap_pkthdr *h,
+    const u_char *pkt)
+{
+	struct bpf_insn *fcode = fp->bf_insns;
+
+	if (fcode != NULL) 
+		return (bpf_filter(fcode, pkt, h->len, h->caplen));
+	else
+		return (0);
+}
+
+/*
  * We make the version string static, and return a pointer to it, rather
  * than exporting the version string directly.  On at least some UNIXes,
  * if you import data from a shared library into an program, the data is
@@ -836,7 +1266,7 @@ pcap_close(pcap_t *p)
 #ifdef HAVE_VERSION_H
 #include "version.h"
 #else
-static const char pcap_version_string[] = "libpcap version 0.9.8";
+static const char pcap_version_string[] = "libpcap version 0.9[.x]";
 #endif
 
 #ifdef WIN32
diff --git a/contrib/libpcap/pcap.h b/contrib/libpcap/pcap.h
index c81f81e..a71d702 100644
--- a/contrib/libpcap/pcap.h
+++ b/contrib/libpcap/pcap.h
@@ -1,4 +1,3 @@
-/* -*- Mode: c; tab-width: 8; indent-tabs-mode: 1; c-basic-offset: 8; -*- */
 /*
  * Copyright (c) 1993, 1994, 1995, 1996, 1997
  *	The Regents of the University of California.  All rights reserved.
@@ -32,16 +31,25 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD$
- * @(#) $Header: /tcpdump/master/libpcap/pcap.h,v 1.52.2.7 2007/06/11 09:52:05 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap.h,v 1.59 2006/10/04 18:09:22 guy Exp $ (LBL)
  */
 
 #ifndef lib_pcap_h
 #define lib_pcap_h
 
-#include <sys/types.h>
-#include <sys/time.h>
+#if defined(WIN32)
+  #include <pcap-stdinc.h>
+#elif defined(MSDOS)
+  #include <sys/types.h>
+  #include <sys/socket.h>  /* u_int, u_char etc. */
+#else /* UN*X */
+  #include <sys/types.h>
+  #include <sys/time.h>
+#endif /* WIN32/MSDOS/UN*X */
 
-#include <net/bpf.h>
+#ifndef PCAP_DONT_INCLUDE_PCAP_BPF_H
+#include <pcap-bpf.h>
+#endif
 
