Update libpcap to 1.1.1.

Changes:

Thu.    April 1, 2010.  guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
        Update CHANGES to reflect more of the changes in 1.1.0.
        Fix build on RHEL5.
        Fix shared library build on AIX.

Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
Summary for 1.1.0 libpcap release
        Add SocketCAN capture support
        Add Myricom SNF API support
        Update Endace DAG and ERF support
        Add support for shared libraries on Solaris, HP-UX, and AIX
        Build, install, and un-install shared libraries by default;
          don't build/install shared libraries on platforms we don't support
        Fix building from a directory other than the source directory
        Fix compiler warnings and builds on some platforms
        Update config.guess and config.sub
        Support monitor mode on mac80211 devices on Linux
        Fix USB memory-mapped capturing on Linux; it requires a new DLT_
          value
        On Linux, scan /sys/class/net for devices if we have it; scan
          it, or /proc/net/dev if we don't have /sys/class/net, even if
          we have getifaddrs(), as it'll find interfaces with no
          addresses
        Add limited support for reading pcap-ng files
        Fix BPF driver-loading error handling on AIX
        Support getting the full-length interface description on FreeBSD
        In the lexical analyzer, free up any addrinfo structure we got back
          from getaddrinfo().
        Add support for BPF and libdlpi in OpenSolaris (and SXCE)
        Hyphenate "link-layer" everywhere
        Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
        In pcap_read_linux_mmap(), if there are no frames available, call
          poll() even if we're in non-blocking mode, so we pick up
          errors, and check for the errors in question.
        Note that poll() works on BPF devices is Snow Leopard
        If an ENXIO or ENETDOWN is received, it may mean the device has
          gone away.  Deal with it.
        For BPF, raise the default capture buffer size to from 32k to 512k
        Support ps_ifdrop on Linux
        Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
         under cygwin.
        Changes to Linux mmapped captures.
        Fix bug where create_ring would fail for particular snaplen and
          buffer size combinations
        Update pcap-config so that it handles libpcap requiring
          additional libraries
        Add workaround for threadsafeness on Windows
        Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
        DLT: Add DLT_CAN_SOCKETCAN
        DLT: Add Solaris ipnet
        Don't check for DLT_IPNET if it's not defined
        Add link-layer types for Fibre Channel FC-2
        Add link-layer types for Wireless HART
        Add link-layer types for AOS
        Add link-layer types for DECT
        Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
        Install headers unconditionally, and include vlan.h/bluetooth.h if
          enabled
        Autoconf fixes+cleanup
        Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
        Support disabling SITA support (--without-sita)
        Return -1 on failure to create packet ring (if supported but
          creation failed)
        Fix handling of 'any' device, so that it can be opened, and no longer
          attempt to open it in Monitor mode
        Add support for snapshot length for USB Memory-Mapped Interface
        Fix configure and build on recent Linux kernels
        Fix memory-mapped Linux capture to support pcap_next() and
          pcap_next_ex()
        Fixes for Linux USB capture
        DLT: Add DLT_LINUX_EVDEV
        DLT: Add DLT_GSMTAP_UM
        DLT: Add DLT_GSMTAP_ABIS

1 files changed, 1454 insertions, 191 deletions

diff --git a/pcap-linux.c b/pcap-linux.c
index 8161af0..af12543 100644
--- a/pcap-linux.c
+++ b/pcap-linux.c
@@ -30,11 +30,44 @@
  *                     based on previous works of:
  *                     Simon Patarin <patarin@cs.unibo.it>
  *                     Phil Wood <cpw@lanl.gov>
+ *
+ * Monitor-mode support for mac80211 includes code taken from the iw
+ * command; the copyright notice for that code is
+ *
+ * Copyright (c) 2007, 2008	Johannes Berg
+ * Copyright (c) 2007		Andy Lutomirski
+ * Copyright (c) 2007		Mike Kershaw
+ * Copyright (c) 2008		Gábor Stefanik
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.129.2.29 2008-10-28 00:50:39 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.164 2008-12-14 22:00:57 guy Exp $ (LBL)";
 #endif
 