 #include <stdio.h>
 
@@ -55,262 +63,13 @@ extern "C" {
 #define PCAP_ERRBUF_SIZE 256
 
 /*
- * Compatibility for systems that have a bpf.h that
- * predates the bpf typedefs for 64-bit support.
- */
-#if BPF_RELEASE - 0 < 199406
-typedef	int bpf_int32;
-typedef	u_int bpf_u_int32;
-#endif
-
-typedef struct pcap pcap_t;
-typedef struct pcap_dumper pcap_dumper_t;
-typedef struct pcap_if pcap_if_t;
-typedef struct pcap_addr pcap_addr_t;
-
-/*
- * The first record in the file contains saved values for some
- * of the flags used in the printout phases of tcpdump.
- * Many fields here are 32 bit ints so compilers won't insert unwanted
- * padding; these files need to be interchangeable across architectures.
- *
- * Do not change the layout of this structure, in any way (this includes
- * changes that only affect the length of fields in this structure).
- *
- * Also, do not change the interpretation of any of the members of this
- * structure, in any way (this includes using values other than
- * LINKTYPE_ values, as defined in "savefile.c", in the "linktype"
- * field).
- *
- * Instead:
- *
- *	introduce a new structure for the new format, if the layout
- *	of the structure changed;
- *
- *	send mail to "tcpdump-workers@tcpdump.org", requesting a new
- *	magic number for your new capture file format, and, when
- *	you get the new magic number, put it in "savefile.c";
- *
- *	use that magic number for save files with the changed file
- *	header;
- *
- *	make the code in "savefile.c" capable of reading files with
- *	the old file header as well as files with the new file header
- *	(using the magic number to determine the header format).
- *
- * Then supply the changes to "patches@tcpdump.org", so that future
- * versions of libpcap and programs that use it (such as tcpdump) will
- * be able to read your new capture file format.
- */
-struct pcap_file_header {
-	bpf_u_int32 magic;
-	u_short version_major;
-	u_short version_minor;
-	bpf_int32 thiszone;	/* gmt to local correction */
-	bpf_u_int32 sigfigs;	/* accuracy of timestamps */
-	bpf_u_int32 snaplen;	/* max length saved portion of each pkt */
-	bpf_u_int32 linktype;	/* data link type (LINKTYPE_*) */
-};
-
-typedef enum {
-       PCAP_D_INOUT = 0,
-       PCAP_D_IN,
-       PCAP_D_OUT
-} pcap_direction_t;
-
-/*
- * Generic per-packet information, as supplied by libpcap.
+ * For backwards compatibility.
  *
- * The time stamp can and should be a "struct timeval", regardless of
- * whether your system supports 32-bit tv_sec in "struct timeval",
- * 64-bit tv_sec in "struct timeval", or both if it supports both 32-bit
- * and 64-bit applications.  The on-disk format of savefiles uses 32-bit
- * tv_sec (and tv_usec); this structure is irrelevant to that.  32-bit
- * and 64-bit versions of libpcap, even if they're on the same platform,
- * should supply the appropriate version of "struct timeval", even if
- * that's not what the underlying packet capture mechanism supplies.
- */
-struct pcap_pkthdr {
-	struct timeval ts;	/* time stamp */
-	bpf_u_int32 caplen;	/* length of portion present */
-	bpf_u_int32 len;	/* length this packet (off wire) */
-};
-
-/*
- * As returned by the pcap_stats()
- */
-struct pcap_stat {
-	u_int ps_recv;		/* number of packets received */
-	u_int ps_drop;		/* number of packets dropped */
-	u_int ps_ifdrop;	/* drops by interface XXX not yet supported */
-#ifdef WIN32
-	u_int bs_capt;		/* number of packets that reach the application */
-#endif /* WIN32 */
-};
-
-#ifdef MSDOS
-/*
- * As returned by the pcap_stats_ex()
+ * Note to OS vendors: do NOT get rid of this file!  Many applications
+ * expect to be able to include <pcap.h>, and at least some of them
+ * go through contortions in their configure scripts to try to detect
+ * OSes that have "helpfully" moved pcap.h to <pcap/pcap.h> without
+ * leaving behind a <pcap.h> file.
  */
-struct pcap_stat_ex {
-       u_long  rx_packets;        /* total packets received       */
-       u_long  tx_packets;        /* total packets transmitted    */
-       u_long  rx_bytes;          /* total bytes received         */
-       u_long  tx_bytes;          /* total bytes transmitted      */
-       u_long  rx_errors;         /* bad packets received         */
-       u_long  tx_errors;         /* packet transmit problems     */
-       u_long  rx_dropped;        /* no space in Rx buffers       */
-       u_long  tx_dropped;        /* no space available for Tx    */
-       u_long  multicast;         /* multicast packets received   */
-       u_long  collisions;
-
-       /* detailed rx_errors: */
-       u_long  rx_length_errors;
-       u_long  rx_over_errors;    /* receiver ring buff overflow  */
-       u_long  rx_crc_errors;     /* recv'd pkt with crc error    */
-       u_long  rx_frame_errors;   /* recv'd frame alignment error */
-       u_long  rx_fifo_errors;    /* recv'r fifo overrun          */
-       u_long  rx_missed_errors;  /* recv'r missed packet         */
-
-       /* detailed tx_errors */
-       u_long  tx_aborted_errors;
-       u_long  tx_carrier_errors;
-       u_long  tx_fifo_errors;
-       u_long  tx_heartbeat_errors;
-       u_long  tx_window_errors;
-     };
-#endif
-
-/*
- * Item in a list of interfaces.
- */
-struct pcap_if {
-	struct pcap_if *next;
-	char *name;		/* name to hand to "pcap_open_live()" */
-	char *description;	/* textual description of interface, or NULL */
-	struct pcap_addr *addresses;
-	bpf_u_int32 flags;	/* PCAP_IF_ interface flags */
-};
-
-#define PCAP_IF_LOOPBACK	0x00000001	/* interface is loopback */
-
-/*
- * Representation of an interface address.
- */
-struct pcap_addr {
-	struct pcap_addr *next;
-	struct sockaddr *addr;		/* address */
-	struct sockaddr *netmask;	/* netmask for that address */
-	struct sockaddr *broadaddr;	/* broadcast address for that address */
-	struct sockaddr *dstaddr;	/* P2P destination address for that address */
-};
-
-typedef void (*pcap_handler)(u_char *, const struct pcap_pkthdr *,
-			     const u_char *);
-
-char	*pcap_lookupdev(char *);
-int	pcap_lookupnet(const char *, bpf_u_int32 *, bpf_u_int32 *, char *);
-pcap_t	*pcap_open_live(const char *, int, int, int, char *);
-pcap_t	*pcap_open_dead(int, int);
-pcap_t	*pcap_open_offline(const char *, char *);
-pcap_t	*pcap_fopen_offline(FILE *, char *);
-void	pcap_close(pcap_t *);
-int	pcap_loop(pcap_t *, int, pcap_handler, u_char *);
-int	pcap_dispatch(pcap_t *, int, pcap_handler, u_char *);
-const u_char*
-	pcap_next(pcap_t *, struct pcap_pkthdr *);
-int 	pcap_next_ex(pcap_t *, struct pcap_pkthdr **, const u_char **);
-void	pcap_breakloop(pcap_t *);
-int	pcap_stats(pcap_t *, struct pcap_stat *);
-int	pcap_setfilter(pcap_t *, struct bpf_program *);
-int 	pcap_setdirection(pcap_t *, pcap_direction_t);
-int	pcap_getnonblock(pcap_t *, char *);
-int	pcap_setnonblock(pcap_t *, int, char *);
-void	pcap_perror(pcap_t *, char *);
-int	pcap_inject(pcap_t *, const void *, size_t);
-int	pcap_sendpacket(pcap_t *, const u_char *, int);
-const char *pcap_strerror(int);
-char	*pcap_geterr(pcap_t *);
-int	pcap_compile(pcap_t *, struct bpf_program *, const char *, int,
-	    bpf_u_int32);
-int	pcap_compile_nopcap(int, int, struct bpf_program *,
-	    const char *, int, bpf_u_int32);
-void	pcap_freecode(struct bpf_program *);
-int	pcap_datalink(pcap_t *);
-int	pcap_list_datalinks(pcap_t *, int **);
-int	pcap_set_datalink(pcap_t *, int);
-int	pcap_datalink_name_to_val(const char *);
-const char *pcap_datalink_val_to_name(int);
-const char *pcap_datalink_val_to_description(int);
-int	pcap_snapshot(pcap_t *);
-int	pcap_is_swapped(pcap_t *);
-int	pcap_major_version(pcap_t *);
-int	pcap_minor_version(pcap_t *);
-
-/* XXX */
-FILE	*pcap_file(pcap_t *);
-int	pcap_fileno(pcap_t *);
-
-pcap_dumper_t *pcap_dump_open(pcap_t *, const char *);
-pcap_dumper_t *pcap_dump_fopen(pcap_t *, FILE *fp);
-FILE	*pcap_dump_file(pcap_dumper_t *);
-long	pcap_dump_ftell(pcap_dumper_t *);
-int	pcap_dump_flush(pcap_dumper_t *);
-void	pcap_dump_close(pcap_dumper_t *);
-void	pcap_dump(u_char *, const struct pcap_pkthdr *, const u_char *);
-
-int	pcap_findalldevs(pcap_if_t **, char *);
-void	pcap_freealldevs(pcap_if_t *);
-
-const char *pcap_lib_version(void);
-
-/* XXX this guy lives in the bpf tree */
-u_int	bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
-int	bpf_validate(struct bpf_insn *f, int len);
-char	*bpf_image(struct bpf_insn *, int);
-void	bpf_dump(struct bpf_program *, int);
-
-#if defined(WIN32)
-
-/*
- * Win32 definitions
- */
-
-int pcap_setbuff(pcap_t *p, int dim);
-int pcap_setmode(pcap_t *p, int mode);
-int pcap_setmintocopy(pcap_t *p, int size);
-
-#ifdef WPCAP
-/* Include file with the wpcap-specific extensions */
-#include <Win32-Extensions.h>
-#endif /* WPCAP */
-
-#define MODE_CAPT 0
-#define MODE_STAT 1
-#define MODE_MON 2
-
-#elif defined(MSDOS)
-
-/*
- * MS-DOS definitions
- */
-
-int  pcap_stats_ex (pcap_t *, struct pcap_stat_ex *);
-void pcap_set_wait (pcap_t *p, void (*yield)(void), int wait);
-u_long pcap_mac_packets (void);
-
-#else /* UN*X */
-
-/*
- * UN*X definitions
- */
-
-int	pcap_get_selectable_fd(pcap_t *);
-
-#endif /* WIN32/MSDOS/UN*X */
-
-#ifdef __cplusplus
-}
-#endif
-
+#include <pcap/pcap.h>
 #endif
diff --git a/contrib/libpcap/pcap/bluetooth.h b/contrib/libpcap/pcap/bluetooth.h
new file mode 100644
index 0000000..7bf65df
--- /dev/null
+++ b/contrib/libpcap/pcap/bluetooth.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2006 Paolo Abeni (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote 
+ * products derived from this software without specific prior written 
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * bluetooth data struct
+ * By Paolo Abeni <paolo.abeni@email.it>
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap/bluetooth.h,v 1.1 2007/09/22 02:10:17 guy Exp $
+ */
+ 
+#ifndef _PCAP_BLUETOOTH_STRUCTS_H__
+#define _PCAP_BLUETOOTH_STRUCTS_H__
+
+/*
+ * Header prepended libpcap to each bluetooth h:4 frame.
+ * fields are in network byte order
+ */
+typedef struct _pcap_bluetooth_h4_header {
+	u_int32_t direction; /* if first bit is set direction is incoming */
+} pcap_bluetooth_h4_header;
+
+
+#endif
diff --git a/contrib/libpcap/pcap/bpf.h b/contrib/libpcap/pcap/bpf.h
new file mode 100644
index 0000000..9f4ca33
--- /dev/null
+++ b/contrib/libpcap/pcap/bpf.h
@@ -0,0 +1,934 @@
+/*-
+ * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * This code is derived from the Stanford/CMU enet packet filter,
+ * (net/enet.c) distributed as part of 4.3BSD, and code contributed
+ * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 
+ * Berkeley Laboratory.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the University of
+ *      California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap/bpf.h,v 1.19.2.8 2008-09-22 20:16:01 guy Exp $ (LBL)
+ */
+
+/*
+ * This is libpcap's cut-down version of bpf.h; it includes only
+ * the stuff needed for the code generator and the userland BPF
+ * interpreter, and the libpcap APIs for setting filters, etc..
+ *
+ * "pcap-bpf.c" will include the native OS version, as it deals with
+ * the OS's BPF implementation.
+ *
+ * XXX - should this all just be moved to "pcap.h"?
+ */
+
+#ifndef BPF_MAJOR_VERSION
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* BSD style release date */
+#define BPF_RELEASE 199606
+
+#ifdef MSDOS /* must be 32-bit */
+typedef long          bpf_int32;
+typedef unsigned long bpf_u_int32;
+#else
+typedef	int bpf_int32;
+typedef	u_int bpf_u_int32;
+#endif
+
+/*
+ * Alignment macros.  BPF_WORDALIGN rounds up to the next 
+ * even multiple of BPF_ALIGNMENT. 
+ */
+#ifndef __NetBSD__
+#define BPF_ALIGNMENT sizeof(bpf_int32)
+#else
+#define BPF_ALIGNMENT sizeof(long)
+#endif
+#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
+
+#define BPF_MAXBUFSIZE 0x8000
+#define BPF_MINBUFSIZE 32
+
+/*
+ * Structure for "pcap_compile()", "pcap_setfilter()", etc..
+ */
+struct bpf_program {
+	u_int bf_len;
+	struct bpf_insn *bf_insns;
+};
+ 
+/*
+ * Struct return by BIOCVERSION.  This represents the version number of 
+ * the filter language described by the instruction encodings below.
+ * bpf understands a program iff kernel_major == filter_major &&
+ * kernel_minor >= filter_minor, that is, if the value returned by the
+ * running kernel has the same major number and a minor number equal
+ * equal to or less than the filter being downloaded.  Otherwise, the
+ * results are undefined, meaning an error may be returned or packets
+ * may be accepted haphazardly.
+ * It has nothing to do with the source code version.
+ */
+struct bpf_version {
+	u_short bv_major;
+	u_short bv_minor;
+};
+/* Current version number of filter architecture. */
+#define BPF_MAJOR_VERSION 1
+#define BPF_MINOR_VERSION 1
+
+/*
+ * Data-link level type codes.
+ *
+ * Do *NOT* add new values to this list without asking
+ * "tcpdump-workers@lists.tcpdump.org" for a value.  Otherwise, you run
+ * the risk of using a value that's already being used for some other
+ * purpose, and of having tools that read libpcap-format captures not
+ * being able to handle captures with your new DLT_ value, with no hope
+ * that they will ever be changed to do so (as that would destroy their
+ * ability to read captures using that value for that other purpose).
+ */
+
+/*
+ * These are the types that are the same on all platforms, and that
+ * have been defined by <net/bpf.h> for ages.
+ */
+#define DLT_NULL	0	/* BSD loopback encapsulation */
+#define DLT_EN10MB	1	/* Ethernet (10Mb) */
+#define DLT_EN3MB	2	/* Experimental Ethernet (3Mb) */
+#define DLT_AX25	3	/* Amateur Radio AX.25 */
+#define DLT_PRONET	4	/* Proteon ProNET Token Ring */
+#define DLT_CHAOS	5	/* Chaos */
+#define DLT_IEEE802	6	/* 802.5 Token Ring */
+#define DLT_ARCNET	7	/* ARCNET, with BSD-style header */
+#define DLT_SLIP	8	/* Serial Line IP */
+#define DLT_PPP		9	/* Point-to-point Protocol */
+#define DLT_FDDI	10	/* FDDI */
+
+/*
+ * These are types that are different on some platforms, and that
+ * have been defined by <net/bpf.h> for ages.  We use #ifdefs to
+ * detect the BSDs that define them differently from the traditional
+ * libpcap <net/bpf.h>
+ *
+ * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
+ * but I don't know what the right #define is for BSD/OS.
+ */
+#define DLT_ATM_RFC1483	11	/* LLC-encapsulated ATM */
+
+#ifdef __OpenBSD__
+#define DLT_RAW		14	/* raw IP */
+#else
+#define DLT_RAW		12	/* raw IP */
+#endif
+
+/*
+ * Given that the only OS that currently generates BSD/OS SLIP or PPP
+ * is, well, BSD/OS, arguably everybody should have chosen its values
+ * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
+ * didn't.  So it goes.
+ */
+#if defined(__NetBSD__) || defined(__FreeBSD__)
+#ifndef DLT_SLIP_BSDOS
+#define DLT_SLIP_BSDOS	13	/* BSD/OS Serial Line IP */
+#define DLT_PPP_BSDOS	14	/* BSD/OS Point-to-point Protocol */
+#endif
+#else
+#define DLT_SLIP_BSDOS	15	/* BSD/OS Serial Line IP */
+#define DLT_PPP_BSDOS	16	/* BSD/OS Point-to-point Protocol */
+#endif
+
+/*
+ * 17 is used for DLT_OLD_PFLOG in OpenBSD;
+ *     OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below.
+ * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else.
+ */
+
+#define DLT_ATM_CLIP	19	/* Linux Classical-IP over ATM */
+
+/*
+ * Apparently Redback uses this for its SmartEdge 400/800.  I hope
+ * nobody else decided to use it, too.
+ */
+#define DLT_REDBACK_SMARTEDGE	32
+
+/*
+ * These values are defined by NetBSD; other platforms should refrain from
+ * using them for other purposes, so that NetBSD savefiles with link
+ * types of 50 or 51 can be read as this type on all platforms.
+ */
+#define DLT_PPP_SERIAL	50	/* PPP over serial with HDLC encapsulation */
+#define DLT_PPP_ETHER	51	/* PPP over Ethernet */
+
+/*
+ * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
+ * a link-layer type of 99 for the tcpdump it supplies.  The link-layer
+ * header has 6 bytes of unknown data, something that appears to be an
+ * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
+ * I've seen.
+ */
+#define DLT_SYMANTEC_FIREWALL	99
+
+/*
+ * Values between 100 and 103 are used in capture file headers as
+ * link-layer types corresponding to DLT_ types that differ
+ * between platforms; don't use those values for new DLT_ new types.
+ */
+
+/*
+ * This value was defined by libpcap 0.5; platforms that have defined
+ * it with a different value should define it here with that value -
+ * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
+ * whatever value that happens to be, so programs will correctly
+ * handle files with that link type regardless of the value of
+ * DLT_C_HDLC.
+ *
+ * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
+ * compatibility with programs written for BSD/OS.
+ *
+ * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
+ * for source compatibility with programs written for libpcap 0.5.
+ */
+#define DLT_C_HDLC	104	/* Cisco HDLC */
+#define DLT_CHDLC	DLT_C_HDLC
+
+#define DLT_IEEE802_11	105	/* IEEE 802.11 wireless */
+
+/*
+ * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
+ * except when it isn't.  (I.e., sometimes it's just raw IP, and
+ * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL,
+ * so that we don't have to worry about the link-layer header.)
+ */
+
+/*
+ * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
+ * with other values.
+ * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
+ * (DLCI, etc.).
+ */
+#define DLT_FRELAY	107
+
+/*
+ * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
+ * that the AF_ type in the link-layer header is in network byte order.
+ *
+ * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
+ * we don't use 12 for it in OSes other than OpenBSD.
+ */
+#ifdef __OpenBSD__
+#define DLT_LOOP	12
+#else
+#define DLT_LOOP	108
+#endif
+
+/*
+ * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
+ * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
+ * than OpenBSD.
+ */
+#ifdef __OpenBSD__
+#define DLT_ENC		13
+#else
+#define DLT_ENC		109
+#endif
+
+/*
+ * Values between 110 and 112 are reserved for use in capture file headers
+ * as link-layer types corresponding to DLT_ types that might differ
+ * between platforms; don't use those values for new DLT_ types
+ * other than the corresponding DLT_ types.
+ */
+
+/*
+ * This is for Linux cooked sockets.
+ */
+#define DLT_LINUX_SLL	113
+
+/*
+ * Apple LocalTalk hardware.
+ */
+#define DLT_LTALK	114
+
+/*
+ * Acorn Econet.
+ */
+#define DLT_ECONET	115
+
+/*
+ * Reserved for use with OpenBSD ipfilter.
+ */
+#define DLT_IPFILTER	116
+
+/*
+ * OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023
+ * in SuSE 6.3, so we can't use 17 for it in capture-file headers.
+ *
+ * XXX: is there a conflict with DLT_PFSYNC 18 as well?
+ */
+#ifdef __OpenBSD__
+#define DLT_OLD_PFLOG	17
+#define DLT_PFSYNC	18
+#endif
+#define DLT_PFLOG	117
+
+/*
+ * Registered for Cisco-internal use.
+ */
+#define DLT_CISCO_IOS	118
+
+/*
+ * For 802.11 cards using the Prism II chips, with a link-layer
+ * header including Prism monitor mode information plus an 802.11
+ * header.
+ */
+#define DLT_PRISM_HEADER	119
+
+/*
+ * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
+ * (see Doug Ambrisko's FreeBSD patches).
+ */
+#define DLT_AIRONET_HEADER	120
+
+/*
+ * Reserved for Siemens HiPath HDLC.
+ */
+#define DLT_HHDLC		121
+
+/*
+ * This is for RFC 2625 IP-over-Fibre Channel.
+ *
+ * This is not for use with raw Fibre Channel, where the link-layer
+ * header starts with a Fibre Channel frame header; it's for IP-over-FC,
+ * where the link-layer header starts with an RFC 2625 Network_Header
+ * field.
+ */
+#define DLT_IP_OVER_FC		122
+
+/*
+ * This is for Full Frontal ATM on Solaris with SunATM, with a
+ * pseudo-header followed by an AALn PDU.
+ *
+ * There may be other forms of Full Frontal ATM on other OSes,
+ * with different pseudo-headers.
+ *
+ * If ATM software returns a pseudo-header with VPI/VCI information
+ * (and, ideally, packet type information, e.g. signalling, ILMI,
+ * LANE, LLC-multiplexed traffic, etc.), it should not use
+ * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
+ * and the like don't have to infer the presence or absence of a
+ * pseudo-header and the form of the pseudo-header.
+ */
+#define DLT_SUNATM		123	/* Solaris+SunATM */
+
+/* 
+ * Reserved as per request from Kent Dahlgren <kent@praesum.com>
+ * for private use.
+ */
+#define DLT_RIO                 124     /* RapidIO */
+#define DLT_PCI_EXP             125     /* PCI Express */
+#define DLT_AURORA              126     /* Xilinx Aurora link layer */
+
+/*
+ * Header for 802.11 plus a number of bits of link-layer information
+ * including radio information, used by some recent BSD drivers as
+ * well as the madwifi Atheros driver for Linux.
+ */
+#define DLT_IEEE802_11_RADIO	127	/* 802.11 plus radiotap radio header */
+
+/*
+ * Reserved for the TZSP encapsulation, as per request from
+ * Chris Waters <chris.waters@networkchemistry.com>
+ * TZSP is a generic encapsulation for any other link type,
+ * which includes a means to include meta-information
+ * with the packet, e.g. signal strength and channel
+ * for 802.11 packets.
+ */
+#define DLT_TZSP                128     /* Tazmen Sniffer Protocol */
+
+/*
+ * BSD's ARCNET headers have the source host, destination host,
+ * and type at the beginning of the packet; that's what's handed
+ * up to userland via BPF.
+ *
+ * Linux's ARCNET headers, however, have a 2-byte offset field
+ * between the host IDs and the type; that's what's handed up
+ * to userland via PF_PACKET sockets.
+ *
+ * We therefore have to have separate DLT_ values for them.
+ */
+#define DLT_ARCNET_LINUX	129	/* ARCNET */
+
+/*
+ * Juniper-private data link types, as per request from
+ * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
+ * for passing on chassis-internal metainformation such as
+ * QOS profiles, etc..
+ */
+#define DLT_JUNIPER_MLPPP       130
+#define DLT_JUNIPER_MLFR        131
+#define DLT_JUNIPER_ES          132
+#define DLT_JUNIPER_GGSN        133
+#define DLT_JUNIPER_MFR         134
+#define DLT_JUNIPER_ATM2        135
+#define DLT_JUNIPER_SERVICES    136
+#define DLT_JUNIPER_ATM1        137
+
+/*
+ * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
+ * <dieter@apple.com>.  The header that's presented is an Ethernet-like
+ * header:
+ *
+ *	#define FIREWIRE_EUI64_LEN	8
+ *	struct firewire_header {
+ *		u_char  firewire_dhost[FIREWIRE_EUI64_LEN];
+ *		u_char  firewire_shost[FIREWIRE_EUI64_LEN];
+ *		u_short firewire_type;
+ *	};
+ *
+ * with "firewire_type" being an Ethernet type value, rather than,
+ * for example, raw GASP frames being handed up.
+ */
+#define DLT_APPLE_IP_OVER_IEEE1394	138
+
+/*
+ * Various SS7 encapsulations, as per a request from Jeff Morriss
+ * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
+ */
+#define DLT_MTP2_WITH_PHDR	139	/* pseudo-header with various info, followed by MTP2 */
+#define DLT_MTP2		140	/* MTP2, without pseudo-header */
+#define DLT_MTP3		141	/* MTP3, without pseudo-header or MTP2 */
+#define DLT_SCCP		142	/* SCCP, without pseudo-header or MTP2 or MTP3 */
+
+/*
+ * DOCSIS MAC frames.
+ */
+#define DLT_DOCSIS		143
+
+/*
+ * Linux-IrDA packets. Protocol defined at http://www.irda.org.
+ * Those packets include IrLAP headers and above (IrLMP...), but
+ * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
+ * framing can be handled by the hardware and depend on the bitrate.
+ * This is exactly the format you would get capturing on a Linux-IrDA
+ * interface (irdaX), but not on a raw serial port.
+ * Note the capture is done in "Linux-cooked" mode, so each packet include
+ * a fake packet header (struct sll_header). This is because IrDA packet
+ * decoding is dependant on the direction of the packet (incomming or
+ * outgoing).
+ * When/if other platform implement IrDA capture, we may revisit the
+ * issue and define a real DLT_IRDA...
+ * Jean II
+ */
+#define DLT_LINUX_IRDA		144
+
+/*
+ * Reserved for IBM SP switch and IBM Next Federation switch.
+ */
+#define DLT_IBM_SP		145
+#define DLT_IBM_SN		146
+
+/*
+ * Reserved for private use.  If you have some link-layer header type
+ * that you want to use within your organization, with the capture files
+ * using that link-layer header type not ever be sent outside your
+ * organization, you can use these values.
+ *
+ * No libpcap release will use these for any purpose, nor will any
+ * tcpdump release use them, either.
+ *
+ * Do *NOT* use these in capture files that you expect anybody not using
+ * your private versions of capture-file-reading tools to read; in
+ * particular, do *NOT* use them in products, otherwise you may find that
+ * people won't be able to use tcpdump, or snort, or Ethereal, or... to
+ * read capture files from your firewall/intrusion detection/traffic
+ * monitoring/etc. appliance, or whatever product uses that DLT_ value,
+ * and you may also find that the developers of those applications will
+ * not accept patches to let them read those files.
+ *
+ * Also, do not use them if somebody might send you a capture using them
+ * for *their* private type and tools using them for *your* private type
+ * would have to read them.
+ *
+ * Instead, ask "tcpdump-workers@lists.tcpdump.org" for a new DLT_ value,
+ * as per the comment above, and use the type you're given.
+ */
+#define DLT_USER0		147
+#define DLT_USER1		148
+#define DLT_USER2		149
+#define DLT_USER3		150
+#define DLT_USER4		151
+#define DLT_USER5		152
+#define DLT_USER6		153
+#define DLT_USER7		154
+#define DLT_USER8		155
+#define DLT_USER9		156
+#define DLT_USER10		157
+#define DLT_USER11		158
+#define DLT_USER12		159
+#define DLT_USER13		160
+#define DLT_USER14		161
+#define DLT_USER15		162
+
+/*
+ * For future use with 802.11 captures - defined by AbsoluteValue
+ * Systems to store a number of bits of link-layer information
+ * including radio information:
+ *
+ *	http://www.shaftnet.org/~pizza/software/capturefrm.txt
+ *
+ * but it might be used by some non-AVS drivers now or in the
+ * future.
+ */
+#define DLT_IEEE802_11_RADIO_AVS 163	/* 802.11 plus AVS radio header */
+
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
+ * for passing on chassis-internal metainformation such as
+ * QOS profiles, etc..
+ */
+#define DLT_JUNIPER_MONITOR     164
+
+/*
+ * Reserved for BACnet MS/TP.
+ */
+#define DLT_BACNET_MS_TP	165
+
+/*
+ * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
+ *
+ * This is used in some OSes to allow a kernel socket filter to distinguish
+ * between incoming and outgoing packets, on a socket intended to
+ * supply pppd with outgoing packets so it can do dial-on-demand and
+ * hangup-on-lack-of-demand; incoming packets are filtered out so they
+ * don't cause pppd to hold the connection up (you don't want random
+ * input packets such as port scans, packets from old lost connections,
+ * etc. to force the connection to stay up).
+ *
+ * The first byte of the PPP header (0xff03) is modified to accomodate
+ * the direction - 0x00 = IN, 0x01 = OUT.
+ */
+#define DLT_PPP_PPPD		166
+
+/*
+ * Names for backwards compatibility with older versions of some PPP
+ * software; new software should use DLT_PPP_PPPD.
+ */
+#define DLT_PPP_WITH_DIRECTION	DLT_PPP_PPPD
+#define DLT_LINUX_PPP_WITHDIRECTION	DLT_PPP_PPPD
+
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
+ * for passing on chassis-internal metainformation such as
+ * QOS profiles, cookies, etc..
+ */
+#define DLT_JUNIPER_PPPOE       167
+#define DLT_JUNIPER_PPPOE_ATM   168
+
+#define DLT_GPRS_LLC		169	/* GPRS LLC */
+#define DLT_GPF_T		170	/* GPF-T (ITU-T G.7041/Y.1303) */
+#define DLT_GPF_F		171	/* GPF-F (ITU-T G.7041/Y.1303) */
+
+/*
+ * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
+ * monitoring equipment.
+ */
+#define DLT_GCOM_T1E1		172
+#define DLT_GCOM_SERIAL		173
+
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>.  The DLT_ is used
+ * for internal communication to Physical Interface Cards (PIC)
+ */
+#define DLT_JUNIPER_PIC_PEER    174
+
+/*
+ * Link types requested by Gregor Maier <gregor@endace.com> of Endace
+ * Measurement Systems.  They add an ERF header (see
+ * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
+ * the link-layer header.
+ */
+#define DLT_ERF_ETH		175	/* Ethernet */
+#define DLT_ERF_POS		176	/* Packet-over-SONET */
+
+/*
+ * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
+ * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
+ * includes additional information before the LAPD header, so it's
+ * not necessarily a generic LAPD header.
+ */
+#define DLT_LINUX_LAPD		177
+
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>. 
+ * The DLT_ are used for prepending meta-information
+ * like interface index, interface name
+ * before standard Ethernet, PPP, Frelay & C-HDLC Frames
+ */
+#define DLT_JUNIPER_ETHER       178
+#define DLT_JUNIPER_PPP         179
+#define DLT_JUNIPER_FRELAY      180
+#define DLT_JUNIPER_CHDLC       181
+
+/*
+ * Multi Link Frame Relay (FRF.16)
+ */
+#define DLT_MFR                 182
+
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>. 
+ * The DLT_ is used for internal communication with a
+ * voice Adapter Card (PIC)
+ */
+#define DLT_JUNIPER_VP          183
+
+/*
+ * Arinc 429 frames.
+ * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
+ * Every frame contains a 32bit A429 label.
+ * More documentation on Arinc 429 can be found at
+ * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
+ */
+#define DLT_A429                184
+
+/*
+ * Arinc 653 Interpartition Communication messages.
+ * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
+ * Please refer to the A653-1 standard for more information.
+ */
+#define DLT_A653_ICM            185
+
+/*
+ * USB packets, beginning with a USB setup header; requested by
+ * Paolo Abeni <paolo.abeni@email.it>.
+ */
+#define DLT_USB			186
+
+/*
+ * Bluetooth HCI UART transport layer (part H:4); requested by
+ * Paolo Abeni.
+ */
+#define DLT_BLUETOOTH_HCI_H4	187
+
+/*
+ * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
+ * <cruz_petagay@bah.com>.
+ */
+#define DLT_IEEE802_16_MAC_CPS	188
+
+/*
+ * USB packets, beginning with a Linux USB header; requested by
+ * Paolo Abeni <paolo.abeni@email.it>.
+ */
+#define DLT_USB_LINUX		189
+
+/*
+ * Controller Area Network (CAN) v. 2.0B packets.
+ * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
+ * Used to dump CAN packets coming from a CAN Vector board.
+ * More documentation on the CAN v2.0B frames can be found at
+ * http://www.can-cia.org/downloads/?269
+ */
+#define DLT_CAN20B              190
+
+/*
+ * IEEE 802.15.4, with address fields padded, as is done by Linux
+ * drivers; requested by Juergen Schimmer.
+ */
+#define DLT_IEEE802_15_4_LINUX	191
+
+/*
+ * Per Packet Information encapsulated packets.
+ * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
+ */
+#define DLT_PPI			192
+
+/*
+ * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
+ * requested by Charles Clancy.
+ */
+#define DLT_IEEE802_16_MAC_CPS_RADIO	193
+
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>. 
+ * The DLT_ is used for internal communication with a
+ * integrated service module (ISM).
+ */
+#define DLT_JUNIPER_ISM         194
+
+/*
+ * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
+ * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
+ */
+#define DLT_IEEE802_15_4	195
+
+/*
+ * Various link-layer types, with a pseudo-header, for SITA
+ * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
+ */
+#define DLT_SITA		196
+
+/*
+ * Various link-layer types, with a pseudo-header, for Endace DAG cards;
+ * encapsulates Endace ERF records.  Requested by Stephen Donnelly
+ * <stephen@endace.com>.
+ */
+#define DLT_ERF			197
+
+/*
+ * Special header prepended to Ethernet packets when capturing from a
+ * u10 Networks board.  Requested by Phil Mulholland
+ * <phil@u10networks.com>.
+ */
+#define DLT_RAIF1		198
+
+/*
+ * IPMB packet for IPMI, beginning with the I2C slave address, followed
+ * by the netFn and LUN, etc..  Requested by Chanthy Toeung
+ * <chanthy.toeung@ca.kontron.com>.
+ */
+#define DLT_IPMB		199
+
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>. 
+ * The DLT_ is used for capturing data on a secure tunnel interface.
+ */
+#define DLT_JUNIPER_ST          200
+
+/*
+ * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
+ * that includes direction information; requested by Paolo Abeni.
+ */
+#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR	201
+
+/*
+ * AX.25 packet with a 1-byte KISS header; see
+ *
+ *	http://www.ax25.net/kiss.htm
+ *
+ * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
+ */
+#define DLT_AX25_KISS		202
+
+/*
+ * LAPD packets from an ISDN channel, starting with the address field,
+ * with no pseudo-header.
+ * Requested by Varuna De Silva <varunax@gmail.com>.
+ */
+#define DLT_LAPD		203
+
+/*
+ * Variants of various link-layer headers, with a one-byte direction
+ * pseudo-header prepended - zero means "received by this host",
+ * non-zero (any non-zero value) means "sent by this host" - as per
+ * Will Barker <w.barker@zen.co.uk>.
+ */
+#define DLT_PPP_WITH_DIR	204	/* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
+#define DLT_C_HDLC_WITH_DIR	205	/* Cisco HDLC */
+#define DLT_FRELAY_WITH_DIR	206	/* Frame Relay */
+#define DLT_LAPB_WITH_DIR	207	/* LAPB */
+
+/*
+ * 208 is reserved for an as-yet-unspecified proprietary link-layer
+ * type, as requested by Will Barker.
+ */
+
+/*
+ * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
+ * <avn@pigeonpoint.com>.
+ */
+#define DLT_IPMB_LINUX		209
+
+/*
+ * FlexRay automotive bus - http://www.flexray.com/ - as requested
+ * by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define DLT_FLEXRAY		210
+
+/*
+ * Media Oriented Systems Transport (MOST) bus for multimedia
+ * transport - http://www.mostcooperation.com/ - as requested
+ * by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define DLT_MOST		211
+
+/*
+ * Local Interconnect Network (LIN) bus for vehicle networks -
+ * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
+ * <hannes.kaelber@x2e.de>.
+ */
+#define DLT_LIN			212
+
+/*
+ * X2E-private data link type used for serial line capture,
+ * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define DLT_X2E_SERIAL		213
+
+/*
+ * X2E-private data link type used for the Xoraya data logger
+ * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define DLT_X2E_XORAYA		214
+
+/*
+ * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
+ * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
+ * of 0 as preamble, one octet of SFD, one octet of frame length+
+ * reserved bit, and then the MAC-layer data, starting with the
+ * frame control field).
+ *
+ * Requested by Max Filippov <jcmvbkbc@gmail.com>.
+ */
+#define DLT_IEEE802_15_4_NONASK_PHY	215
+
+
+/*
+ * DLT and savefile link type values are split into a class and
+ * a member of that class.  A class value of 0 indicates a regular
+ * DLT_/LINKTYPE_ value.
+ */
+#define DLT_CLASS(x)		((x) & 0x03ff0000)
+
+/*
+ * NetBSD-specific generic "raw" link type.  The class value indicates
+ * that this is the generic raw type, and the lower 16 bits are the
+ * address family we're dealing with.  Those values are NetBSD-specific;
+ * do not assume that they correspond to AF_ values for your operating
+ * system.
+ */
+#define	DLT_CLASS_NETBSD_RAWAF	0x02240000
+#define	DLT_NETBSD_RAWAF(af)	(DLT_CLASS_NETBSD_RAWAF | (af))
+#define	DLT_NETBSD_RAWAF_AF(x)	((x) & 0x0000ffff)
+#define	DLT_IS_NETBSD_RAWAF(x)	(DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF)
+
+
+/*
+ * The instruction encodings.
+ */
+/* instruction classes */
+#define BPF_CLASS(code) ((code) & 0x07)
+#define		BPF_LD		0x00
+#define		BPF_LDX		0x01
+#define		BPF_ST		0x02
+#define		BPF_STX		0x03
+#define		BPF_ALU		0x04
+#define		BPF_JMP		0x05
+#define		BPF_RET		0x06
+#define		BPF_MISC	0x07
+
+/* ld/ldx fields */
+#define BPF_SIZE(code)	((code) & 0x18)
+#define		BPF_W		0x00
+#define		BPF_H		0x08
+#define		BPF_B		0x10
+#define BPF_MODE(code)	((code) & 0xe0)
+#define		BPF_IMM 	0x00
+#define		BPF_ABS		0x20
+#define		BPF_IND		0x40
+#define		BPF_MEM		0x60
+#define		BPF_LEN		0x80
+#define		BPF_MSH		0xa0
+
+/* alu/jmp fields */
+#define BPF_OP(code)	((code) & 0xf0)
+#define		BPF_ADD		0x00
+#define		BPF_SUB		0x10
+#define		BPF_MUL		0x20
+#define		BPF_DIV		0x30
+#define		BPF_OR		0x40
+#define		BPF_AND		0x50
+#define		BPF_LSH		0x60
+#define		BPF_RSH		0x70
+#define		BPF_NEG		0x80
+#define		BPF_JA		0x00
+#define		BPF_JEQ		0x10
+#define		BPF_JGT		0x20
+#define		BPF_JGE		0x30
+#define		BPF_JSET	0x40
+#define BPF_SRC(code)	((code) & 0x08)
+#define		BPF_K		0x00
+#define		BPF_X		0x08
+
+/* ret - BPF_K and BPF_X also apply */
+#define BPF_RVAL(code)	((code) & 0x18)
+#define		BPF_A		0x10
+
+/* misc */
+#define BPF_MISCOP(code) ((code) & 0xf8)
+#define		BPF_TAX		0x00
+#define		BPF_TXA		0x80
+
+/*
+ * The instruction data structure.
+ */
+struct bpf_insn {
+	u_short	code;
+	u_char 	jt;
+	u_char 	jf;
+	bpf_u_int32 k;
+};
+
+/*
+ * Macros for insn array initializers.
+ */
+#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
+#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
+
+#if __STDC__ || defined(__cplusplus)
+extern int bpf_validate(const struct bpf_insn *, int);
+extern u_int bpf_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
+#else
+extern int bpf_validate();
+extern u_int bpf_filter();
+#endif
+
+/*
+ * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
+ */
+#define BPF_MEMWORDS 16
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/contrib/libpcap/pcap/namedb.h b/contrib/libpcap/pcap/namedb.h
new file mode 100644
index 0000000..9002c75
--- /dev/null
+++ b/contrib/libpcap/pcap/namedb.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 1994, 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by the Computer Systems
+ *	Engineering Group at Lawrence Berkeley Laboratory.
+ * 4. Neither the name of the University nor of the Laboratory may be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap/namedb.h,v 1.1 2006/10/04 18:09:22 guy Exp $ (LBL)
+ */
+
+#ifndef lib_pcap_namedb_h
+#define lib_pcap_namedb_h
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * As returned by the pcap_next_etherent()
+ * XXX this stuff doesn't belong in this interface, but this
+ * library already must do name to address translation, so
+ * on systems that don't have support for /etc/ethers, we
+ * export these hooks since they'll
+ */
+struct pcap_etherent {
+	u_char addr[6];
+	char name[122];
+};
+#ifndef PCAP_ETHERS_FILE
+#define PCAP_ETHERS_FILE "/etc/ethers"
+#endif
+struct	pcap_etherent *pcap_next_etherent(FILE *);
+u_char *pcap_ether_hostton(const char*);
+u_char *pcap_ether_aton(const char *);
+
+bpf_u_int32 **pcap_nametoaddr(const char *);
+#ifdef INET6
+struct addrinfo *pcap_nametoaddrinfo(const char *);
+#endif
+bpf_u_int32 pcap_nametonetaddr(const char *);
+
+int	pcap_nametoport(const char *, int *, int *);
+int	pcap_nametoportrange(const char *, int *, int *, int *);
+int	pcap_nametoproto(const char *);
+int	pcap_nametoeproto(const char *);
+int	pcap_nametollc(const char *);
+/*
+ * If a protocol is unknown, PROTO_UNDEF is returned.
+ * Also, pcap_nametoport() returns the protocol along with the port number.
+ * If there are ambiguous entried in /etc/services (i.e. domain
+ * can be either tcp or udp) PROTO_UNDEF is returned.
+ */
+#define PROTO_UNDEF		-1
+
+/* XXX move these to pcap-int.h? */
+int __pcap_atodn(const char *, bpf_u_int32 *);
+int __pcap_atoin(const char *, bpf_u_int32 *);
+u_short	__pcap_nametodnaddr(const char *);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/contrib/libpcap/pcap1.h b/contrib/libpcap/pcap/pcap.h
index 08d0c5a..ea18edcf 100644
--- a/contrib/libpcap/pcap1.h
+++ b/contrib/libpcap/pcap/pcap.h
@@ -31,21 +31,24 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * @(#) $Header: /tcpdump/master/libpcap/pcap1.h,v 1.2 2004/03/30 14:42:50 mcr Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap/pcap.h,v 1.4.2.11 2008-10-06 15:38:39 gianluca Exp $ (LBL)
  */
 
-#ifndef lib_pcap_h
-#define lib_pcap_h
+#ifndef lib_pcap_pcap_h
+#define lib_pcap_pcap_h
 
-#ifdef WIN32
-#include <pcap-stdinc.h>
-#else /* WIN32 */
-#include <sys/types.h>
-#include <sys/time.h>
-#endif /* WIN32 */
+#if defined(WIN32)
+  #include <pcap-stdinc.h>
+#elif defined(MSDOS)
+  #include <sys/types.h>
+  #include <sys/socket.h>  /* u_int, u_char etc. */
+#else /* UN*X */
+  #include <sys/types.h>
+  #include <sys/time.h>
+#endif /* WIN32/MSDOS/UN*X */
 
 #ifndef PCAP_DONT_INCLUDE_PCAP_BPF_H
-#include <pcap-bpf.h>
+#include <pcap/bpf.h>
 #endif
 
 #include <stdio.h>
@@ -54,8 +57,8 @@
 extern "C" {
 #endif
 
-#define PCAP_VERSION_MAJOR 3
-#define PCAP_VERSION_MINOR 0
+#define PCAP_VERSION_MAJOR 2
+#define PCAP_VERSION_MINOR 4
 
 #define PCAP_ERRBUF_SIZE 256
 
@@ -92,8 +95,8 @@ typedef struct pcap_addr pcap_addr_t;
  *	introduce a new structure for the new format, if the layout
  *	of the structure changed;
  *
- *	send mail to "tcpdump-workers@tcpdump.org", requesting a new
- *	magic number for your new capture file format, and, when
+ *	send mail to "tcpdump-workers@lists.tcpdump.org", requesting
+ *	a new magic number for your new capture file format, and, when
  *	you get the new magic number, put it in "savefile.c";
  *
  *	use that magic number for save files with the changed file
@@ -103,75 +106,56 @@ typedef struct pcap_addr pcap_addr_t;
  *	the old file header as well as files with the new file header
  *	(using the magic number to determine the header format).
  *
- * Then supply the changes to "patches@tcpdump.org", so that future
- * versions of libpcap and programs that use it (such as tcpdump) will
- * be able to read your new capture file format.
+ * Then supply the changes as a patch at
+ *
+ *	http://sourceforge.net/projects/libpcap/
+ *
+ * so that future versions of libpcap and programs that use it (such as
+ * tcpdump) will be able to read your new capture file format.
  */
-
-enum pcap1_info_types {
-        PCAP_DATACAPTURE,
-	PCAP_TIMESTAMP,
-	PCAP_WALLTIME,
-	PCAP_TIMESKEW,
-	PCAP_PROBEPLACE,              /* aka direction */
-	PCAP_COMMENT,                 /* comment */
-};
-
-struct pcap1_info_container {
-	bpf_u_int32 info_len;         /* in bytes */
-	bpf_u_int32 info_type;        /* enum pcap1_info_types */
-	unsigned char info_data[0];
-};
-
-struct pcap1_info_timestamp {
-	struct pcap1_info_container pic;
-	bpf_u_int32    nanoseconds;   /* 10^-9 of seconds */
-	bpf_u_int32    seconds;       /* seconds since Unix epoch - GMT */
-	bpf_u_int16    macroseconds;  /* 16 bits more of MSB of time */
-	bpf_u_int16    sigfigs;	      /* accuracy of timestamps - LSB bits */
-};	
-	
-struct pcap1_info_packet {
-	struct pcap1_info_container pic;
-	bpf_u_int32 caplen;	/* length of portion present */
-	bpf_u_int32 len;	/* length this packet (off wire) */
+struct pcap_file_header {
+	bpf_u_int32 magic;
+	u_short version_major;
+	u_short version_minor;
+	bpf_int32 thiszone;	/* gmt to local correction */
+	bpf_u_int32 sigfigs;	/* accuracy of timestamps */
+	bpf_u_int32 snaplen;	/* max length saved portion of each pkt */
 	bpf_u_int32 linktype;	/* data link type (LINKTYPE_*) */
-	bpf_u_int32 ifIndex;	/* abstracted interface index */
-	unsigned char packet_data[0];
-};	
-
-enum pcap1_probe {
-	INBOUND  =1,
-	OUTBOUND =2,
-	FORWARD  =3,
-	PREENCAP =4,
-	POSTDECAP=5,
 };
 
-struct pcap1_info_probe {
-	struct pcap1_info_container pic;
-	bpf_u_int32                 probeloc;   /* enum pcap1_probe */
-        unsigned char               probe_desc[0];
-};
-	
-struct pcap1_info_comment {
-	struct pcap1_info_container pic;
-        unsigned char               comment[0];
-};
-	
-struct pcap1_packet_header {
-	bpf_u_int32 magic;
-	u_short     version_major;
-	u_short     version_minor;
-        bpf_u_int32 block_len;
-	struct pcap1_info_container pics[0];
-};
+/*
+ * Macros for the value returned by pcap_datalink_ext().
+ * 
+ * If LT_FCS_LENGTH_PRESENT(x) is true, the LT_FCS_LENGTH(x) macro
+ * gives the FCS length of packets in the capture.
+ */
+#define LT_FCS_LENGTH_PRESENT(x)	((x) & 0x04000000)
+#define LT_FCS_LENGTH(x)		(((x) & 0xF0000000) >> 28)
+#define LT_FCS_DATALINK_EXT(x)		((((x) & 0xF) << 28) | 0x04000000)
+
+typedef enum {
+       PCAP_D_INOUT = 0,
+       PCAP_D_IN,
+       PCAP_D_OUT
+} pcap_direction_t;
 
 /*
- * Each packet in the dump file is prepended with this generic header.
- * This gets around the problem of different headers for different
- * packet interfaces.
+ * Generic per-packet information, as supplied by libpcap.
+ *
+ * The time stamp can and should be a "struct timeval", regardless of
+ * whether your system supports 32-bit tv_sec in "struct timeval",
+ * 64-bit tv_sec in "struct timeval", or both if it supports both 32-bit
+ * and 64-bit applications.  The on-disk format of savefiles uses 32-bit
+ * tv_sec (and tv_usec); this structure is irrelevant to that.  32-bit
+ * and 64-bit versions of libpcap, even if they're on the same platform,
+ * should supply the appropriate version of "struct timeval", even if
+ * that's not what the underlying packet capture mechanism supplies.
  */
+struct pcap_pkthdr {
+	struct timeval ts;	/* time stamp */
+	bpf_u_int32 caplen;	/* length of portion present */
+	bpf_u_int32 len;	/* length this packet (off wire) */
+};
 
 /*
  * As returned by the pcap_stats()
@@ -185,6 +169,39 @@ struct pcap_stat {
 #endif /* WIN32 */
 };
 
+#ifdef MSDOS
+/*
+ * As returned by the pcap_stats_ex()
+ */
+struct pcap_stat_ex {
+       u_long  rx_packets;        /* total packets received       */
+       u_long  tx_packets;        /* total packets transmitted    */
+       u_long  rx_bytes;          /* total bytes received         */
+       u_long  tx_bytes;          /* total bytes transmitted      */
+       u_long  rx_errors;         /* bad packets received         */
+       u_long  tx_errors;         /* packet transmit problems     */
+       u_long  rx_dropped;        /* no space in Rx buffers       */
+       u_long  tx_dropped;        /* no space available for Tx    */
+       u_long  multicast;         /* multicast packets received   */
+       u_long  collisions;
+
+       /* detailed rx_errors: */
+       u_long  rx_length_errors;
+       u_long  rx_over_errors;    /* receiver ring buff overflow  */
+       u_long  rx_crc_errors;     /* recv'd pkt with crc error    */
+       u_long  rx_frame_errors;   /* recv'd frame alignment error */
+       u_long  rx_fifo_errors;    /* recv'r fifo overrun          */
+       u_long  rx_missed_errors;  /* recv'r missed packet         */
+
+       /* detailed tx_errors */
+       u_long  tx_aborted_errors;
+       u_long  tx_carrier_errors;
+       u_long  tx_fifo_errors;
+       u_long  tx_heartbeat_errors;
+       u_long  tx_window_errors;
+     };
+#endif
+
 /*
  * Item in a list of interfaces.
  */
@@ -212,11 +229,57 @@ struct pcap_addr {
 typedef void (*pcap_handler)(u_char *, const struct pcap_pkthdr *,
 			     const u_char *);
 
+/*
+ * Error codes for the pcap API.
+ * These will all be negative, so you can check for the success or
+ * failure of a call that returns these codes by checking for a
+ * negative value.
+ */
+#define PCAP_ERROR			-1	/* generic error code */
+#define PCAP_ERROR_BREAK		-2	/* loop terminated by pcap_breakloop */
+#define PCAP_ERROR_NOT_ACTIVATED	-3	/* the capture needs to be activated */
+#define PCAP_ERROR_ACTIVATED		-4	/* the operation can't be performed on already activated captures */
+#define PCAP_ERROR_NO_SUCH_DEVICE	-5	/* no such device exists */
+#define PCAP_ERROR_RFMON_NOTSUP		-6	/* this device doesn't support rfmon (monitor) mode */
+#define PCAP_ERROR_NOT_RFMON		-7	/* operation supported only in monitor mode */
+#define PCAP_ERROR_PERM_DENIED		-8	/* no permission to open the device */
+#define PCAP_ERROR_IFACE_NOT_UP		-9	/* interface isn't up */
+
+/*
+ * Warning codes for the pcap API.
+ * These will all be positive and non-zero, so they won't look like
+ * errors.
+ */
+#define PCAP_WARNING			1	/* generic warning code */
+#define PCAP_WARNING_PROMISC_NOTSUP	2	/* this device doesn't support promiscuous mode */
+
 char	*pcap_lookupdev(char *);
 int	pcap_lookupnet(const char *, bpf_u_int32 *, bpf_u_int32 *, char *);
+
+pcap_t	*pcap_create(const char *, char *);
+int	pcap_set_snaplen(pcap_t *, int);
+int	pcap_set_promisc(pcap_t *, int);
+int	pcap_can_set_rfmon(pcap_t *);
+int	pcap_set_rfmon(pcap_t *, int);
+int	pcap_set_timeout(pcap_t *, int);
+int	pcap_set_buffer_size(pcap_t *, int);
+int	pcap_activate(pcap_t *);
+
 pcap_t	*pcap_open_live(const char *, int, int, int, char *);
 pcap_t	*pcap_open_dead(int, int);
 pcap_t	*pcap_open_offline(const char *, char *);
+#if defined(WIN32)
+pcap_t  *pcap_hopen_offline(intptr_t, char *);
+#if !defined(LIBPCAP_EXPORTS)
+#define pcap_fopen_offline(f,b) \
+	pcap_hopen_offline(_get_osfhandle(_fileno(f)), b)
+#else /*LIBPCAP_EXPORTS*/
+static pcap_t *pcap_fopen_offline(FILE *, char *);
+#endif
+#else /*WIN32*/
+pcap_t	*pcap_fopen_offline(FILE *, char *);
+#endif /*WIN32*/
+
 void	pcap_close(pcap_t *);
 int	pcap_loop(pcap_t *, int, pcap_handler, u_char *);
 int	pcap_dispatch(pcap_t *, int, pcap_handler, u_char *);
@@ -226,19 +289,27 @@ int 	pcap_next_ex(pcap_t *, struct pcap_pkthdr **, const u_char **);
 void	pcap_breakloop(pcap_t *);
 int	pcap_stats(pcap_t *, struct pcap_stat *);
 int	pcap_setfilter(pcap_t *, struct bpf_program *);
+int 	pcap_setdirection(pcap_t *, pcap_direction_t);
 int	pcap_getnonblock(pcap_t *, char *);
 int	pcap_setnonblock(pcap_t *, int, char *);
-void	pcap_perror(pcap_t *, char *);
-char	*pcap_strerror(int);
+int	pcap_inject(pcap_t *, const void *, size_t);
+int	pcap_sendpacket(pcap_t *, const u_char *, int);
+const char *pcap_statustostr(int);
+const char *pcap_strerror(int);
 char	*pcap_geterr(pcap_t *);
-int	pcap_compile(pcap_t *, struct bpf_program *, char *, int,
+void	pcap_perror(pcap_t *, char *);
+int	pcap_compile(pcap_t *, struct bpf_program *, const char *, int,
 	    bpf_u_int32);
 int	pcap_compile_nopcap(int, int, struct bpf_program *,
-	    char *, int, bpf_u_int32);
+	    const char *, int, bpf_u_int32);
 void	pcap_freecode(struct bpf_program *);
+int	pcap_offline_filter(struct bpf_program *, const struct pcap_pkthdr *,
+	    const u_char *);
 int	pcap_datalink(pcap_t *);
+int	pcap_datalink_ext(pcap_t *);
 int	pcap_list_datalinks(pcap_t *, int **);
 int	pcap_set_datalink(pcap_t *, int);
+void	pcap_free_datalinks(int *);
 int	pcap_datalink_name_to_val(const char *);
 const char *pcap_datalink_val_to_name(int);
 const char *pcap_datalink_val_to_description(int);
@@ -252,10 +323,12 @@ FILE	*pcap_file(pcap_t *);
 int	pcap_fileno(pcap_t *);
 
 pcap_dumper_t *pcap_dump_open(pcap_t *, const char *);
+pcap_dumper_t *pcap_dump_fopen(pcap_t *, FILE *fp);
+FILE	*pcap_dump_file(pcap_dumper_t *);
+long	pcap_dump_ftell(pcap_dumper_t *);
 int	pcap_dump_flush(pcap_dumper_t *);
 void	pcap_dump_close(pcap_dumper_t *);
 void	pcap_dump(u_char *, const struct pcap_pkthdr *, const u_char *);
-FILE	*pcap_dump_file(pcap_dumper_t *);
 
 int	pcap_findalldevs(pcap_if_t **, char *);
 void	pcap_freealldevs(pcap_if_t *);
@@ -263,37 +336,49 @@ void	pcap_freealldevs(pcap_if_t *);
 const char *pcap_lib_version(void);
 