 /*
@@ -80,31 +113,50 @@ static const char rcsid[] _U_ =
  */
 
 
+#define _GNU_SOURCE
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
 #include <errno.h>
+#include <stdio.h>
 #include <stdlib.h>
+#include <ctype.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <string.h>
+#include <limits.h>
 #include <sys/socket.h>
 #include <sys/ioctl.h>
 #include <sys/utsname.h>
 #include <sys/mman.h>
-#include <net/if.h>
+#include <linux/if.h>
 #include <netinet/in.h>
 #include <linux/if_ether.h>
 #include <net/if_arp.h>
 #include <poll.h>
+#include <dirent.h>
 
 /*
  * Got Wireless Extensions?
  */
 #ifdef HAVE_LINUX_WIRELESS_H
 #include <linux/wireless.h>
-#endif
+#endif /* HAVE_LINUX_WIRELESS_H */
+
+/*
+ * Got libnl?
+ */
+#ifdef HAVE_LIBNL
+#include <linux/nl80211.h>
+
+#include <netlink/genl/genl.h>
+#include <netlink/genl/family.h>
+#include <netlink/genl/ctrl.h>
+#include <netlink/msg.h>
+#include <netlink/attr.h>
+#endif /* HAVE_LIBNL */
 
 #include "pcap-int.h"
 #include "pcap/sll.h"
@@ -118,6 +170,10 @@ static const char rcsid[] _U_ =
 #include "pcap-septel.h"
 #endif /* HAVE_SEPTEL_API */
 
+#ifdef HAVE_SNF_API
+#include "pcap-snf.h"
+#endif /* HAVE_SNF_API */
+
 #ifdef PCAP_SUPPORT_USB
 #include "pcap-usb-linux.h"
 #endif
@@ -126,6 +182,10 @@ static const char rcsid[] _U_ =
 #include "pcap-bt-linux.h"
 #endif
 
+#ifdef PCAP_SUPPORT_CAN
+#include "pcap-can-linux.h"
+#endif
+
 /*
  * If PF_PACKET is defined, we can use {SOCK_RAW,SOCK_DGRAM}/PF_PACKET
  * sockets rather than SOCK_PACKET sockets.
@@ -262,6 +322,8 @@ static int pcap_read_linux_mmap(pcap_t *, int, pcap_handler , u_char *);
 static int pcap_setfilter_linux_mmap(pcap_t *, struct bpf_program *);
 static int pcap_setnonblock_mmap(pcap_t *p, int nonblock, char *errbuf);
 static int pcap_getnonblock_mmap(pcap_t *p, char *errbuf);
+static void pcap_oneshot_mmap(u_char *user, const struct pcap_pkthdr *h,
+    const u_char *bytes);
 #endif
 
 /*
@@ -274,14 +336,17 @@ static int	iface_get_mtu(int fd, const char *device, char *ebuf);
 static int 	iface_get_arptype(int fd, const char *device, char *ebuf);
 #ifdef HAVE_PF_PACKET_SOCKETS
 static int 	iface_bind(int fd, int ifindex, char *ebuf);
+#ifdef IW_MODE_MONITOR
 static int	has_wext(int sock_fd, const char *device, char *ebuf);
-static int	enter_rfmon_mode_wext(pcap_t *handle, int sock_fd,
+#endif /* IW_MODE_MONITOR */
+static int	enter_rfmon_mode(pcap_t *handle, int sock_fd,
     const char *device);
-#endif
+#endif /* HAVE_PF_PACKET_SOCKETS */
 static int 	iface_bind_old(int fd, const char *device, char *ebuf);
 
 #ifdef SO_ATTACH_FILTER
-static int	fix_program(pcap_t *handle, struct sock_fprog *fcode);
+static int	fix_program(pcap_t *handle, struct sock_fprog *fcode,
+    int is_mapped);
 static int	fix_offset(struct bpf_insn *p);
 static int	set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode);
 static int	reset_kernel_filter(pcap_t *handle);
@@ -297,6 +362,12 @@ pcap_create(const char *device, char *ebuf)
 {
 	pcap_t *handle;
 
+	/*
+	 * A null device name is equivalent to the "any" device.
+	 */
+	if (device == NULL)
+		device = "any";
+
 #ifdef HAVE_DAG_API
 	if (strstr(device, "dag")) {
 		return dag_create(device, ebuf);
@@ -309,14 +380,27 @@ pcap_create(const char *device, char *ebuf)
 	}
 #endif /* HAVE_SEPTEL_API */
 