 /* XXX this guy lives in the bpf tree */
-u_int	bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
-int	bpf_validate(struct bpf_insn *f, int len);
-char	*bpf_image(struct bpf_insn *, int);
-void	bpf_dump(struct bpf_program *, int);
+u_int	bpf_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
+int	bpf_validate(const struct bpf_insn *f, int len);
+char	*bpf_image(const struct bpf_insn *, int);
+void	bpf_dump(const struct bpf_program *, int);
+
+#if defined(WIN32)
 
-#ifdef WIN32
 /*
  * Win32 definitions
  */
 
 int pcap_setbuff(pcap_t *p, int dim);
 int pcap_setmode(pcap_t *p, int mode);
-int pcap_sendpacket(pcap_t *p, u_char *buf, int size);
 int pcap_setmintocopy(pcap_t *p, int size);
 
 #ifdef WPCAP
 /* Include file with the wpcap-specific extensions */
 #include <Win32-Extensions.h>
-#endif
+#endif /* WPCAP */
 
 #define MODE_CAPT 0
 #define MODE_STAT 1
+#define MODE_MON 2
+
+#elif defined(MSDOS)
+
+/*
+ * MS-DOS definitions
+ */
+
+int  pcap_stats_ex (pcap_t *, struct pcap_stat_ex *);
+void pcap_set_wait (pcap_t *p, void (*yield)(void), int wait);
+u_long pcap_mac_packets (void);
+
+#else /* UN*X */
 
-#else
 /*
  * UN*X definitions
  */
 
 int	pcap_get_selectable_fd(pcap_t *);
 
-#endif /* WIN32 */
+#endif /* WIN32/MSDOS/UN*X */
 
 #ifdef __cplusplus
 }
diff --git a/contrib/libpcap/sll.h b/contrib/libpcap/pcap/sll.h
index 85a3a9d..e9d5452 100644
--- a/contrib/libpcap/sll.h
+++ b/contrib/libpcap/pcap/sll.h
@@ -35,7 +35,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * @(#) $Header: /tcpdump/master/libpcap/sll.h,v 1.7 2002/06/11 17:04:48 itojun Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap/sll.h,v 1.2.2.1 2008-05-30 01:36:06 guy Exp $ (LBL)
  */
 
 /*
@@ -64,8 +64,8 @@
  * DO NOT change the layout of this structure, or change any of the
  * LINUX_SLL_ values below.  If you must change the link-layer header
  * for a "cooked" Linux capture, introduce a new DLT_ type (ask
- * "tcpdump-workers@tcpdump.org" for one, so that you don't give it a
- * value that collides with a value already being used), and use the
+ * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it
+ * a value that collides with a value already being used), and use the
  * new header in captures of that type, so that programs that can
  * handle DLT_LINUX_SLL captures will continue to handle them correctly
  * without any change, and so that capture files with different headers
@@ -73,6 +73,9 @@
  * packets in them.
  */
 