+#ifdef HAVE_SNF_API
+        handle = snf_create(device, ebuf);
+        if (strstr(device, "snf") || handle != NULL)
+		return handle;
+
+#endif /* HAVE_SNF_API */
+
 #ifdef PCAP_SUPPORT_BT
 	if (strstr(device, "bluetooth")) {
 		return bt_create(device, ebuf);
 	}
 #endif
 
+#ifdef PCAP_SUPPORT_CAN
+	if (strstr(device, "can") || strstr(device, "vcan")) {
+		return can_create(device, ebuf);
+	}
+#endif
+
 #ifdef PCAP_SUPPORT_USB
-	if (strstr(device, "usb")) {
+	if (strstr(device, "usbmon")) {
 		return usb_create(device, ebuf);
 	}
 #endif
@@ -330,22 +414,462 @@ pcap_create(const char *device, char *ebuf)
 	return handle;
 }
 
+#ifdef HAVE_LIBNL
+/*
+	 *
+	 * If interface {if} is a mac80211 driver, the file
+	 * /sys/class/net/{if}/phy80211 is a symlink to
+	 * /sys/class/ieee80211/{phydev}, for some {phydev}.
+	 *
+	 * On Fedora 9, with a 2.6.26.3-29 kernel, my Zydas stick, at
+	 * least, has a "wmaster0" device and a "wlan0" device; the
+	 * latter is the one with the IP address.  Both show up in
+	 * "tcpdump -D" output.  Capturing on the wmaster0 device
+	 * captures with 802.11 headers.
+	 *
+	 * airmon-ng searches through /sys/class/net for devices named
+	 * monN, starting with mon0; as soon as one *doesn't* exist,
+	 * it chooses that as the monitor device name.  If the "iw"
+	 * command exists, it does "iw dev {if} interface add {monif}
+	 * type monitor", where {monif} is the monitor device.  It
+	 * then (sigh) sleeps .1 second, and then configures the
+	 * device up.  Otherwise, if /sys/class/ieee80211/{phydev}/add_iface
+	 * is a file, it writes {mondev}, without a newline, to that file,
+	 * and again (sigh) sleeps .1 second, and then iwconfig's that
+	 * device into monitor mode and configures it up.  Otherwise,
+	 * you can't do monitor mode.
+	 *
+	 * All these devices are "glued" together by having the
+	 * /sys/class/net/{device}/phy80211 links pointing to the same
+	 * place, so, given a wmaster, wlan, or mon device, you can
+	 * find the other devices by looking for devices with
+	 * the same phy80211 link.
+	 *
+	 * To turn monitor mode off, delete the monitor interface,
+	 * either with "iw dev {monif} interface del" or by sending
+	 * {monif}, with no NL, down /sys/class/ieee80211/{phydev}/remove_iface
+	 *
+	 * Note: if you try to create a monitor device named "monN", and
+	 * there's already a "monN" device, it fails, as least with
+	 * the netlink interface (which is what iw uses), with a return
+	 * value of -ENFILE.  (Return values are negative errnos.)  We
+	 * could probably use that to find an unused device.
+	 *
+	 * Yes, you can have multiple monitor devices for a given
+	 * physical device.
+*/
+
+/*
+ * Is this a mac80211 device?  If so, fill in the physical device path and
+ * return 1; if not, return 0.  On an error, fill in handle->errbuf and
+ * return PCAP_ERROR.
+ */
 static int
-pcap_can_set_rfmon_linux(pcap_t *p)
+get_mac80211_phydev(pcap_t *handle, const char *device, char *phydev_path,
+    size_t phydev_max_pathlen)
 {
+	char *pathstr;
+	ssize_t bytes_read;
+
+	/*
+	 * Generate the path string for the symlink to the physical device.
+	 */
+	if (asprintf(&pathstr, "/sys/class/net/%s/phy80211", device) == -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: Can't generate path name string for /sys/class/net device",
+		    device);
+		return PCAP_ERROR;
+	}
+	bytes_read = readlink(pathstr, phydev_path, phydev_max_pathlen);
+	if (bytes_read == -1) {
+		if (errno == ENOENT || errno == EINVAL) {
+			/*
+			 * Doesn't exist, or not a symlink; assume that
+			 * means it's not a mac80211 device.
+			 */
+			free(pathstr);
+			return 0;
+		}
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: Can't readlink %s: %s", device, pathstr,
+		    strerror(errno));
+		free(pathstr);
+		return PCAP_ERROR;
+	}
+	free(pathstr);
+	phydev_path[bytes_read] = '\0';
+	return 1;
+}
+
+struct nl80211_state {
+	struct nl_handle *nl_handle;
+	struct nl_cache *nl_cache;
+	struct genl_family *nl80211;
+};
+
+static int
+nl80211_init(pcap_t *handle, struct nl80211_state *state, const char *device)
+{
+	state->nl_handle = nl_handle_alloc();
+	if (!state->nl_handle) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: failed to allocate netlink handle", device);
+		return PCAP_ERROR;
+	}
+
+	if (genl_connect(state->nl_handle)) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: failed to connect to generic netlink", device);
+		goto out_handle_destroy;
+	}
+
+	state->nl_cache = genl_ctrl_alloc_cache(state->nl_handle);
+	if (!state->nl_cache) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: failed to allocate generic netlink cache", device);
+		goto out_handle_destroy;
+	}
+
+	state->nl80211 = genl_ctrl_search_by_name(state->nl_cache, "nl80211");
+	if (!state->nl80211) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: nl80211 not found", device);
+		goto out_cache_free;
+	}
+
+	return 0;
+
+out_cache_free:
+	nl_cache_free(state->nl_cache);
+out_handle_destroy:
+	nl_handle_destroy(state->nl_handle);
+	return PCAP_ERROR;
+}
+
+static void
+nl80211_cleanup(struct nl80211_state *state)
+{
+	genl_family_put(state->nl80211);
+	nl_cache_free(state->nl_cache);
+	nl_handle_destroy(state->nl_handle);
+}
+
+static int
+add_mon_if(pcap_t *handle, int sock_fd, struct nl80211_state *state,
+    const char *device, const char *mondevice)
+{
+	int ifindex;
+	struct nl_msg *msg;
+	int err;
+
+	ifindex = iface_get_id(sock_fd, device, handle->errbuf);
+	if (ifindex == -1)
+		return PCAP_ERROR;
+
+	msg = nlmsg_alloc();
+	if (!msg) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: failed to allocate netlink msg", device);
+		return PCAP_ERROR;
+	}
+
+	genlmsg_put(msg, 0, 0, genl_family_get_id(state->nl80211), 0,
+		    0, NL80211_CMD_NEW_INTERFACE, 0);
+	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
+	NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, mondevice);
+	NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, NL80211_IFTYPE_MONITOR);
+
+	err = nl_send_auto_complete(state->nl_handle, msg);
+	if (err < 0) {
+		if (err == -ENFILE) {
+			/*
+			 * Device not available; our caller should just
+			 * keep trying.
+			 */
+			nlmsg_free(msg);
+			return 0;
+		} else {
+			/*
+			 * Real failure, not just "that device is not
+			 * available.
+			 */
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			    "%s: nl_send_auto_complete failed adding %s interface: %s",
+			    device, mondevice, strerror(-err));
+			nlmsg_free(msg);
+			return PCAP_ERROR;
+		}
+	}
+	err = nl_wait_for_ack(state->nl_handle);
+	if (err < 0) {
+		if (err == -ENFILE) {
+			/*
+			 * Device not available; our caller should just
+			 * keep trying.
+			 */
+			nlmsg_free(msg);
+			return 0;
+		} else {
+			/*
+			 * Real failure, not just "that device is not
+			 * available.
+			 */
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			    "%s: nl_wait_for_ack failed adding %s interface: %s",
+			    device, mondevice, strerror(-err));
+			nlmsg_free(msg);
+			return PCAP_ERROR;
+		}
+	}
+
+	/*
+	 * Success.
+	 */
+	nlmsg_free(msg);
+	return 1;
+
+nla_put_failure:
+	snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+	    "%s: nl_put failed adding %s interface",
+	    device, mondevice);
+	nlmsg_free(msg);
+	return PCAP_ERROR;
+}
+
+static int
+del_mon_if(pcap_t *handle, int sock_fd, struct nl80211_state *state,
+    const char *device, const char *mondevice)
+{
+	int ifindex;
+	struct nl_msg *msg;
+	int err;
+
+	ifindex = iface_get_id(sock_fd, mondevice, handle->errbuf);
+	if (ifindex == -1)
+		return PCAP_ERROR;
+
+	msg = nlmsg_alloc();
+	if (!msg) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: failed to allocate netlink msg", device);
+		return PCAP_ERROR;
+	}
+
+	genlmsg_put(msg, 0, 0, genl_family_get_id(state->nl80211), 0,
+		    0, NL80211_CMD_DEL_INTERFACE, 0);
+	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
+
+	err = nl_send_auto_complete(state->nl_handle, msg);
+	if (err < 0) {
+		if (err == -ENFILE) {
+			/*
+			 * Device not available; our caller should just
+			 * keep trying.
+			 */
+			nlmsg_free(msg);