+#ifndef lib_pcap_sll_h
+#define lib_pcap_sll_h
+
 /*
  * A DLT_LINUX_SLL fake link-layer header.
  */
@@ -122,3 +125,5 @@ struct sll_header {
  */
 #define LINUX_SLL_P_802_3	0x0001	/* Novell 802.3 frames without 802.2 LLC header */
 #define LINUX_SLL_P_802_2	0x0004	/* 802.2 frames (not D/I/X Ethernet) */
+
+#endif
diff --git a/contrib/libpcap/pcap/usb.h b/contrib/libpcap/pcap/usb.h
new file mode 100644
index 0000000..adcd19c
--- /dev/null
+++ b/contrib/libpcap/pcap/usb.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2006 Paolo Abeni (Italy)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote 
+ * products derived from this software without specific prior written 
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * Basic USB data struct
+ * By Paolo Abeni <paolo.abeni@email.it>
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap/usb.h,v 1.6 2007/09/22 02:06:08 guy Exp $
+ */
+ 
+#ifndef _PCAP_USB_STRUCTS_H__
+#define _PCAP_USB_STRUCTS_H__
+
+/* 
+ * possible transfer mode
+ */
+#define URB_TRANSFER_IN   0x80
+#define URB_ISOCHRONOUS   0x0
+#define URB_INTERRUPT     0x1
+#define URB_CONTROL       0x2
+#define URB_BULK          0x3
+
+/*
+ * possible event type
+ */
+#define URB_SUBMIT        'S'
+#define URB_COMPLETE      'C'
+#define URB_ERROR         'E'
+
+/*
+ * USB setup header as defined in USB specification.
+ * Appears at the front of each packet in DLT_USB captures.
+ */
+typedef struct _usb_setup {
+	u_int8_t bmRequestType;
+	u_int8_t bRequest;
+	u_int16_t wValue;
+	u_int16_t wIndex;
+	u_int16_t wLength;
+} pcap_usb_setup;
+
+
+/*
+ * Header prepended by linux kernel to each event.
+ * Appears at the front of each packet in DLT_USB_LINUX captures.
+ */
+typedef struct _usb_header {
+	u_int64_t id;
+	u_int8_t event_type;
+	u_int8_t transfer_type;
+	u_int8_t endpoint_number;
+	u_int8_t device_address;
+	u_int16_t bus_id;
+	char setup_flag;/*if !=0 the urb setup header is not present*/
+	char data_flag; /*if !=0 no urb data is present*/
+	int64_t ts_sec;
+	int32_t ts_usec;
+	int32_t status;
+	u_int32_t urb_len;
+	u_int32_t data_len; /* amount of urb data really present in this event*/
+	pcap_usb_setup setup;
+} pcap_usb_header;
+
+
+#endif
diff --git a/contrib/libpcap/pcap/vlan.h b/contrib/libpcap/pcap/vlan.h
new file mode 100644
index 0000000..b0cb794
--- /dev/null
+++ b/contrib/libpcap/pcap/vlan.h
@@ -0,0 +1,46 @@
+/*-
+ * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by the University of
+ *      California, Berkeley and its contributors.
+ * 4. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * @(#) $Header: /tcpdump/master/libpcap/pcap/vlan.h,v 1.1.2.2 2008-08-06 07:45:59 guy Exp $
+ */
+
+#ifndef lib_pcap_vlan_h
+#define lib_pcap_vlan_h
+
+struct vlan_tag {
+	u_int16_t	vlan_tpid;		/* ETH_P_8021Q */
+	u_int16_t	vlan_tci;		/* VLAN TCI */
+};
+
+#define VLAN_TAG_LEN	4
+
+#endif
diff --git a/contrib/libpcap/pcap_activate.3pcap b/contrib/libpcap/pcap_activate.3pcap
new file mode 100644
index 0000000..5b19136
--- /dev/null
+++ b/contrib/libpcap/pcap_activate.3pcap
@@ -0,0 +1,89 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_activate.3pcap,v 1.1.2.5 2008-07-01 08:04:03 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_ACTIVATE 3PCAP "5 April 2008"
+.SH NAME
+pcap_activate \- activate a capture handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_activate(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_activate()
+is used to activate a packet capture handle to look
+at packets on the network, with the options that were set on the handle
+being in effect.
+.SH RETURN VALUE
+.B pcap_activate()
+returns 0 on success without warnings,
+.B PCAP_WARNING_PROMISC_NOTSUP
+on success on a device that doesn't support promiscuous mode if
+promiscuous mode was requested,
+.B PCAP_WARNING
+on success with any other warning,
+.B PCAP_ERROR_ACTIVATED
+if the handle has already been activated,
+.B PCAP_ERROR_NO_SUCH_DEVICE
+if the capture source specified when the handle was created doesn't
+exist,
+.B PCAP_ERROR_PERM_DENIED
+if the process doesn't have permission to open the capture source,
+.B PCAP_ERROR_RFMON_NOTSUP
+if monitor mode was specified but the capture source doesn't support
+monitor mode,
+.B PCAP_ERROR_IFACE_NOT_UP
+if the capture source is not up, and
+.B PCAP_ERROR
+if another error occurred.
+If
+.B PCAP_WARNING
+or
+.B PCAP_ERROR
+is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display a message describing the warning or
+error.
+If
+.BR PCAP_WARNING_PROMISC_NOTSUP ,
+.BR PCAP_ERROR_NO_SUCH_DEVICE ,
+or
+.B PCAP_ERROR_PERM_DENIED
+is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display an message giving additional details
+about the problem that might be useful for debugging the problem if it's
+unexpected.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_breakloop.3pcap b/contrib/libpcap/pcap_breakloop.3pcap
new file mode 100644
index 0000000..cf78860
--- /dev/null
+++ b/contrib/libpcap/pcap_breakloop.3pcap
@@ -0,0 +1,105 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_breakloop.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_BREAKLOOP 3PCAP "5 April 2008"
+.SH NAME
+pcap_breakloop \- force a pcap_dispatch() or pcap_loop() call to return
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+void pcap_breakloop(pcap_t *);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_breakloop()
+sets a flag that will force
+.B pcap_dispatch()
+or
+.B pcap_loop()
+to return rather than looping; they will return the number of packets
+that have been processed so far, or \-2 if no packets have been
+processed so far.
+.PP
+This routine is safe to use inside a signal handler on UNIX or a console
+control handler on Windows, as it merely sets a flag that is checked
+within the loop.
+.PP
+The flag is checked in loops reading packets from the OS - a signal by
+itself will not necessarily terminate those loops - as well as in loops
+processing a set of packets returned by the OS.
+.ft B
+Note that if you are catching signals on UNIX systems that support
+restarting system calls after a signal, and calling pcap_breakloop()
+in the signal handler, you must specify, when catching those signals,
+that system calls should NOT be restarted by that signal.  Otherwise,
+if the signal interrupted a call reading packets in a live capture,
+when your signal handler returns after calling pcap_breakloop(), the
+call will be restarted, and the loop will not terminate until more
+packets arrive and the call completes.
+.PP
+Note also that, in a multi-threaded application, if one thread is
+blocked in
+.BR pcap_dispatch() ,
+.BR pcap_loop() ,
+.BR pcap_next() ,
+or
+.BR pcap_next_ex() ,
+a call to
+.B pcap_breakloop()
+in a different thread will not unblock that thread; you will need to use
+whatever mechanism the OS provides for breaking a thread out of blocking
+calls in order to unblock the thread, such as thread cancellation in
+systems that support POSIX threads.
+.ft R
+.PP
+Note that
+.B pcap_next()
+and
+.B pcap_next_ex()
+will, on some platforms, loop reading packets from the OS; that loop
+will not necessarily be terminated by a signal, so
+.B pcap_breakloop()
+should be used to terminate packet processing even if
+.B pcap_next()
+or
+.B pcap_next_ex()
+is being used.
+.PP
+.B pcap_breakloop()
+does not guarantee that no further packets will be processed by
+.B pcap_dispatch()
+or
+.B pcap_loop()
+after it is called; at most one more packet might be processed.
+.PP
+If \-2 is returned from
+.B pcap_dispatch()
+or
+.BR pcap_loop() ,
+the flag is cleared, so a subsequent call will resume reading packets. 
+If a positive number is returned, the flag is not cleared, so a
+subsequent call will return \-2 and clear the flag.
+.SH SEE ALSO
+pcap(3PCAP), pcap_loop(3PCAP), pcap_next_ex(3PCAP)
diff --git a/contrib/libpcap/pcap_can_set_rfmon.3pcap b/contrib/libpcap/pcap_can_set_rfmon.3pcap
new file mode 100644
index 0000000..992d2c8
--- /dev/null
+++ b/contrib/libpcap/pcap_can_set_rfmon.3pcap
@@ -0,0 +1,60 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_can_set_rfmon.3pcap,v 1.1.2.1 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_CAN_SET_RFMON 3PCAP "5 April 2008"
+.SH NAME
+pcap_can_set_rfmon \- check whether monitor mode can be set for a
+not-yet-activated capture handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+int pcap_can_set_rfmon(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_can_set_rfmon()
+checks whether monitor mode could be set on a capture handle when
+the handle is activated.
+.SH RETURN VALUE
+.B pcap_set_rfmon()
+returns 0 if monitor mode could not be set,
+1 if monitor mode could be set,
+.B PCAP_ERROR_NO_SUCH_DEVICE
+if the device specified when the handle was created doesn't exist,
+.B PCAP_ERROR_ACTIVATED
+if called on a capture handle that has been activated, or
+.B PCAP_ERROR
+if an error occurred.
+If
+.B PCAP_ERROR
+is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
+pcap_set_rfmon(3PCAP)
diff --git a/contrib/libpcap/pcap_close.3pcap b/contrib/libpcap/pcap_close.3pcap
new file mode 100644
index 0000000..3d92f03
--- /dev/null
+++ b/contrib/libpcap/pcap_close.3pcap
@@ -0,0 +1,41 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_close.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_CLOSE 3PCAP "5 April 2008"
+.SH NAME
+pcap_close \- close a capture device or savefile
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+void pcap_close(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_close()
+closes the files associated with
+.I p
+and deallocates resources.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_compile.3pcap b/contrib/libpcap/pcap_compile.3pcap
new file mode 100644
index 0000000..b0bfee3
--- /dev/null
+++ b/contrib/libpcap/pcap_compile.3pcap
@@ -0,0 +1,72 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_compile.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_COMPILE 3PCAP "5 April 2008"
+.SH NAME
+pcap_compile \- compile a filter expression
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_compile(pcap_t *p, struct bpf_program *fp,
+.ti +8
+const char *str, int optimize, bpf_u_int32 netmask);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_compile()
+is used to compile the string
+.I str
+into a filter program.  See
+.BR pcap-filter (7)
+for the syntax of that string.
+.I program
+is a pointer to a
+.I bpf_program
+struct and is filled in by
+.BR pcap_compile() .
+.I optimize
+controls whether optimization on the resulting code is performed.
+.I netmask
+specifies the IPv4 netmask of the network on which packets are being
+captured; it is used only when checking for IPv4 broadcast addresses in
+the filter program.  If the netmask of the network on which packets are
+being captured isn't known to the program, or if packets are being
+captured on the Linux "any" pseudo-interface that can capture on more
+than one network, a value of 0 can be supplied; tests for IPv4 broadcast
+addreses won't be done correctly, but all other tests in the filter
+program will be OK.
+.SH RETURN VALUE
+.B pcap_compile()
+returns 0 on success and \-1 on failure.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_setfilter(3PCAP), pcap_freecode(3PCAP),
+pcap_geterr(3PCAP), pcap-filter(7)
diff --git a/contrib/libpcap/pcap_compile.3pcap.in b/contrib/libpcap/pcap_compile.3pcap.in
new file mode 100644
index 0000000..87e2778
--- /dev/null
+++ b/contrib/libpcap/pcap_compile.3pcap.in
@@ -0,0 +1,72 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_compile.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_COMPILE 3PCAP "5 April 2008"
+.SH NAME
+pcap_compile \- compile a filter expression
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_compile(pcap_t *p, struct bpf_program *fp,
+.ti +8
+const char *str, int optimize, bpf_u_int32 netmask);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_compile()
+is used to compile the string
+.I str
+into a filter program.  See
+.BR pcap-filter (@MAN_MISC_INFO@)
+for the syntax of that string.
+.I program
+is a pointer to a
+.I bpf_program
+struct and is filled in by
+.BR pcap_compile() .
+.I optimize
+controls whether optimization on the resulting code is performed.
+.I netmask
+specifies the IPv4 netmask of the network on which packets are being
+captured; it is used only when checking for IPv4 broadcast addresses in
+the filter program.  If the netmask of the network on which packets are
+being captured isn't known to the program, or if packets are being
+captured on the Linux "any" pseudo-interface that can capture on more
+than one network, a value of 0 can be supplied; tests for IPv4 broadcast
+addreses won't be done correctly, but all other tests in the filter
+program will be OK.
+.SH RETURN VALUE
+.B pcap_compile()
+returns 0 on success and \-1 on failure.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_setfilter(3PCAP), pcap_freecode(3PCAP),
+pcap_geterr(3PCAP), pcap-filter(@MAN_MISC_INFO@)
diff --git a/contrib/libpcap/pcap_create.3pcap b/contrib/libpcap/pcap_create.3pcap
new file mode 100644
index 0000000..32071b3
--- /dev/null
+++ b/contrib/libpcap/pcap_create.3pcap
@@ -0,0 +1,74 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_create.3pcap,v 1.1.2.1 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_CREATE 3PCAP "5 April 2008"
+.SH NAME
+pcap_create \- create a live capture handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+pcap_t *pcap_create(const char *source, char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_create()
+is used to create a packet capture handle to look
+at packets on the network.
+.I source
+is a string that specifies the network device to open; on Linux systems
+with 2.2 or later kernels, a
+.I source
+argument of "any" or
+.B NULL
+can be used to capture packets from all interfaces.
+.PP
+The returned handle must be activated with
+.B pcap_activate()
+before packets can be captured
+with it; options for the capture, such as promiscuous mode, can be set
+on the handle before activating it.
+.SH RETURN VALUE
+.B pcap_create()
+returns a
+.I pcap_t *
+on success and
+.B NULL
+on failure.
+If
+.B NULL
+is returned,
+.I errbuf
+is filled in with an appropriate error message.
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP), pcap_activate(3PCAP)
diff --git a/contrib/libpcap/pcap_datalink.3pcap b/contrib/libpcap/pcap_datalink.3pcap
new file mode 100644
index 0000000..06dfdee
--- /dev/null
+++ b/contrib/libpcap/pcap_datalink.3pcap
@@ -0,0 +1,41 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_datalink.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DATALINK 3PCAP "5 April 2008"
+.SH NAME
+pcap_datalink \- get the link-layer header type
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_datalink(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_datalink()
+returns the link layer type for the live capture or ``savefile''
+specified by
+.IR p .
+.SH SEE ALSO
+pcap(3PCAP), pcap-linktype(7)
diff --git a/contrib/libpcap/pcap_datalink.3pcap.in b/contrib/libpcap/pcap_datalink.3pcap.in
new file mode 100644
index 0000000..83426f0
--- /dev/null
+++ b/contrib/libpcap/pcap_datalink.3pcap.in
@@ -0,0 +1,41 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_datalink.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DATALINK 3PCAP "5 April 2008"
+.SH NAME
+pcap_datalink \- get the link-layer header type
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_datalink(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_datalink()
+returns the link layer type for the live capture or ``savefile''
+specified by
+.IR p .
+.SH SEE ALSO
+pcap(3PCAP), pcap-linktype(@MAN_MISC_INFO@)
diff --git a/contrib/libpcap/pcap_datalink_name_to_val.3pcap b/contrib/libpcap/pcap_datalink_name_to_val.3pcap
new file mode 100644
index 0000000..f51b933
--- /dev/null
+++ b/contrib/libpcap/pcap_datalink_name_to_val.3pcap
@@ -0,0 +1,48 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_datalink_name_to_val.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DATALINK_NAME_TO_VAL 3PCAP "5 April 2008"
+.SH NAME
+pcap_datalink_name_to_val \- get the link-layer header type value
+corresponding to a header type name
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_datalink_name_to_val(const char *name);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_datalink_name_to_val()
+translates a data link type name, which is a
+.B DLT_
+name with the
+.B DLT_
+removed, to the corresponding data link type value.  The translation
+is case-insensitive.
+.SH RETURN VALUE
+.B pcap_datalink_name_to_val()
+returns 0 on success and \-1 on failure.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_datalink_val_to_name.3pcap b/contrib/libpcap/pcap_datalink_val_to_name.3pcap
new file mode 100644
index 0000000..476bf10
--- /dev/null
+++ b/contrib/libpcap/pcap_datalink_val_to_name.3pcap
@@ -0,0 +1,44 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_datalink_val_to_name.3pcap,v 1.1.2.2 2008-05-30 01:32:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DATALINK_VAL_TO_NAME 3 "4 April 2008"
+.SH NAME
+pcap_datalink_val_to_name, pcap_datalink_val_to_description \- get a
+name or description for a link-layer header type value
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap.h>
+.ft
+.LP
+.ft B
+const char *pcap_datalink_val_to_name(int dlt);
+const char *pcap_datalink_val_to_description(int dlt);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_datalink_val_to_name()
+translates a data link type value to the corresponding data link type
+name.  NULL is returned on failure.
+.PP
+.B pcap_datalink_val_to_description()
+translates a data link type value to a short description of that data
+link type.  NULL is returned on failure.
diff --git a/contrib/libpcap/pcap_dump.3pcap b/contrib/libpcap/pcap_dump.3pcap
new file mode 100644
index 0000000..1808869
--- /dev/null
+++ b/contrib/libpcap/pcap_dump.3pcap
@@ -0,0 +1,53 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_dump.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DUMP 3PCAP "5 April 2008"
+.SH NAME
+pcap_dump \- write a packet to a capture file
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+void pcap_dump(u_char *user, struct pcap_pkthdr *h,
+.ti +8
+u_char *sp);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_dump()
+outputs a packet to the ``savefile'' opened with
+.BR pcap_dump_open() .
+Note that its calling arguments are suitable for use with
+.B pcap_dispatch()
+or
+.BR pcap_loop() .
+If called directly, the 
+.I user
+parameter is of type 
+.B pcap_dumper_t
+as returned by
+.BR pcap_dump_open() .
+.SH SEE ALSO
+pcap(3PCAP), pcap_dump_open(3PCAP), pcap_dispatch(3PCAP),
+pcap_loop(3PCAP)
diff --git a/contrib/libpcap/pcap_dump_close.3pcap b/contrib/libpcap/pcap_dump_close.3pcap
new file mode 100644
index 0000000..07b690a
--- /dev/null
+++ b/contrib/libpcap/pcap_dump_close.3pcap
@@ -0,0 +1,39 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_dump_close.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DUMP_CLOSE 3PCAP "5 April 2008"
+.SH NAME
+pcap_dump_close \- close a savefile being written to
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+void pcap_dump_close(pcap_dumper_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_dump_close()
+closes the ``savefile.''
+.SH SEE ALSO
+pcap(3PCAP), pcap_dump_open(3PCAP), pcap_dump(3PCAP)
diff --git a/contrib/libpcap/pcap_dump_file.3pcap b/contrib/libpcap/pcap_dump_file.3pcap
new file mode 100644
index 0000000..5cf0de6
--- /dev/null
+++ b/contrib/libpcap/pcap_dump_file.3pcap
@@ -0,0 +1,40 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_dump_file.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DUMP_FILE 3PCAP "5 April 2008"
+.SH NAME
+pcap_dump_file \- get the standard I/O stream for a savefile being written
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+FILE *pcap_dump_file(pcap_dumper_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_dump_file()
+returns the standard I/O stream of the ``savefile'' opened by
+.BR pcap_dump_open() .
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_dump_flush.3pcap b/contrib/libpcap/pcap_dump_flush.3pcap
new file mode 100644
index 0000000..e83e2a0
--- /dev/null
+++ b/contrib/libpcap/pcap_dump_flush.3pcap
@@ -0,0 +1,45 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_dump_flush.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DUMP_FLUSH 3PCAP "5 April 2008"
+.SH NAME
+pcap_dump_flush \- flush to a savefile packets dumped
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_dump_flush(pcap_dumper_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_dump_flush()
+flushes the output buffer to the ``savefile,'' so that any packets
+written with
+.B pcap_dump()
+but not yet written to the ``savefile'' will be written.
+.SH RETURN VALUE
+.B pcap_dump_flush()
+returns 0 on success and \-1 on failure.
+.SH SEE ALSO
+pcap(3PCAP), pcap_dump_open(3PCAP), pcap_dump(3PCAP)
diff --git a/contrib/libpcap/pcap_dump_ftell.3pcap b/contrib/libpcap/pcap_dump_ftell.3pcap
new file mode 100644
index 0000000..d9c3600
--- /dev/null
+++ b/contrib/libpcap/pcap_dump_ftell.3pcap
@@ -0,0 +1,44 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_dump_ftell.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DUMP_FTELL 3PCAP "5 April 2008"
+.SH NAME
+pcap_dump_ftell \- get the current file offset for a savefile being written
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+long pcap_dump_ftell(pcap_dumper_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_dump_ftell()
+returns the current file position for the ``savefile'', representing the
+number of bytes written by
+.B pcap_dump_open()
+and
+.BR pcap_dump() .
+\-1 is returned on error.
+.SH SEE ALSO
+pcap(3PCAP), pcap_dump_open(3PCAP), pcap_dump(3PCAP)
diff --git a/contrib/libpcap/pcap_dump_open.3pcap b/contrib/libpcap/pcap_dump_open.3pcap
new file mode 100644
index 0000000..70aa932
--- /dev/null
+++ b/contrib/libpcap/pcap_dump_open.3pcap
@@ -0,0 +1,87 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_dump_open.3pcap.in,v 1.1.2.2 2008-10-23 05:59:43 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DUMP_OPEN 3PCAP "5 April 2008"
+.SH NAME
+pcap_dump_open, pcap_dump_fopen \- open a file to which to write packets
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.nf
+.LP
+.ft B
+pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname);
+pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *fp);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_dump_open()
+is called to open a ``savefile'' for writing.
+.I fname
+specifies the name of the file to open. The file will have
+the same format as those used by
+.BR tcpdump (1)
+and
+.BR tcpslice (1).
+The name "-" in a synonym
+for
+.BR stdout .
+.PP
+.B pcap_dump_fopen()
+is called to write data to an existing open stream
+.IR fp .
+Note that on Windows, that stream should be opened in binary mode.
+.PP
+.I p
+is a capture or ``savefile'' handle returned by an earlier call to
+.B pcap_create()
+and activated by an earlier call to
+.BR pcap_activate() ,
+or returned by an earlier call to
+.BR pcap_open_offline() ,
+.BR pcap_open_live() ,
+or
+.BR pcap_open_dead() .
+The link-layer type and snapshot length from
+.I p
+are used as the link-layer type and snapshot length of the output file.
+.SH RETURN VALUES
+A pointer to a
+.B pcap_dumper_t
+structure to use in subsequent
+.B pcap_dump()
+and
+.B pcap_dump_close()
+calls is returned on success.
+.B NULL
+is returned on failure.
+If
+.B NULL
+is returned,
+.B pcap_geterr(\fIp\fB)
+can be used to get the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
+pcap_open_offline(3PCAP), pcap_open_live(3PCAP), pcap_open_dead(3PCAP),
+pcap_dump(3PCAP), pcap_dump_close(3PCAP), pcap_geterr(3PCAP),
+pcap-savefile(5)
diff --git a/contrib/libpcap/pcap_dump_open.3pcap.in b/contrib/libpcap/pcap_dump_open.3pcap.in
new file mode 100644
index 0000000..9fe116b
--- /dev/null
+++ b/contrib/libpcap/pcap_dump_open.3pcap.in
@@ -0,0 +1,87 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_dump_open.3pcap.in,v 1.1.2.2 2008-10-23 05:59:43 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_DUMP_OPEN 3PCAP "5 April 2008"
+.SH NAME
+pcap_dump_open, pcap_dump_fopen \- open a file to which to write packets
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.nf
+.LP
+.ft B
+pcap_dumper_t *pcap_dump_open(pcap_t *p, const char *fname);
+pcap_dumper_t *pcap_dump_fopen(pcap_t *p, FILE *fp);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_dump_open()
+is called to open a ``savefile'' for writing.
+.I fname
+specifies the name of the file to open. The file will have
+the same format as those used by
+.BR tcpdump (1)
+and
+.BR tcpslice (1).
+The name "-" in a synonym
+for
+.BR stdout .
+.PP
+.B pcap_dump_fopen()
+is called to write data to an existing open stream
+.IR fp .
+Note that on Windows, that stream should be opened in binary mode.
+.PP
+.I p
+is a capture or ``savefile'' handle returned by an earlier call to
+.B pcap_create()
+and activated by an earlier call to
+.BR pcap_activate() ,
+or returned by an earlier call to
+.BR pcap_open_offline() ,
+.BR pcap_open_live() ,
+or
+.BR pcap_open_dead() .
+The link-layer type and snapshot length from
+.I p
+are used as the link-layer type and snapshot length of the output file.
+.SH RETURN VALUES
+A pointer to a
+.B pcap_dumper_t
+structure to use in subsequent
+.B pcap_dump()
+and
+.B pcap_dump_close()
+calls is returned on success.
+.B NULL
+is returned on failure.
+If
+.B NULL
+is returned,
+.B pcap_geterr(\fIp\fB)
+can be used to get the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
+pcap_open_offline(3PCAP), pcap_open_live(3PCAP), pcap_open_dead(3PCAP),
+pcap_dump(3PCAP), pcap_dump_close(3PCAP), pcap_geterr(3PCAP),
+pcap-savefile(@MAN_FILE_FORMATS@)
diff --git a/contrib/libpcap/pcap_file.3pcap b/contrib/libpcap/pcap_file.3pcap
new file mode 100644
index 0000000..b74e502
--- /dev/null
+++ b/contrib/libpcap/pcap_file.3pcap
@@ -0,0 +1,59 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_file.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_FILE 3PCAP "5 April 2008"
+.SH NAME
+pcap_file \- get the standard I/O stream for a savefile being read
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+FILE *pcap_file(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_file()
+returns the standard I/O stream of the ``savefile,'' if a ``savefile''
+was opened with
+.BR pcap_open_offline() ,
+or NULL, if a network device was opened with
+.B pcap_create()
+and
+.BR pcap_activate() ,
+or with
+.BR pcap_open_live() .
+.PP
+Note that the Packet Capture library is usually built with large file
+support, so the standard I/O stream of the ``savefile'' might refer to
+a file larger than 2 gigabytes; applications that use
+.B pcap_file()
+should, if possible, use calls that support large files on the return
+value of
+.B pcap_file()
+or the value returned by
+.B fileno()
+when passed the return value of
+.BR pcap_file() .
+.SH SEE ALSO
+pcap(3PCAP), pcap_open_offline(3PCAP)
diff --git a/contrib/libpcap/pcap_fileno.3pcap b/contrib/libpcap/pcap_fileno.3pcap
new file mode 100644
index 0000000..9c05be0
--- /dev/null
+++ b/contrib/libpcap/pcap_fileno.3pcap
@@ -0,0 +1,47 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_fileno.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_FILENO 3PCAP "5 April 2008"
+.SH NAME
+pcap_fileno \- get the file descriptor for a live capture
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_fileno(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_fileno()
+returns the file descriptor number from which captured packets are read,
+if a network device was opened with
+.B pcap_create()
+and
+.B pcap_activate()
+or with
+.BR pcap_open_live() ,
+or \-1, if a ``savefile'' was opened with
+.BR pcap_open_offline() .
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
diff --git a/contrib/libpcap/pcap_findalldevs.3pcap b/contrib/libpcap/pcap_findalldevs.3pcap
new file mode 100644
index 0000000..93c0455
--- /dev/null
+++ b/contrib/libpcap/pcap_findalldevs.3pcap
@@ -0,0 +1,156 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_findalldevs.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_FINDALLDEVS 3PCAP "5 April 2008"
+.SH NAME
+pcap_findalldevs \- get a list of capture devices
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+int pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_findalldevs()
+constructs a list of network devices that can be opened with
+.B pcap_create()
+and
+.B pcap_activate()
+or with
+.BR pcap_open_live() .
+(Note that there may be network devices that cannot be opened by the
+process calling
+.BR pcap_findalldevs() ,
+because, for example, that process might not have sufficient privileges
+to open them for capturing; if so, those devices will not appear on the
+list.)
+.I alldevsp
+is set to point to the first element of the list; each element of the
+list is of type
+.BR pcap_if_t ,
+and has the following members:
+.RS
+.TP
+.B next
+if not
+.BR NULL ,
+a pointer to the next element in the list;
+.B NULL
+for the last element of the list
+.TP
+.B name
+a pointer to a string giving a name for the device to pass to
+.B pcap_open_live()
+.TP
+.B description
+if not
+.BR NULL ,
+a pointer to a string giving a human-readable description of the device
+.TP
+.B addresses
+a pointer to the first element of a list of addresses for the interface
+.TP
+.B flags
+interface flags:
+.RS
+.TP
+.B PCAP_IF_LOOPBACK
+set if the interface is a loopback interface
+.RE
+.RE
+.PP
+Each element of the list of addresses is of type
+.BR pcap_addr_t ,
+and has the following members:
+.RS
+.TP
+.B next
+if not
+.BR NULL ,
+a pointer to the next element in the list;
+.B NULL
+for the last element of the list
+.TP
+.B addr
+a pointer to a
+.B "struct sockaddr"
+containing an address
+.TP
+.B netmask
+if not
+.BR NULL ,
+a pointer to a
+.B "struct sockaddr"
+that contains the netmask corresponding to the address pointed to by
+.B addr
+.TP
+.B broadaddr
+if not
+.BR NULL ,
+a pointer to a
+.B "struct sockaddr"
+that contains the broadcast address corresponding to the address pointed
+to by
+.BR addr ;
+may be null if the interface doesn't support broadcasts
+.TP
+.B dstaddr
+if not
+.BR NULL ,
+a pointer to a
+.B "struct sockaddr"
+that contains the destination address corresponding to the address pointed
+to by
+.BR addr ;
+may be null if the interface isn't a point-to-point interface
+.RE
+.PP
+Note that not all the addresses in the list of addresses are
+necessarily IPv4 or IPv6 addresses - you must check the
+.B sa_family
+member of the
+.B "struct sockaddr"
+before interpreting the contents of the address.
+.PP
+The list of devices must be freed with
+.BR pcap_freealldevs() .
+.SH RETURN VALUE
+.B pcap_findalldevs()
+returns 0 on success and \-1 on failure.
+If \-1 is returned,
+.I errbuf
+is filled in with an appropriate error message.
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
+pcap_open_live(3PCAP), pcap_freealldevs(3PCAP)
diff --git a/contrib/libpcap/pcap_free_datalinks.3pcap b/contrib/libpcap/pcap_free_datalinks.3pcap
new file mode 100644
index 0000000..8bb7899
--- /dev/null
+++ b/contrib/libpcap/pcap_free_datalinks.3pcap
@@ -0,0 +1,41 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_free_datalinks.3pcap,v 1.1.2.1 2008-05-26 19:58:59 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_FREE_DATALINKS 3PCAP "26 May 2008"
+.SH NAME
+pcap_free_datalinks \- free a list of link-layer header types from
+pcap_get_datalinks()
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+void pcap_free_datalinks(int *dlt_list);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_free_datalinks()
+is used to free a list of supported data link types returned by
+.BR pcap_list_datalinks() .
+.SH SEE ALSO
+pcap(3PCAP), pcap_list_datalinks(3PCAP)
diff --git a/contrib/libpcap/pcap_freealldevs.3pcap b/contrib/libpcap/pcap_freealldevs.3pcap
new file mode 100644
index 0000000..09d4706
--- /dev/null
+++ b/contrib/libpcap/pcap_freealldevs.3pcap
@@ -0,0 +1,40 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_freealldevs.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_FREEALLDEVS 3PCAP "5 April 2008"
+.SH NAME
+pcap_freealldevs \- free a list of capture devices
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+void pcap_freealldevs(pcap_if_t *alldevs);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_freealldevs()
+is used to free a list allocated by
+.BR pcap_findalldevs() .
+.SH SEE ALSO
+pcap(3PCAP), pcap_findalldevs(3PCAP)
diff --git a/contrib/libpcap/pcap_freecode.3pcap b/contrib/libpcap/pcap_freecode.3pcap
new file mode 100644
index 0000000..061b506
--- /dev/null
+++ b/contrib/libpcap/pcap_freecode.3pcap
@@ -0,0 +1,45 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_freecode.3pcap,v 1.1.2.3 2008-04-06 03:21:55 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_FREECODE 3PCAP "5 April 2008"
+.SH NAME
+pcap_freecode \- free a BPF program
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+void pcap_freecode(struct bpf_program *);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_freecode()
+is used to free up allocated memory pointed to by a
+.I bpf_program
+struct generated by
+.B pcap_compile()
+when that BPF program is no longer needed, for example after it
+has been made the filter program for a pcap structure by a call to
+.BR pcap_setfilter() .
+.SH SEE ALSO
+pcap(3PCAP), pcap_compile(3PCAP), pcap_setfilter(3PCAP)
diff --git a/contrib/libpcap/pcap_get_selectable_fd.3pcap b/contrib/libpcap/pcap_get_selectable_fd.3pcap
new file mode 100644
index 0000000..9026f45
--- /dev/null
+++ b/contrib/libpcap/pcap_get_selectable_fd.3pcap
@@ -0,0 +1,114 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_get_selectable_fd.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_GET_SELECTABLE_FD 3PCAP "5 April 2008"
+.SH NAME
+pcap_get_selectable_fd \- get a file descriptor on which a select() can
+be done for a live capture
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_get_selectable_fd(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_get_selectable_fd()
+returns, on UNIX, a file descriptor number for a file descriptor on
+which one can
+do a
+.B select()
+or
+.B poll()
+to wait for it to be possible to read packets without blocking, if such
+a descriptor exists, or \-1, if no such descriptor exists.  Some network
+devices opened with
+.B pcap_create()
+and
+.BR pcap_activate() ,
+or with
+.BR pcap_open_live() ,
+do not support
+.B select()
+or
+.B poll()
+(for example, regular network devices on FreeBSD 4.3 and 4.4, and Endace
+DAG devices), so \-1 is returned for those devices.
+.PP
+Note that on most versions of most BSDs (including Mac OS X)
+.B select()
+and
+.B poll()
+do not work correctly on BPF devices;
+.B pcap_get_selectable_fd()
+will return a file descriptor on most of those versions (the exceptions
+being FreeBSD 4.3 and 4.4), a simple
+.B select()
+or
+.B poll()
+will not return even after the read timeout expires.  To work around
+this, an application that uses
+.B select()
+or
+.B poll()
+to wait for packets to arrive must put the
+.B pcap_t
+in non-blocking mode, and must arrange that the
+.B select()
+or
+.B poll()
+have a timeout less than or equal to the read timeout,
+and must try to read packets after that timeout expires, regardless of
+whether
+.B select()
+or
+.B poll()
+indicated that the file descriptor for the
+.B pcap_t
+is ready to be read or not.  (That workaround will not work in FreeBSD
+4.3 and later; however, in FreeBSD 4.6 and later,
+.B select()
+and
+.B poll()
+work correctly on BPF devices, so the workaround isn't necessary,
+although it does no harm.)
+.PP
+Note also that
+.B poll()
+doesn't work on character special files, including BPF devices, in Mac
+OS X 10.4 and 10.5, so, while
+.B select()
+can be used on the descriptor returned by
+.BR pcap_get_selectable_fd() ,
+.B poll()
+cannot be used on it those versions of Mac OS X.  Kqueues also don't
+work on that descriptor.
+.PP
+.B pcap_get_selectable_fd()
+is not available on Windows.
+.SH RETURN VALUE
+A selectable file descriptor is returned if one exists; otherwise, \-1
+is returned.
+.SH SEE ALSO
+pcap(3PCAP), select(2), poll(2)
diff --git a/contrib/libpcap/pcap_geterr.3pcap b/contrib/libpcap/pcap_geterr.3pcap
new file mode 100644
index 0000000..9a46a83
--- /dev/null
+++ b/contrib/libpcap/pcap_geterr.3pcap
@@ -0,0 +1,53 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_geterr.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_GETERR 3PCAP "5 April 2008"
+.SH NAME
+pcap_geterr, pcap_perror \- get or print libpcap error message text
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+char *pcap_geterr(pcap_t *p);
+void pcap_perror(pcap_t *p, char *prefix);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_geterr()
+returns the error text pertaining to the last pcap library error.
+.BR NOTE :
+the pointer it returns will no longer point to a valid error message
+string after the
+.B pcap_t
+passed to it is closed; you must use or copy the string before closing
+the
+.BR pcap_t .
+.PP
+.B pcap_perror()
+prints the text of the last pcap library error on
+.BR stderr ,
+prefixed by
+.IR prefix .
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_inject.3pcap b/contrib/libpcap/pcap_inject.3pcap
new file mode 100644
index 0000000..954984c
--- /dev/null
+++ b/contrib/libpcap/pcap_inject.3pcap
@@ -0,0 +1,90 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_inject.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_INJECT 3PCAP "5 April 2008"
+.SH NAME
+pcap_inject, pcap_sendpacket \- transmit a packet
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_inject(pcap_t *p, const void *buf, size_t size);
+int pcap_sendpacket(pcap_t *p, const u_char *buf, int size);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_inject()
+sends a raw packet through the network interface;
+.I buf
+points to the data of the packet, including the link-layer header, and
+.I size
+is the number of bytes in the packet.
+.PP
+Note that, even if you successfully open the network interface, you
+might not have permission to send packets on it, or it might not support
+sending packets; as
+.I pcap_open_live()
+doesn't have a flag to indicate whether to open for capturing, sending,
+or capturing and sending, you cannot request an open that supports
+sending and be notified at open time whether sending will be possible.
+Note also that some devices might not support sending packets.
+.PP
+Note that, on some platforms, the link-layer header of the packet that's
+sent might not be the same as the link-layer header of the packet
+supplied to
+.BR pcap_inject() ,
+as the source link-layer address, if the header contains such an
+address, might be changed to be the address assigned to the interface on
+which the packet it sent, if the platform doesn't support sending
+completely raw and unchanged packets.  Even worse, some drivers on some
+platforms might change the link-layer type field to whatever value
+libpcap used when attaching to the device, even on platforms that
+.I do
+nominally support sending completely raw and unchanged packets.
+.PP
+.B pcap_sendpacket()
+is like
+.BR pcap_inject() ,
+but it returns 0 on success, rather than returning the number of bytes
+written.
+.RB ( pcap_inject()
+comes from OpenBSD;
+.B pcap_sendpacket()
+comes from WinPcap.  Both are provided for compatibility.)
+.SH RETURN VALUE
+.B pcap_inject()
+returns the number of bytes written on success and \-1 on failure.
+.PP
+.B pcap_sendpacket()
+returns 0 on success and \-1 on failure.
+.PP
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP)
diff --git a/contrib/libpcap/pcap_is_swapped.3pcap b/contrib/libpcap/pcap_is_swapped.3pcap
new file mode 100644
index 0000000..6cc7089
--- /dev/null
+++ b/contrib/libpcap/pcap_is_swapped.3pcap
@@ -0,0 +1,42 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_is_swapped.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_IS_SWAPPED 3PCAP "5 April 2008"
+.SH NAME
+pcap_is_swapped \- find out whether a savefile has the native byte order
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_is_swapped(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_is_swapped()
+returns true if
+.I p
+refers to a ``savefile'' that uses a different byte order
+than the current system.  For a live capture, it always returns false.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_lib_version.3pcap b/contrib/libpcap/pcap_lib_version.3pcap
new file mode 100644
index 0000000..fff9149
--- /dev/null
+++ b/contrib/libpcap/pcap_lib_version.3pcap
@@ -0,0 +1,41 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_lib_version.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_LIB_VERSION 3PCAP "5 April 2008"
+.SH NAME
+pcap_lib_version \- get the version information for libpcap
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+const char *pcap_lib_version(void);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_lib_version()
+returns a pointer to a string giving information about the version of
+the libpcap library being used; note that it contains more information
+than just a version number.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_list_datalinks.3pcap b/contrib/libpcap/pcap_list_datalinks.3pcap
new file mode 100644
index 0000000..4e73196
--- /dev/null
+++ b/contrib/libpcap/pcap_list_datalinks.3pcap
@@ -0,0 +1,58 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_list_datalinks.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_LIST_DATALINKS 3PCAP "5 April 2008"
+.SH NAME
+pcap_list_datalinks \- get a list of link-layer header types supported
+by a capture device
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_list_datalinks(pcap_t *p, int **dlt_buf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_list_datalinks()
+is used to get a list of the supported data link types of the interface
+associated with the pcap descriptor.
+.B pcap_list_datalinks()
+allocates an array to hold the list and sets
+.IR *dlt_buf .
+The caller is responsible for freeing the array with
+.BR pcap_free_datalinks (3PCAP).
+.SH RETURN VALUE
+.B pcap_list_datalinks()
+returns the number of data link types in the array on success and \-1
+on failure.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP), pcap_free_datalinks(3PCAP),
+pcap-linktype(7)
diff --git a/contrib/libpcap/pcap_list_datalinks.3pcap.in b/contrib/libpcap/pcap_list_datalinks.3pcap.in
new file mode 100644
index 0000000..822c70c
--- /dev/null
+++ b/contrib/libpcap/pcap_list_datalinks.3pcap.in
@@ -0,0 +1,58 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_list_datalinks.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_LIST_DATALINKS 3PCAP "5 April 2008"
+.SH NAME
+pcap_list_datalinks \- get a list of link-layer header types supported
+by a capture device
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_list_datalinks(pcap_t *p, int **dlt_buf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_list_datalinks()
+is used to get a list of the supported data link types of the interface
+associated with the pcap descriptor.
+.B pcap_list_datalinks()
+allocates an array to hold the list and sets
+.IR *dlt_buf .
+The caller is responsible for freeing the array with
+.BR pcap_free_datalinks (3PCAP).
+.SH RETURN VALUE
+.B pcap_list_datalinks()
+returns the number of data link types in the array on success and \-1
+on failure.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP), pcap_free_datalinks(3PCAP),
+pcap-linktype(@MAN_MISC_INFO@)
diff --git a/contrib/libpcap/pcap_lookupdev.3pcap b/contrib/libpcap/pcap_lookupdev.3pcap
new file mode 100644
index 0000000..2d80bf5
--- /dev/null
+++ b/contrib/libpcap/pcap_lookupdev.3pcap
@@ -0,0 +1,62 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_lookupdev.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_LOOKUPDEV 3PCAP "5 April 2008"
+.SH NAME
+pcap_lookupdev \- find the default device on which to capture
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+char *pcap_lookupdev(char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_lookupdev()
+returns a pointer to a string giving the name of a network device
+suitable for use with
+.B pcap_create()
+and
+.BR pcap_activate() ,
+or with
+.BR pcap_open_live() ,
+and with
+.BR pcap_lookupnet() .
+If there is an error,
+.B NULL
+is returned and
+.I errbuf
+is filled in with an appropriate error message.
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
+pcap_open_live(3PCAP), pcap_lookupnet(3PCAP)
diff --git a/contrib/libpcap/pcap_lookupnet.3pcap b/contrib/libpcap/pcap_lookupnet.3pcap
new file mode 100644
index 0000000..031acb7
--- /dev/null
+++ b/contrib/libpcap/pcap_lookupnet.3pcap
@@ -0,0 +1,65 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_lookupnet.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_LOOKUPNET 3PCAP "5 April 2008"
+.SH NAME
+pcap_lookupnet \- find the IPv4 network number and netmask for a device
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+int pcap_lookupnet(const char *device, bpf_u_int32 *netp,
+.ti +8
+bpf_u_int32 *maskp, char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_lookupnet()
+is used to determine the IPv4 network number and mask
+associated with the network device
+.IR device .
+Both
+.I netp
+and
+.I maskp
+are
+.I bpf_u_int32
+pointers.
+.SH RETURN VALUE
+.B pcap_lookupnet()
+returns 0 on success and \-1 on failure.
+If \-1 is returned,
+.I errbuf
+is filled in with an appropriate error message.
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_loop.3pcap b/contrib/libpcap/pcap_loop.3pcap
new file mode 100644
index 0000000..8e491d4
--- /dev/null
+++ b/contrib/libpcap/pcap_loop.3pcap
@@ -0,0 +1,150 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_loop.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_LOOP 3PCAP "5 April 2008"
+.SH NAME
+pcap_loop, pcap_dispatch \- process packets from a live capture or savefile
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
+.ti +8
+			     const u_char *bytes);
+.ft
+.LP
+.ft B
+int pcap_loop(pcap_t *p, int cnt,
+.ti +8
+pcap_handler callback, u_char *user);
+int pcap_dispatch(pcap_t *p, int cnt,
+.ti +8
+pcap_handler callback, u_char *user);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_loop()
+processes packets from a live capture or ``savefile'' until
+.I cnt
+packets are processed, the end of the ``savefile'' is
+reached when reading from a ``savefile'',
+.B pcap_breakloop()
+is called, or an error occurs.
+It does
+.B not
+return when live read timeouts occur.
+A value of \-1 or 0 for
+.I cnt
+is equivalent to infinity, so that packets are processed until another
+ending condition occurs.
+.PP
+.B pcap_dispatch()
+processes packets from a live capture or ``savefile'' until
+.I cnt
+packets are processed, the end of the current bufferful of packets is
+reached when doing a live capture, the end of the ``savefile'' is
+reached when reading from a ``savefile'',
+.B pcap_breakloop()
+is called, or an error occurs.
+Thus, when doing a live capture,
+.I cnt
+is the maximum number of packets to process before returning, but is not
+a minimum number; when reading a live capture, only one
+bufferful of packets is read at a time, so fewer than
+.I cnt
+packets may be processed. A value of \-1 or 0 for
+.I cnt
+causes all the packets received in one buffer to be processed when
+reading a live capture, and causes all the packets in the file to be
+processed when reading a ``savefile''.
+.PP
+.ft B
+(In older versions of libpcap, the behavior when
+\fIcnt\fP
+was 0 was undefined; different platforms and devices behaved
+differently, so code that must work with older versions of libpcap
+should use \-1, nor 0, as the value of
+\fIcnt\fP.)
+.ft R
+.PP
+.I callback
+specifies a routine to be called with three arguments:
+a
+.I u_char
+pointer which is passed in the
+.I user
+argument to
+.B pcap_loop()
+or
+.BR pcap_dispatch() ,
+a
+.I const struct pcap_pkthdr
+pointer pointing to the packet time stamp and lengths, and a
+.I const u_char
+pointer to the first
+.B caplen
+(as given in the
+.I struct pcap_pkthdr
+a pointer to which is passed to the callback routine)
+bytes of data from the packet.
+.SH RETURN VALUE
+.B pcap_loop()
+returns 0 if
+.I cnt
+is exhausted, \-1 if an error occurs, or \-2 if the loop terminated due
+to a call to
+.B pcap_breakloop()
+before any packets were processed.
+It does
+.B not
+return when live read timeouts occur; instead, it attempts to read more
+packets.
+.PP
+.B pcap_dispatch()
+returns the number of packets processed on success; this can be 0 if no
+packets were read from a live capture (if, for example, they were
+discarded because they didn't pass the packet filter, or if, on
+platforms that support a read timeout that starts before any packets
+arrive, the timeout expires before any packets arrive, or if the file
+descriptor for the capture device is in non-blocking mode and no packets
+were available to be read) or if no more packets are available in a
+``savefile.''  It returns \-1 if an error occurs or \-2 if the loop
+terminated due to a call to
+.B pcap_breakloop()
+before any packets were processed.
+.ft B
+If your application uses pcap_breakloop(),
+make sure that you explicitly check for \-1 and \-2, rather than just
+checking for a return value < 0.
+.ft R
+.PP
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP), pcap_breakloop(3PCAP)
diff --git a/contrib/libpcap/pcap_major_version.3pcap b/contrib/libpcap/pcap_major_version.3pcap
new file mode 100644
index 0000000..1eabcf0
--- /dev/null
+++ b/contrib/libpcap/pcap_major_version.3pcap
@@ -0,0 +1,54 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_major_version.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_MAJOR_VERSION 3PCAP "5 April 2008"
+.SH NAME
+pcap_major_version, pcap_minor_version \- get the version number of a savefile
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_major_version(pcap_t *p);
+int pcap_minor_version(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+If
+.I p
+refers to a savefile,
+.B pcap_major_version()
+returns the major number of the file format of the savefile and
+.B pcap_minor_version()
+returns the minor number of the file format of the savefile.  The
+version number is stored in the header of the savefile.
+.PP
+If
+.I p
+refers to a live capture, the values returned by
+.B pcap_major_version()
+and
+.B pcap_minor_version()
+are not meaningful.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_next_ex.3pcap b/contrib/libpcap/pcap_next_ex.3pcap
new file mode 100644
index 0000000..d472a2b
--- /dev/null
+++ b/contrib/libpcap/pcap_next_ex.3pcap
@@ -0,0 +1,90 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_next_ex.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_NEXT_EX 3PCAP "5 April 2008"
+.SH NAME
+pcap_next_ex, pcap_next \- read the next packet from a pcap_t
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
+.ti +8
+const u_char **pkt_data);
+const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_next_ex()
+reads the next packet and returns a success/failure indication.
+If the packet was read without problems, the pointer pointed to by the
+.I pkt_header
+argument is set to point to the
+.I pcap_pkthdr
+struct for the packet, and the
+pointer pointed to by the
+.I pkt_data
+argument is set to point to the data in the packet.
+.PP
+.B pcap_next()
+reads the next packet (by calling
+.B pcap_dispatch()
+with a
+.I cnt
+of 1) and returns a
+.I u_char
+pointer to the data in that packet.
+The
+.I pcap_pkthdr
+structure pointed to by
+.I h
+is filled in with the appropriate values for the packet.
+.SH RETURN VALUE
+.B pcap_next_ex()
+returns 1 if the packet was read without problems, 0
+if packets are being read from a live capture, and the timeout expired,
+\-1 if an error occurred while reading the packet, and \-2 if
+packets are being read from a ``savefile'', and there are no more
+packets to read from the savefile.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.PP
+.B pcap_next()
+returns a pointer to the packet data on success, and returns
+.B NULL
+if an error occured, or if no packets were read from a live
+capture (if, for example, they were discarded because they didn't pass
+the packet filter, or if, on platforms that support a read timeout that
+starts before any packets arrive, the timeout expires before any packets
+arrive, or if the file descriptor for the capture device is in
+non-blocking mode and no packets were available to be read), or if no
+more packets are available in a ``savefile.''  Unfortunately, there is
+no way to determine whether an error occured or not.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP)
diff --git a/contrib/libpcap/pcap_offline_filter.3pcap b/contrib/libpcap/pcap_offline_filter.3pcap
new file mode 100644
index 0000000..0ec6977
--- /dev/null
+++ b/contrib/libpcap/pcap_offline_filter.3pcap
@@ -0,0 +1,57 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_offline_filter.3pcap,v 1.1.2.1 2008-05-13 15:20:44 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_OFFLINE_FILTER 3PCAP "13 May 2008"
+.SH NAME
+pcap_offline_filter \- check whether a filter matches a packet
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_offline_filter(struct bpf_program *fp,
+.ti +8
+const struct pcap_pkthdr *h, const u_char *pkt)
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_offline_filter()
+checks whether a filter matches a packet.
+.I fp
+is a pointer to a
+.I bpf_program
+struct, usually the result of a call to
+.BR pcap_compile() .
+.I h
+points to the
+.I pcap_pkthdr
+structure for the packet, and
+.I pkt
+points to the data in the packet.
+.SH RETURN VALUE
+.B pcap_offline_filter()
+returns the return value of the filter program.  This will be zero if
+the packet doesn't match the filter and non-zero if the packet matches
+the filter.
+.SH SEE ALSO
+pcap(3PCAP), pcap_compile(3PCAP)
diff --git a/contrib/libpcap/pcap_open_dead.3pcap b/contrib/libpcap/pcap_open_dead.3pcap
new file mode 100644
index 0000000..29b8f7a
--- /dev/null
+++ b/contrib/libpcap/pcap_open_dead.3pcap
@@ -0,0 +1,52 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_dead.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_OPEN_DEAD 3PCAP "5 April 2008"
+.SH NAME
+pcap_open_dead \- open a fake pcap_t for compiling filters or opening a
+capture for output
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+pcap_t *pcap_open_dead(int linktype, int snaplen);
+.ft
+.fi
+.SH DESCRIPTION
+.PP
+.B pcap_open_dead()
+is used for creating a
+.B pcap_t
+structure to use when calling the other functions in libpcap.  It is
+typically used when just using libpcap for compiling BPF code.
+.PP
+.I linktype
+specifies the link-layer type for the
+.BR pcap_t .
+.PP
+.I snaplen
+specifies the snapshot length for the
+.BR pcap_t .
+.SH SEE ALSO
+pcap(3PCAP), pcap-linktype(7)
diff --git a/contrib/libpcap/pcap_open_dead.3pcap.in b/contrib/libpcap/pcap_open_dead.3pcap.in
new file mode 100644
index 0000000..18c98ff
--- /dev/null
+++ b/contrib/libpcap/pcap_open_dead.3pcap.in
@@ -0,0 +1,52 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_dead.3pcap.in,v 1.1.2.2 2008-10-21 07:44:57 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_OPEN_DEAD 3PCAP "5 April 2008"
+.SH NAME
+pcap_open_dead \- open a fake pcap_t for compiling filters or opening a
+capture for output
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+pcap_t *pcap_open_dead(int linktype, int snaplen);
+.ft
+.fi
+.SH DESCRIPTION
+.PP
+.B pcap_open_dead()
+is used for creating a
+.B pcap_t
+structure to use when calling the other functions in libpcap.  It is
+typically used when just using libpcap for compiling BPF code.
+.PP
+.I linktype
+specifies the link-layer type for the
+.BR pcap_t .
+.PP
+.I snaplen
+specifies the snapshot length for the
+.BR pcap_t .
+.SH SEE ALSO
+pcap(3PCAP), pcap-linktype(@MAN_MISC_INFO@)
diff --git a/contrib/libpcap/pcap_open_live.3pcap b/contrib/libpcap/pcap_open_live.3pcap
new file mode 100644
index 0000000..6ef1d5f
--- /dev/null
+++ b/contrib/libpcap/pcap_open_live.3pcap
@@ -0,0 +1,89 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_live.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_OPEN_LIVE 3PCAP "5 April 2008"
+.SH NAME
+pcap_open_live \- open a device for capturing
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+pcap_t *pcap_open_live(const char *device, int snaplen,
+.ti +8
+int promisc, int to_ms, char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_open_live()
+is used to obtain a packet capture handle to look
+at packets on the network.
+.I device
+is a string that specifies the network device to open; on Linux systems
+with 2.2 or later kernels, a
+.I device
+argument of "any" or
+.B NULL
+can be used to capture packets from all interfaces.
+.PP
+.I snaplen
+specifies the snapshot length to be set on the handle.
+.PP
+.I promisc
+specifies if the interface is to be put into promiscuous mode.
+.PP
+.I to_ms
+specifies the read timeout in milliseconds.
+.SH RETURN VALUE
+.B pcap_open_live()
+returns a
+.I pcap_t *
+on success and
+.B NULL
+on failure.
+If
+.B NULL
+is returned,
+.I errbuf
+is filled in with an appropriate error message.
+.I errbuf
+may also be set to warning text when
+.B pcap_open_live()
+succeds; to detect this case the caller should store a zero-length string in
+.I errbuf
+before calling
+.B pcap_open_live()
+and display the warning to the user if
+.I errbuf
+is no longer a zero-length string.
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
diff --git a/contrib/libpcap/pcap_open_offline.3pcap b/contrib/libpcap/pcap_open_offline.3pcap
new file mode 100644
index 0000000..c89b867
--- /dev/null
+++ b/contrib/libpcap/pcap_open_offline.3pcap
@@ -0,0 +1,78 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_offline.3pcap.in,v 1.1.2.2 2008-10-23 05:59:43 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_OPEN_OFFLINE 3PCAP "5 April 2008"
+.SH NAME
+pcap_open_offline, pcap_fopen_offline \- open a saved capture file for reading
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+pcap_t *pcap_open_offline(const char *fname, char *errbuf);
+pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_open_offline()
+is called to open a ``savefile'' for reading.
+.PP
+.I fname
+specifies the name of the file to open. The file has
+the same format as those used by
+.BR tcpdump (1)
+and
+.BR tcpslice (1).
+The name "-" in a synonym for
+.BR stdin .
+.PP
+Alternatively, you may call
+.B pcap_fopen_offline()
+to read dumped data from an existing open stream
+.IR fp .
+Note that on Windows, that stream should be opened in binary mode.
+.SH RETURN VALUE
+.B pcap_open_offline()
+and
+.B pcap_fopen_offline()
+return a
+.I pcap_t *
+on success and
+.B NULL
+on failure.
+If
+.B NULL
+is returned,
+.I errbuf
+is filled in with an appropriate error message.
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP), pcap-savefile(5)
diff --git a/contrib/libpcap/pcap_open_offline.3pcap.in b/contrib/libpcap/pcap_open_offline.3pcap.in
new file mode 100644
index 0000000..ce350dd
--- /dev/null
+++ b/contrib/libpcap/pcap_open_offline.3pcap.in
@@ -0,0 +1,78 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_open_offline.3pcap.in,v 1.1.2.2 2008-10-23 05:59:43 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_OPEN_OFFLINE 3PCAP "5 April 2008"
+.SH NAME
+pcap_open_offline, pcap_fopen_offline \- open a saved capture file for reading
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+pcap_t *pcap_open_offline(const char *fname, char *errbuf);
+pcap_t *pcap_fopen_offline(FILE *fp, char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_open_offline()
+is called to open a ``savefile'' for reading.
+.PP
+.I fname
+specifies the name of the file to open. The file has
+the same format as those used by
+.BR tcpdump (1)
+and
+.BR tcpslice (1).
+The name "-" in a synonym for
+.BR stdin .
+.PP
+Alternatively, you may call
+.B pcap_fopen_offline()
+to read dumped data from an existing open stream
+.IR fp .
+Note that on Windows, that stream should be opened in binary mode.
+.SH RETURN VALUE
+.B pcap_open_offline()
+and
+.B pcap_fopen_offline()
+return a
+.I pcap_t *
+on success and
+.B NULL
+on failure.
+If
+.B NULL
+is returned,
+.I errbuf
+is filled in with an appropriate error message.
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP), pcap-savefile(@MAN_FILE_FORMATS@)
diff --git a/contrib/libpcap/pcap_set_buffer_size.3pcap b/contrib/libpcap/pcap_set_buffer_size.3pcap
new file mode 100644
index 0000000..d26a7a5
--- /dev/null
+++ b/contrib/libpcap/pcap_set_buffer_size.3pcap
@@ -0,0 +1,47 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_set_buffer_size.3pcap,v 1.1.2.1 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SET_BUFFER_SIZE 3PCAP "5 April 2008"
+.SH NAME
+pcap_set_buffer_size \- set the buffer size for a not-yet-activated
+capture handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+int pcap_set_buffer_size(pcap_t *p, int buffer_size);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_set_buffer_size()
+sets the buffer size that will be used on a capture handle when
+the handle is activated to
+.IR buffer_size ,
+which is in units of bytes.
+.SH RETURN VALUE
+.B pcap_set_buffer_size()
+returns 0 on success or
+.B PCAP_ERROR_ACTIVATED
+if called on a capture handle that has been activated.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
diff --git a/contrib/libpcap/pcap_set_datalink.3pcap b/contrib/libpcap/pcap_set_datalink.3pcap
new file mode 100644
index 0000000..5754d76
--- /dev/null
+++ b/contrib/libpcap/pcap_set_datalink.3pcap
@@ -0,0 +1,52 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_set_datalink.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SET_DATALINK 3PCAP "5 April 2008"
+.SH NAME
+pcap_set_datalink \- set the link-layer header type to be used by a
+capture device
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_set_datalink(pcap_t *p, int dlt);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_set_datalink()
+is used to set the current data link type of the pcap descriptor
+to the type specified by
+.IR dlt .
+.SH RETURN VALUE
+.B pcap_set_datalink()
+returns 0 on success and \-1 on failure.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP)
diff --git a/contrib/libpcap/pcap_set_promisc.3pcap b/contrib/libpcap/pcap_set_promisc.3pcap
new file mode 100644
index 0000000..27c0714
--- /dev/null
+++ b/contrib/libpcap/pcap_set_promisc.3pcap
@@ -0,0 +1,48 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_set_promisc.3pcap,v 1.1.2.1 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SET_PROMISC 3PCAP "5 April 2008"
+.SH NAME
+pcap_set_promisc \- set promiscuous mode for a not-yet-activated
+capture handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+int pcap_set_promisc(pcap_t *p, int promisc);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_set_promisc()
+sets whether promiscuous mode should be set on a capture handle when
+the handle is activated.
+If
+.I promisc
+is non-zero, promiscuous mode will be set, otherwise it will not be set.
+.SH RETURN VALUE
+.B pcap_set_promisc()
+returns 0 on success or
+.B PCAP_ERROR_ACTIVATED
+if called on a capture handle that has been activated.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
diff --git a/contrib/libpcap/pcap_set_rfmon.3pcap b/contrib/libpcap/pcap_set_rfmon.3pcap
new file mode 100644
index 0000000..ceb62a6
--- /dev/null
+++ b/contrib/libpcap/pcap_set_rfmon.3pcap
@@ -0,0 +1,49 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_set_rfmon.3pcap,v 1.1.2.1 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SET_RFMON 3PCAP "5 April 2008"
+.SH NAME
+pcap_set_rfmon \- set monitor mode for a not-yet-activated capture
+handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+int pcap_set_rfmon(pcap_t *p, int rfmon);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_set_rfmon()
+sets whether monitor mode should be set on a capture handle when
+the handle is activated.
+If
+.I rfmon
+is non-zero, monitor mode will be set, otherwise it will not be set.
+.SH RETURN VALUE
+.B pcap_set_rfmon()
+returns 0 on success or
+.B PCAP_ERROR_ACTIVATED
+if called on a capture handle that has been activated.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
+pcap_can_set_rfmon(3PCAP)
diff --git a/contrib/libpcap/pcap_set_snaplen.3pcap b/contrib/libpcap/pcap_set_snaplen.3pcap
new file mode 100644
index 0000000..10093e4
--- /dev/null
+++ b/contrib/libpcap/pcap_set_snaplen.3pcap
@@ -0,0 +1,46 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_set_snaplen.3pcap,v 1.1.2.1 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SET_SNAPLEN 3PCAP "5 April 2008"
+.SH NAME
+pcap_set_snaplen \- set the snapshot length for a not-yet-activated
+capture handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+int pcap_set_snaplen(pcap_t *p, int snaplen);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_set_snaplen()
+sets the snapshot length to be used on a capture handle when the handle
+is activated to
+.IR snaplen .
+.SH RETURN VALUE
+.B pcap_set_snaplen()
+returns 0 on success or
+.B PCAP_ERROR_ACTIVATED
+if called on a capture handle that has been activated.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
diff --git a/contrib/libpcap/pcap_set_timeout.3pcap b/contrib/libpcap/pcap_set_timeout.3pcap
new file mode 100644
index 0000000..17f2c31
--- /dev/null
+++ b/contrib/libpcap/pcap_set_timeout.3pcap
@@ -0,0 +1,47 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_set_timeout.3pcap,v 1.1.2.1 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SET_TIMEOUT 3PCAP "5 April 2008"
+.SH NAME
+pcap_set_timeout \- set the read timeout for a not-yet-activated
+capture handle
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.LP
+.ft B
+int pcap_set_timeout(pcap_t *p, int to_ms);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_set_timeout()
+sets the read timeout that will be used on a capture handle when
+the handle is activated to
+.IR to_ms ,
+which is in units of milliseconds.
+.SH RETURN VALUE
+.B pcap_set_timeout()
+returns 0 on success or
+.B PCAP_ERROR_ACTIVATED
+if called on a capture handle that has been activated.
+.SH SEE ALSO
+pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP)
diff --git a/contrib/libpcap/pcap_setdirection.3pcap b/contrib/libpcap/pcap_setdirection.3pcap
new file mode 100644
index 0000000..70891a2
--- /dev/null
+++ b/contrib/libpcap/pcap_setdirection.3pcap
@@ -0,0 +1,71 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_setdirection.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SETDIRECTION 3PCAP "5 April 2008"
+.SH NAME
+pcap_setdirection \- set the direction for which packets will be captured
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_setdirection(pcap_t *p, pcap_direction_t d);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_setdirection()
+is used to specify a direction that packets will be captured.
+.I d
+is one of the constants
+.BR PCAP_D_IN ,
+.B PCAP_D_OUT
+or 
+.BR PCAP_D_INOUT .
+.B PCAP_D_IN
+will only capture packets received by the device,
+.B PCAP_D_OUT
+will only capture packets sent by the device and
+.B PCAP_D_INOUT
+will capture packets received by or sent by the device.
+.B PCAP_D_INOUT
+is the default setting if this function is not called.
+.PP
+.B pcap_setdirection()
+isn't necessarily fully supported on all platforms; some platforms might
+return an error for all values, and some other platforms might not
+support
+.BR PCAP_D_OUT .
+.PP
+This operation is not supported if a ``savefile'' is being read.
+.SH RETURN VALUE
+.B pcap_setdirection()
+returns 0 on success and \-1 on failure.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP)
diff --git a/contrib/libpcap/pcap_setfilter.3pcap b/contrib/libpcap/pcap_setfilter.3pcap
new file mode 100644
index 0000000..67c1214
--- /dev/null
+++ b/contrib/libpcap/pcap_setfilter.3pcap
@@ -0,0 +1,54 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_setfilter.3pcap,v 1.1.2.4 2008-05-13 15:20:44 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SETFILTER 3PCAP "5 April 2008"
+.SH NAME
+pcap_setfilter \- set the filter
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_setfilter(pcap_t *p, struct bpf_program *fp);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_setfilter()
+is used to specify a filter program.
+.I fp
+is a pointer to a
+.I bpf_program
+struct, usually the result of a call to
+.BR pcap_compile() .
+.SH RETURN VALUE
+.B pcap_setfilter()
+returns 0 on success and \-1 on failure.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_compile(3PCAP), pcap_geterr(3PCAP)
diff --git a/contrib/libpcap/pcap_setnonblock.3pcap b/contrib/libpcap/pcap_setnonblock.3pcap
new file mode 100644
index 0000000..07d9629
--- /dev/null
+++ b/contrib/libpcap/pcap_setnonblock.3pcap
@@ -0,0 +1,75 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_setnonblock.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SETNONBLOCK 3PCAP "5 April 2008"
+.SH NAME
+pcap_setnonblock, pcap_getnonblock \- set or get the state of
+non-blocking mode on a capture device
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.nf
+.ft B
+char errbuf[PCAP_ERRBUF_SIZE];
+.ft
+.LP
+.ft B
+int pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf);
+int pcap_getnonblock(pcap_t *p, char *errbuf);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_setnonblock()
+puts a capture handle into ``non-blocking'' mode, or takes it out
+of ``non-blocking'' mode, depending on whether the
+.I nonblock
+argument is non-zero or zero.  It has no effect on ``savefiles''.
+If there is an error, \-1 is returned and
+.I errbuf
+is filled in with an appropriate error message; otherwise, 0 is
+returned.
+In
+``non-blocking'' mode, an attempt to read from the capture descriptor
+with
+.B pcap_dispatch()
+will, if no packets are currently available to be read, return 0
+immediately rather than blocking waiting for packets to arrive.
+.B pcap_loop()
+and
+.B pcap_next()
+will not work in ``non-blocking'' mode.
+.SH RETURN VALUE
+.B pcap_getnonblock()
+returns the current ``non-blocking'' state of the capture descriptor; it
+always returns 0 on ``savefiles''.
+If there is an error, \-1 is returned and
+.I errbuf
+is filled in with an appropriate error message.
+.PP
+.I errbuf
+is assumed to be able to hold at least
+.B PCAP_ERRBUF_SIZE
+chars.
+.SH SEE ALSO
+pcap(3PCAP), pcap_loop(3PCAP), pcap_next_ex(3PCAP), pcap_geterr(3PCAP)
diff --git a/contrib/libpcap/pcap_snapshot.3pcap b/contrib/libpcap/pcap_snapshot.3pcap
new file mode 100644
index 0000000..19bb9de
--- /dev/null
+++ b/contrib/libpcap/pcap_snapshot.3pcap
@@ -0,0 +1,44 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_snapshot.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SNAPSHOT 3PCAP "5 April 2008"
+.SH NAME
+pcap_snapshot \- get the snapshot length
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_snapshot(pcap_t *p);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_snapshot()
+returns the snapshot length specified when
+.B pcap_set_snapshot()
+or
+.B pcap_open_live()
+was called, for a live capture, or the snapshot length from the capture
+file, for a ``savefile''.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_stats.3pcap b/contrib/libpcap/pcap_stats.3pcap
new file mode 100644
index 0000000..0a68c1e
--- /dev/null
+++ b/contrib/libpcap/pcap_stats.3pcap
@@ -0,0 +1,59 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_stats.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_SNAPSHOT 3PCAP "5 April 2008"
+.SH NAME
+pcap_stats \- get capture statistics
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+int pcap_stats(pcap_t *p, struct pcap_stat *ps);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_stats()
+fills in the
+.I pcap_stat
+structure pointed to by its second argument.  The values represent
+packet statistics from the start of the run to the time of the call.
+.PP
+.B pcap_stats()
+is supported only on live captures, not on ``savefiles''; no statistics
+are stored in ``savefiles'', so no statistics are available when reading
+from a ``savefile''.
+.SH RETURN VALUE
+.B pcap_stats()
+returns 0 on success and returns \-1 if there is an error or the
+.I p
+doesn't support packet statistics.
+If \-1 is returned,
+.B pcap_geterr()
+or
+.B pcap_perror()
+may be called with
+.I p
+as an argument to fetch or display the error text.
+.SH SEE ALSO
+pcap(3PCAP), pcap_geterr(3PCAP)
diff --git a/contrib/libpcap/pcap_statustostr.3pcap b/contrib/libpcap/pcap_statustostr.3pcap
new file mode 100644
index 0000000..5e8942c
--- /dev/null
+++ b/contrib/libpcap/pcap_statustostr.3pcap
@@ -0,0 +1,43 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_statustostr.3pcap,v 1.1.2.1 2008-04-09 21:41:53 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_STATUSTOSTR 3PCAP "9 April 2008"
+.SH NAME
+pcap_statustostr \- convert a PCAP_ERROR_ or PCAP_WARNING_ value to a string
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+const char *pcap_statustostr(int error);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_statustostr()
+converts a
+.B PCAP_ERROR_
+or
+.B PCAP_WARNING_
+value returned by a libpcap routine to an error string.
+.SH SEE ALSO
+pcap(3PCAP)
diff --git a/contrib/libpcap/pcap_strerror.3pcap b/contrib/libpcap/pcap_strerror.3pcap
new file mode 100644
index 0000000..eacdce4
--- /dev/null
+++ b/contrib/libpcap/pcap_strerror.3pcap
@@ -0,0 +1,42 @@
+.\" @(#) $Header: /tcpdump/master/libpcap/pcap_strerror.3pcap,v 1.1.2.3 2008-04-06 03:21:56 guy Exp $
+.\"
+.\" Copyright (c) 1994, 1996, 1997
+.\"	The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH PCAP_STRERROR 3PCAP "4 April 2008"
+.SH NAME
+pcap_strerror \- convert an errno value to a string
+.SH SYNOPSIS
+.nf
+.ft B
+#include <pcap/pcap.h>
+.ft
+.LP
+.ft B
+const char *pcap_strerror(int error);
+.ft
+.fi
+.SH DESCRIPTION
+.B pcap_strerror()
+is provided in case
+.BR strerror (3)
+isn't available.  It returns an error message string corresponding to
+.IR error .
+.SH SEE ALSO
+strerror(3)
diff --git a/contrib/libpcap/runlex.sh b/contrib/libpcap/runlex.sh
new file mode 100755
index 0000000..497a618
--- /dev/null
+++ b/contrib/libpcap/runlex.sh
@@ -0,0 +1,235 @@
+#! /bin/sh
+
+#
+# runlex.sh
+# Script to run Lex/Flex.
+# First argument is the (quoted) name of the command; if it's null, that
+# means that neither Flex nor Lex was found, so we report an error and
+# quit.
+#
+# @(#) $Header: /tcpdump/master/libpcap/runlex.sh,v 1.1.2.4 2007/12/31 03:39:06 guy Exp $
+#
+
+#
+# Get the name of the command to run, and then shift to get the arguments.
+#
+if [ $# -eq 0 ]
+then
+	echo "Usage: runlex <lex/flex command to run> [ arguments ]" 1>&2
+	exit 1
+fi
+LEX="$1"
+shift
+
+#
+# Check whether we have Lex or Flex.
+#
+if [ -z "${LEX}" ]
+then
+	echo "Neither lex nor flex was found" 1>&2
+	exit 1
+fi
+
+#
+# Process the flags.  We don't use getopt because we don't want to
+# embed complete knowledge of what options are supported by Lex/Flex.
+#
+flags=""
+outfile=lex.yy.c
+while [ $# -ne 0 ]
+do
+	case "$1" in
+
+	-o*)
+		#
+		# Set the output file name.
+		#
+		outfile=`echo "$1" | sed 's/-o\(.*\)/\1/'`
+		;;
+
+	-*)
+		#
+		# Add this to the list of flags.
+		#
+		flags="$flags $1"
+		;;
+
+	--|*)
+		#
+		# End of flags.
+		#
+		break
+		;;
+	esac
+	shift
+done
+
+#
+# Is it Lex, or is it Flex?
+#
+if [ "${LEX}" = flex ]
+then
+	#
+	# It's Flex.
+	#
+	have_flex=yes
+
+	#
+	# Does it support the --noFUNCTION options?  If so, we pass
+	# --nounput, as at least some versions that support those
+	# options don't support disabling yyunput by defining
+	# YY_NO_UNPUT.
+	#
+	if flex --help | egrep noFUNCTION >/dev/null
+	then
+		flags="$flags --nounput"
+
+		#
+		# Does it support -R, for generating reentrant scanners?
+		# If so, we're not currently using that feature, but
+		# it'll generate some unused functions anyway - and there
+		# won't be any header file declaring them, so there'll be
+		# defined-but-not-declared warnings.  Therefore, we use
+		# --noFUNCTION options to suppress generating those
+		# functions.
+		#
+		if flex --help | egrep reentrant >/dev/null
+		then
+			flags="$flags --noyyget_lineno --noyyget_in --noyyget_out --noyyget_leng --noyyget_text --noyyset_lineno --noyyset_in --noyyset_out"
+		fi
+	fi
+else
+	#
+	# It's Lex.
+	#
+	have_flex=no
+fi
+
+#
+# OK, run it.
+# If it's lex, it doesn't support -o, so we just write to
+# lex.yy.c and, if it succeeds, rename it to the right name,
+# otherwise we remove lex.yy.c.
+# If it's flex, it supports -o, so we use that - flex with -P doesn't
+# write to lex.yy.c, it writes to a lex.{prefix from -P}.c.
+#
+if [ $have_flex = yes ]
+then
+	${LEX} $flags -o"$outfile" "$@"
+
+	#
+	# Did it succeed?
+	#
+	status=$?
+	if [ $status -ne 0 ]
+	then
+		#
+		# No.  Exit with the failing exit status.
+		#
+		exit $status
+	fi
+
+	#
+	# Flex has the annoying habit of stripping all but the last
+	# component of the "-o" flag argument and using that as the
+	# place to put the output.  This gets in the way of building
+	# in a directory different from the source directory.  Try
+	# to work around this.
+	#
+	# Is the outfile where we think it is?
+	#
+	outfile_base=`basename "$outfile"`
+	if [ "$outfile_base" != "$outfile" -a \( ! -r "$outfile" \) -a -r "$outfile_base" ]
+	then
+		#
+		# No, it's not, but it is in the current directory.  Put it
+		# where it's supposed to be.
+		#
+		mv "$outfile_base" "$outfile"
+
+		#
+		# Did that succeed?
+		#
+		status=$?
+		if [ $status -ne 0 ]
+		then
+			#
+			# No.  Exit with the failing exit status.
+			#
+			exit $status
+		fi
+	fi
+else
+	${LEX} $flags "$@"
+
+	#
+	# Did it succeed?
+	#
+	status=$?
+	if [ $status -ne 0 ]
+	then
+		#
+		# No.  Get rid of any lex.yy.c file we generated, and
+		# exit with the failing exit status.
+		#
+		rm -f lex.yy.c
+		exit $status
+	fi
+
+	#
+	# OK, rename lex.yy.c to the right output file.
+	#
+	mv lex.yy.c "$outfile" 
+
+	#
+	# Did that succeed?
+	#
+	status=$?
+	if [ $status -ne 0 ]
+	then
+		#
+		# No.  Get rid of any lex.yy.c file we generated, and
+		# exit with the failing exit status.
+		#
+		rm -f lex.yy.c
+		exit $status
+	fi
+fi
+
+#
+# OK, now let's generate a header file declaring the relevant functions
+# defined by the .c file; if the .c file is .../foo.c, the header file
+# will be .../foo.h.
+#
+# This works around some other Flex suckage, wherein it doesn't declare
+# the lex routine before defining it, causing compiler warnings.
+# XXX - newer versions of Flex support --header-file=, to generate the
+# appropriate header file.  With those versions, we should use that option.
+#
+
+#
+# Get the name of the prefix; scan the source files for a %option prefix
+# line.  We use the last one.
+#
+prefix=`sed -n 's/%option[ 	][ 	]*prefix="\(.*\)".*/\1/p' "$@" | tail -1`
+if [ ! -z "$prefix" ]
+then
+	prefixline="#define yylex ${prefix}lex"
+fi
+
+#
+# Construct the name of the header file.
+#
+header_file=`dirname "$outfile"`/`basename "$outfile" .c`.h
+
+#
+# Spew out the declaration.
+#
+cat <<EOF >$header_file
+/* This is generated by runlex.sh.  Do not edit it. */
+$prefixline
+#ifndef YY_DECL
+#define YY_DECL int yylex(void)
+#endif  
+YY_DECL;
+EOF
diff --git a/contrib/libpcap/savefile.c b/contrib/libpcap/savefile.c
index 09396f7..90619cc 100644
--- a/contrib/libpcap/savefile.c
+++ b/contrib/libpcap/savefile.c
@@ -30,7 +30,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.126.2.30 2007/08/14 20:57:49 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.168.2.10 2008-10-06 15:38:39 gianluca Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -44,6 +44,7 @@ static const char rcsid[] _U_ =
 #include <string.h>
 