+			return 0;
+		} else {
+			/*
+			 * Real failure, not just "that device is not
+			 * available.
+			 */
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			    "%s: nl_send_auto_complete failed deleting %s interface: %s",
+			    device, mondevice, strerror(-err));
+			nlmsg_free(msg);
+			return PCAP_ERROR;
+		}
+	}
+	err = nl_wait_for_ack(state->nl_handle);
+	if (err < 0) {
+		if (err == -ENFILE) {
+			/*
+			 * Device not available; our caller should just
+			 * keep trying.
+			 */
+			nlmsg_free(msg);
+			return 0;
+		} else {
+			/*
+			 * Real failure, not just "that device is not
+			 * available.
+			 */
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			    "%s: nl_wait_for_ack failed adding %s interface: %s",
+			    device, mondevice, strerror(-err));
+			nlmsg_free(msg);
+			return PCAP_ERROR;
+		}
+	}
+
+	/*
+	 * Success.
+	 */
+	nlmsg_free(msg);
+	return 1;
+
+nla_put_failure:
+	snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+	    "%s: nl_put failed deleting %s interface",
+	    device, mondevice);
+	nlmsg_free(msg);
+	return PCAP_ERROR;
+}
+
+static int
+enter_rfmon_mode_mac80211(pcap_t *handle, int sock_fd, const char *device)
+{
+	int ret;
+	char phydev_path[PATH_MAX+1];
+	struct nl80211_state nlstate;
+	struct ifreq ifr;
+	u_int n;
+
+	/*
+	 * Is this a mac80211 device?
+	 */
+	ret = get_mac80211_phydev(handle, device, phydev_path, PATH_MAX);
+	if (ret < 0)
+		return ret;	/* error */
+	if (ret == 0)
+		return 0;	/* no error, but not mac80211 device */
+
+	/*
+	 * XXX - is this already a monN device?
+	 * If so, we're done.
+	 * Is that determined by old Wireless Extensions ioctls?
+	 */
+
+	/*
+	 * OK, it's apparently a mac80211 device.
+	 * Try to find an unused monN device for it.
+	 */
+	ret = nl80211_init(handle, &nlstate, device);
+	if (ret != 0)
+		return ret;
+	for (n = 0; n < UINT_MAX; n++) {
+		/*
+		 * Try mon{n}.
+		 */
+		char mondevice[3+10+1];	/* mon{UINT_MAX}\0 */
+
+		snprintf(mondevice, sizeof mondevice, "mon%u", n);
+		ret = add_mon_if(handle, sock_fd, &nlstate, device, mondevice);
+		if (ret == 1) {
+			handle->md.mondevice = strdup(mondevice);
+			goto added;
+		}
+		if (ret < 0) {
+			/*
+			 * Hard failure.  Just return ret; handle->errbuf
+			 * has already been set.
+			 */
+			nl80211_cleanup(&nlstate);
+			return ret;
+		}
+	}
+
+	snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+	    "%s: No free monN interfaces", device);
+	nl80211_cleanup(&nlstate);
+	return PCAP_ERROR;
+
+added:
+
+#if 0
+	/*
+	 * Sleep for .1 seconds.
+	 */
+	delay.tv_sec = 0;
+	delay.tv_nsec = 500000000;
+	nanosleep(&delay, NULL);
+#endif
+
+	/*
+	 * Now configure the monitor interface up.
+	 */
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, handle->md.mondevice, sizeof(ifr.ifr_name));
+	if (ioctl(sock_fd, SIOCGIFFLAGS, &ifr) == -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: Can't get flags for %s: %s", device,
+		    handle->md.mondevice, strerror(errno));
+		del_mon_if(handle, sock_fd, &nlstate, device,
+		    handle->md.mondevice);
+		nl80211_cleanup(&nlstate);
+		return PCAP_ERROR;
+	}
+	ifr.ifr_flags |= IFF_UP|IFF_RUNNING;
+	if (ioctl(sock_fd, SIOCSIFFLAGS, &ifr) == -1) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "%s: Can't set flags for %s: %s", device,
+		    handle->md.mondevice, strerror(errno));
+		del_mon_if(handle, sock_fd, &nlstate, device,
+		    handle->md.mondevice);
+		nl80211_cleanup(&nlstate);
+		return PCAP_ERROR;
+	}
+
+	/*
+	 * Success.  Clean up the libnl state.
+	 */
+	nl80211_cleanup(&nlstate);
+
+	/*
+	 * Note that we have to delete the monitor device when we close
+	 * the handle.
+	 */
+	handle->md.must_do_on_close |= MUST_DELETE_MONIF;
+
+	/*
+	 * Add this to the list of pcaps to close when we exit.
+	 */
+	pcap_add_to_pcaps_to_close(handle);
+
+	return 1;
+}
+#endif /* HAVE_LIBNL */
+
+static int
+pcap_can_set_rfmon_linux(pcap_t *handle)
+{
+#ifdef HAVE_LIBNL
+	char phydev_path[PATH_MAX+1];
+	int ret;
+#endif
 #ifdef IW_MODE_MONITOR
 	int sock_fd;
 	struct iwreq ireq;
 #endif
 