 #include "pcap-int.h"
+#include "pcap/usb.h"
 
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
@@ -146,11 +147,12 @@ static const char rcsid[] _U_ =
  *
  * In order to ensure that a given LINKTYPE_* code's value will refer to
  * the same encapsulation type on all platforms, you should not allocate
- * a new LINKTYPE_* value without consulting "tcpdump-workers@tcpdump.org".
- * The tcpdump developers will allocate a value for you, and will not
- * subsequently allocate it to anybody else; that value will be added to
- * the "pcap.h" in the tcpdump.org CVS repository, so that a future
- * libpcap release will include it.
+ * a new LINKTYPE_* value without consulting
+ * "tcpdump-workers@lists.tcpdump.org".  The tcpdump developers will
+ * allocate a value for you, and will not subsequently allocate it to
+ * anybody else; that value will be added to the "pcap.h" in the
+ * tcpdump.org CVS repository, so that a future libpcap release will
+ * include it.
  *
  * You should, if possible, also contribute patches to libpcap and tcpdump
  * to handle the new encapsulation type, so that they can also be checked
@@ -312,9 +314,9 @@ static const char rcsid[] _U_ =
  * for *their* private type and tools using them for *your* private type
  * would have to read them.
  *
- * Instead, in those cases, ask "tcpdump-workers@tcpdump.org" for a new DLT_
- * and LINKTYPE_ value, as per the comment in pcap-bpf.h, and use the type
- * you're given.
+ * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a
+ * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use
+ * the type you're given.
  */
 #define LINKTYPE_USER0		147
 #define LINKTYPE_USER1		148
@@ -551,6 +553,100 @@ static const char rcsid[] _U_ =
  */
 #define LINKTYPE_IPMB		199
 