-	if (p->opt.source == NULL) {
+	if (strcmp(handle->opt.source, "any") == 0) {
 		/*
-		 * This is equivalent to the "any" device, and we don't
-		 * support monitor mode on it.
+		 * Monitor mode makes no sense on the "any" device.
 		 */
 		return 0;
 	}
 
+#ifdef HAVE_LIBNL
+	/*
+	 * Bleah.  There doesn't seem to be a way to ask a mac80211
+	 * device, through libnl, whether it supports monitor mode;
+	 * we'll just check whether the device appears to be a
+	 * mac80211 device and, if so, assume the device supports
+	 * monitor mode.
+	 *
+	 * wmaster devices don't appear to support the Wireless
+	 * Extensions, but we can create a mon device for a
+	 * wmaster device, so we don't bother checking whether
+	 * a mac80211 device supports the Wireless Extensions.
+	 */
+	ret = get_mac80211_phydev(handle, handle->opt.source, phydev_path,
+	    PATH_MAX);
+	if (ret < 0)
+		return ret;	/* error */
+	if (ret == 1)
+		return 1;	/* mac80211 device */
+#endif
+
 #ifdef IW_MODE_MONITOR
 	/*
 	 * Bleah.  There doesn't appear to be an ioctl to use to ask
@@ -359,7 +883,7 @@ pcap_can_set_rfmon_linux(pcap_t *p)
 	 */
 	sock_fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
 	if (sock_fd == -1) {
-		(void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+		(void)snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 		    "socket: %s", pcap_strerror(errno));
 		return PCAP_ERROR;
 	}
@@ -367,7 +891,7 @@ pcap_can_set_rfmon_linux(pcap_t *p)
 	/*
 	 * Attempt to get the current mode.
 	 */
-	strncpy(ireq.ifr_ifrn.ifrn_name, p->opt.source,
+	strncpy(ireq.ifr_ifrn.ifrn_name, handle->opt.source,
 	    sizeof ireq.ifr_ifrn.ifrn_name);
 	ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
 	if (ioctl(sock_fd, SIOCGIWMODE, &ireq) != -1) {
@@ -379,6 +903,8 @@ pcap_can_set_rfmon_linux(pcap_t *p)
 	}
 	if (errno == ENODEV) {
 		/* The device doesn't even exist. */
+		(void)snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "SIOCGIWMODE failed: %s", pcap_strerror(errno));
 		close(sock_fd);
 		return PCAP_ERROR_NO_SUCH_DEVICE;
 	}
@@ -388,6 +914,67 @@ pcap_can_set_rfmon_linux(pcap_t *p)
 }
 