+/*
+ * Juniper-private data link type, as per request from
+ * Hannes Gredler <hannes@juniper.net>. 
+ * The DLT_ is used for capturing data on a secure tunnel interface.
+ */
+#define LINKTYPE_JUNIPER_ST     200
+
+/*
+ * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
+ * that includes direction information; requested by Paolo Abeni.
+ */
+#define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR	201
+
+/*
+ * AX.25 packet with a 1-byte KISS header; see
+ *
+ *	http://www.ax25.net/kiss.htm
+ *
+ * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
+ */
+#define LINKTYPE_AX25_KISS	202
+
+/*
+ * LAPD packets from an ISDN channel, starting with the address field,
+ * with no pseudo-header.
+ * Requested by Varuna De Silva <varunax@gmail.com>.
+ */
+#define LINKTYPE_LAPD		203
+
+/*
+ * Variants of various link-layer headers, with a one-byte direction
+ * pseudo-header prepended - zero means "received by this host",
+ * non-zero (any non-zero value) means "sent by this host" - as per
+ * Will Barker <w.barker@zen.co.uk>.
+ */
+#define LINKTYPE_PPP_WITH_DIR	204	/* PPP */
+#define LINKTYPE_C_HDLC_WITH_DIR 205	/* Cisco HDLC */
+#define LINKTYPE_FRELAY_WITH_DIR 206	/* Frame Relay */
+#define LINKTYPE_LAPB_WITH_DIR	207	/* LAPB */
+
+/*
+ * 208 is reserved for an as-yet-unspecified proprietary link-layer
+ * type, as requested by Will Barker.
+ */
+
+/*
+ * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
+ * <avn@pigeonpoint.com>.
+ */
+#define LINKTYPE_IPMB_LINUX		209
+
+/*
+ * FlexRay automotive bus - http://www.flexray.com/ - as requested
+ * by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define LINKTYPE_FLEXRAY		210
+
+/*
+ * Media Oriented Systems Transport (MOST) bus for multimedia
+ * transport - http://www.mostcooperation.com/ - as requested
+ * by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define LINKTYPE_MOST			211
+
+/*
+ * Local Interconnect Network (LIN) bus for vehicle networks -
+ * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
+ * <hannes.kaelber@x2e.de>.
+ */
+#define LINKTYPE_LIN			212
+
+/*
+ * X2E-private data link type used for serial line capture,
+ * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define LINKTYPE_X2E_SERIAL		213
+
+/*
+ * X2E-private data link type used for the Xoraya data logger
+ * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
+ */
+#define LINKTYPE_X2E_XORAYA		214
+
+/*
+ * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
+ * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
+ * of 0 as preamble, one octet of SFD, one octet of frame length+
+ * reserved bit, and then the MAC-layer data, starting with the
+ * frame control field).
+ *
+ * Requested by Max Filippov <jcmvbkbc@gmail.com>.
+ */
+#define LINKTYPE_IEEE802_15_4_NONASK_PHY	215
+
 
 static struct linktype_map {
 	int	dlt;
@@ -814,9 +910,66 @@ static struct linktype_map {
 	/* enc0 device */
 	{ DLT_ENC, LINKTYPE_ENC },
 
+        /* Juniper Secure Tunnel */
+        { DLT_JUNIPER_ST,       LINKTYPE_JUNIPER_ST },
+
+	/* Bluetooth HCI UART transport layer, with pseudo-header */
+	{ DLT_BLUETOOTH_HCI_H4_WITH_PHDR, LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR },
+
+	/* AX.25 with KISS header */
+	{ DLT_AX25_KISS,	LINKTYPE_AX25_KISS },
+
+	/* Raw LAPD, with no pseudo-header */
+	{ DLT_LAPD,		LINKTYPE_LAPD },
+
+	/* PPP with one-byte pseudo-header giving direction */
+	{ DLT_PPP_WITH_DIR,	LINKTYPE_PPP_WITH_DIR },
+
+	/* Cisco HDLC with one-byte pseudo-header giving direction */
+	{ DLT_C_HDLC_WITH_DIR,	LINKTYPE_C_HDLC_WITH_DIR },
+
+	/* Frame Relay with one-byte pseudo-header giving direction */
+	{ DLT_FRELAY_WITH_DIR,	LINKTYPE_FRELAY_WITH_DIR },
+
+	/* LAPB with one-byte pseudo-header giving direction */
+	{ DLT_LAPB_WITH_DIR,	LINKTYPE_LAPB_WITH_DIR },
+
+	/* IPMB with Linux pseudo-header */
+	{ DLT_IPMB_LINUX,	LINKTYPE_IPMB_LINUX },
+
+	/* FlexRay */
+	{ DLT_FLEXRAY,		LINKTYPE_FLEXRAY },
+
+	/* MOST */
+	{ DLT_MOST,		LINKTYPE_MOST },
+
+	/* LIN */
+	{ DLT_LIN,		LINKTYPE_LIN },
+
+	/* X2E-private serial line capture */
+	{ DLT_X2E_SERIAL,	LINKTYPE_X2E_SERIAL },
+
+	/* X2E-private for Xoraya data logger family */
+	{ DLT_X2E_XORAYA,	LINKTYPE_X2E_XORAYA },
+
+	/* IEEE 802.15.4 with PHY data for non-ASK PHYs */
+	{ DLT_IEEE802_15_4_NONASK_PHY, LINKTYPE_IEEE802_15_4_NONASK_PHY },
+
 	{ -1,			-1 }
 };
 
+/*
+ * Mechanism for storing information about a capture in the upper
+ * 6 bits of a linktype value in a capture file.
+ *
+ * LT_LINKTYPE_EXT(x) extracts the additional information.
+ *
+ * The rest of the bits are for a value describing the link-layer
+ * value.  LT_LINKTYPE(x) extracts that value.
+ */
+#define LT_LINKTYPE(x)		((x) & 0x03FFFFFF)
+#define LT_LINKTYPE_EXT(x)	((x) & 0xFC000000)
+
 static int
 dlt_to_linktype(int dlt)
 {
@@ -912,6 +1065,32 @@ sf_stats(pcap_t *p, struct pcap_stat *ps)
 	return (-1);
 }
 
+#ifdef WIN32
+static int
+sf_setbuff(pcap_t *p, int dim)
+{
+	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+	    "The kernel buffer size cannot be set while reading from a file");
+	return (-1);
+}
+
+static int
+sf_setmode(pcap_t *p, int mode)
+{
+	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+	    "impossible to set mode while reading from a file");
+	return (-1);
+}
+
+static int
+sf_setmintocopy(pcap_t *p, int size)
+{
+	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+	    "The mintocopy parameter cannot be set while reading from a file");
+	return (-1);
+}
+#endif
+
 static int
 sf_inject(pcap_t *p, const void *buf _U_, size_t size _U_)
 {
@@ -933,7 +1112,7 @@ sf_setdirection(pcap_t *p, pcap_direction_t d)
 }
 
 static void
-sf_close(pcap_t *p)
+sf_cleanup(pcap_t *p)
 {
 	if (p->sf.rfile != stdin)
 		(void)fclose(p->sf.rfile);
@@ -978,6 +1157,33 @@ pcap_open_offline(const char *fname, char *errbuf)
 	return (p);
 }
 
+#ifdef WIN32
+pcap_t* pcap_hopen_offline(intptr_t osfd, char *errbuf)
+{
+	int fd;
+	FILE *file;
+
+	fd = _open_osfhandle(osfd, _O_RDONLY);
+	if ( fd < 0 ) 
+	{
+		snprintf(errbuf, PCAP_ERRBUF_SIZE, pcap_strerror(errno));
+		return NULL;
+	}
+
+	file = _fdopen(fd, "rb");
+	if ( file == NULL ) 
+	{
+		snprintf(errbuf, PCAP_ERRBUF_SIZE, pcap_strerror(errno));
+		return NULL;
+	}
+
+	return pcap_fopen_offline(file, errbuf);
+}
+#endif
+
+#ifdef WIN32
+static
+#endif
 pcap_t *
 pcap_fopen_offline(FILE *fp, char *errbuf)
 {
@@ -1047,7 +1253,8 @@ pcap_fopen_offline(FILE *fp, char *errbuf)
 	}
 	p->tzoff = hdr.thiszone;
 	p->snapshot = hdr.snaplen;
-	p->linktype = linktype_to_dlt(hdr.linktype);
+	p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
+	p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
 	if (magic == KUZNETZOV_TCPDUMP_MAGIC && p->linktype == DLT_EN10MB) {
 		/*
 		 * This capture might have been done in raw mode or cooked
@@ -1160,7 +1367,13 @@ pcap_fopen_offline(FILE *fp, char *errbuf)
 	p->getnonblock_op = sf_getnonblock;
 	p->setnonblock_op = sf_setnonblock;
 	p->stats_op = sf_stats;
-	p->close_op = sf_close;
+#ifdef WIN32
+	p->setbuff_op = sf_setbuff;
+	p->setmode_op = sf_setmode;
+	p->setmintocopy_op = sf_setmintocopy;
+#endif
+	p->cleanup_op = sf_cleanup;
+	p->activated = 1;
 
 	return (p);
  bad:
@@ -1198,8 +1411,9 @@ sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, u_int buflen)
 		} else {
 			if (amt_read != 0) {
 				snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
-				    "truncated dump file; tried to read %d header bytes, only got %lu",
-				    p->sf.hdrsize, (unsigned long)amt_read);
+				    "truncated dump file; tried to read %lu header bytes, only got %lu",
+				    (unsigned long)p->sf.hdrsize,
+				    (unsigned long)amt_read);
 				return (-1);
 			}
 			/* EOF */
@@ -1309,6 +1523,44 @@ sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, u_int buflen)
 			return (-1);
 		}
 	}
+
+	/*
+	 * The DLT_USB_LINUX header is in host byte order when capturing
+	 * (it's supplied directly from a memory-mapped buffer shared
+	 * by the kernel).
+	 *
+	 * When reading a DLT_USB_LINUX capture file, we need to convert
+	 * it from the capturing host's byte order to the reading host's
+	 * byte order.
+	 */
+	if (p->sf.swapped && p->linktype == DLT_USB_LINUX) {
+		pcap_usb_header* uhdr = (pcap_usb_header*) buf;
+		/*
+		 * The URB id is a totally opaque value; do we really need to 
+		 * converte it to the reading host's byte order???
+		 */
+		if (hdr->caplen < 8)
+			return 0;
+		uhdr->id = SWAPLL(uhdr->id);
+		if (hdr->caplen < 14)
+			return 0;
+		uhdr->bus_id = SWAPSHORT(uhdr->bus_id);
+		if (hdr->caplen < 24)
+			return 0;
+		uhdr->ts_sec = SWAPLL(uhdr->ts_sec);
+		if (hdr->caplen < 28)
+			return 0;
+		uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);
+		if (hdr->caplen < 32)
+			return 0;
+		uhdr->status = SWAPLONG(uhdr->status);
+		if (hdr->caplen < 36)
+			return 0;
+		uhdr->urb_len = SWAPLONG(uhdr->urb_len);
+		if (hdr->caplen < 40)
+			return 0;
+		uhdr->data_len = SWAPLONG(uhdr->data_len);
+	}
 	return (0);
 }
 
@@ -1423,6 +1675,7 @@ pcap_dump_open(pcap_t *p, const char *fname)
 		    fname, linktype);
 		return (NULL);
 	}
+	linktype |= p->linktype_ext;
 
 	if (fname[0] == '-' && fname[1] == '\0') {
 		f = stdout;
@@ -1457,6 +1710,7 @@ pcap_dump_fopen(pcap_t *p, FILE *f)
 		    linktype);
 		return (NULL);
 	}
+	linktype |= p->linktype_ext;
 
 	return (pcap_setup_dump(p, linktype, f, "stream"));
 }
diff --git a/contrib/libpcap/scanner.l b/contrib/libpcap/scanner.l
index ff8ae63..551b2cc 100644
--- a/contrib/libpcap/scanner.l
+++ b/contrib/libpcap/scanner.l
@@ -24,7 +24,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.99.2.9 2007/06/11 09:52:05 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.110.2.2 2008/02/06 10:21:47 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -54,7 +54,7 @@ static const char rcsid[] _U_ =
 #define AI_NUMERICHOST 0x04
 #endif
 #endif /*INET6*/
-#include <pcap-namedb.h>
+#include <pcap/namedb.h>
 #include "tokdefs.h"
 
 #ifdef HAVE_OS_PROTO_H
@@ -80,6 +80,7 @@ extern YYSTYPE yylval;
 
 N		([0-9]+|(0X|0x)[0-9A-Fa-f]+)
 B		([0-9A-Fa-f][0-9A-Fa-f]?)
+B2		([0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f])
 W		([0-9A-Fa-f][0-9A-Fa-f]?[0-9A-Fa-f]?[0-9A-Fa-f]?)
 
 %a 18400
@@ -167,6 +168,10 @@ V6004		::{N}\.{N}\.{N}\.{N}
 
 V6		({V680}|{V670}|{V671}|{V672}|{V673}|{V674}|{V675}|{V676}|{V677}|{V660}|{V661}|{V662}|{V663}|{V664}|{V665}|{V666}|{V650}|{V651}|{V652}|{V653}|{V654}|{V655}|{V640}|{V641}|{V642}|{V643}|{V644}|{V630}|{V631}|{V632}|{V633}|{V620}|{V621}|{V622}|{V610}|{V611}|{V600}|{V6604}|{V6504}|{V6514}|{V6524}|{V6534}|{V6544}|{V6554}|{V6404}|{V6414}|{V6424}|{V6434}|{V6444}|{V6304}|{V6314}|{V6324}|{V6334}|{V6204}|{V6214}|{V6224}|{V6104}|{V6114}|{V6004})
 
+MAC		({B}:{B}:{B}:{B}:{B}:{B}|{B}\-{B}\-{B}\-{B}\-{B}\-{B}|{B}\.{B}\.{B}\.{B}\.{B}\.{B}|{B2}\.{B2}\.{B2}|{B2}{3})
+
+
+
 %%
 dst		return DST;
 src		return SRC;
@@ -248,6 +253,14 @@ protochain	{
 
 gateway		return GATEWAY;
 
+type		return TYPE;
+subtype		return SUBTYPE;
+direction|dir	return DIR;
+address1|addr1	return ADDR1;
+address2|addr2	return ADDR2;
+address3|addr3	return ADDR3;
+address4|addr4	return ADDR4;
+
 less		return LESS;
 greater		return GREATER;
 byte		return CBYTE;
@@ -308,11 +321,11 @@ sls		return SLS;
 ">>"			return RSH;
 ${B}			{ yylval.e = pcap_ether_aton(((char *)yytext)+1);
 			  return AID; }
+{MAC}			{ yylval.e = pcap_ether_aton((char *)yytext);
+			  return EID; }
 {N}			{ yylval.i = stoi((char *)yytext); return NUM; }
 ({N}\.{N})|({N}\.{N}\.{N})|({N}\.{N}\.{N}\.{N})	{
 			yylval.s = sdup((char *)yytext); return HID; }
-{B}:{B}:{B}:{B}:{B}:{B} { yylval.e = pcap_ether_aton((char *)yytext);
-			  return EID; }
 {V6}			{
 #ifdef INET6
 			  struct addrinfo hints, *res;
author	rpaulo <rpaulo@FreeBSD.org>	2009-03-21 22:58:08 +0000
committer	rpaulo <rpaulo@FreeBSD.org>	2009-03-21 22:58:08 +0000
commit	3f19af99adb541ff811a6faaaae340e24ad313c5 (patch)
tree	41d4ee124e8dc2938aa5559c6f422a7b778c807f /contrib/libpcap
parent	b0069d00e9ca6c9d90eb18267d0949527c0249e5 (diff)
parent	d8d18f6fbdf4f16ae4382f3d0a2d97953edd9b2c (diff)
download	FreeBSD-src-3f19af99adb541ff811a6faaaae340e24ad313c5.zip FreeBSD-src-3f19af99adb541ff811a6faaaae340e24ad313c5.tar.gz