 /*
+ * Grabs the number of dropped packets by the interface from /proc/net/dev.
+ *
+ * XXX - what about /sys/class/net/{interface name}/rx_*?  There are
+ * individual devices giving, in ASCII, various rx_ and tx_ statistics.
+ *
+ * Or can we get them in binary form from netlink?
+ */
+static long int
+linux_if_drops(const char * if_name)
+{
+	char buffer[512];
+	char * bufptr;
+	FILE * file;
+	int field_to_convert = 3, if_name_sz = strlen(if_name);
+	long int dropped_pkts = 0;
+	
+	file = fopen("/proc/net/dev", "r");
+	if (!file)
+		return 0;
+
+	while (!dropped_pkts && fgets( buffer, sizeof(buffer), file ))
+	{
+		/* 	search for 'bytes' -- if its in there, then
+			that means we need to grab the fourth field. otherwise
+			grab the third field. */
+		if (field_to_convert != 4 && strstr(buffer, "bytes"))
+		{
+			field_to_convert = 4;
+			continue;
+		}
+	
+		/* find iface and make sure it actually matches -- space before the name and : after it */
+		if ((bufptr = strstr(buffer, if_name)) &&
+			(bufptr == buffer || *(bufptr-1) == ' ') &&
+			*(bufptr + if_name_sz) == ':')
+		{
+			bufptr = bufptr + if_name_sz + 1;
+
+			/* grab the nth field from it */
+			while( --field_to_convert && *bufptr != '\0')
+			{
+				while (*bufptr != '\0' && *(bufptr++) == ' ');
+				while (*bufptr != '\0' && *(bufptr++) != ' ');
+			}
+			
+			/* get rid of any final spaces */
+			while (*bufptr != '\0' && *bufptr == ' ') bufptr++;
+			
+			if (*bufptr != '\0')
+				dropped_pkts = strtol(bufptr, NULL, 10);
+
+			break;
+		}
+	}
+	
+	fclose(file);
+	return dropped_pkts;
+} 
+
+
+/*
  * With older kernels promiscuous mode is kind of interesting because we
  * have to reset the interface before exiting. The problem can't really
  * be solved without some daemon taking care of managing usage counts.
@@ -402,16 +989,20 @@ pcap_can_set_rfmon_linux(pcap_t *p)
 static void	pcap_cleanup_linux( pcap_t *handle )
 {
 	struct ifreq	ifr;
+#ifdef HAVE_LIBNL
+	struct nl80211_state nlstate;
+	int ret;
+#endif /* HAVE_LIBNL */
 #ifdef IW_MODE_MONITOR
 	struct iwreq ireq;
-#endif
+#endif /* IW_MODE_MONITOR */
 
-	if (handle->md.must_clear != 0) {
+	if (handle->md.must_do_on_close != 0) {
 		/*
 		 * There's something we have to do when closing this
 		 * pcap_t.
 		 */
-		if (handle->md.must_clear & MUST_CLEAR_PROMISC) {
+		if (handle->md.must_do_on_close & MUST_CLEAR_PROMISC) {
 			/*
 			 * We put the interface into promiscuous mode;
 			 * take it out of promiscuous mode.
@@ -449,8 +1040,25 @@ static void	pcap_cleanup_linux( pcap_t *handle )
 			}
 		}
 
+#ifdef HAVE_LIBNL
+		if (handle->md.must_do_on_close & MUST_DELETE_MONIF) {
+			ret = nl80211_init(handle, &nlstate, handle->md.device);
+			if (ret >= 0) {
+				ret = del_mon_if(handle, handle->fd, &nlstate,
+				    handle->md.device, handle->md.mondevice);
+				nl80211_cleanup(&nlstate);
+			}
+			if (ret < 0) {
+				fprintf(stderr,
+				    "Can't delete monitor interface %s (%s).\n"
+				    "Please delete manually.\n",
+				    handle->md.mondevice, handle->errbuf);
+			}
+		}
+#endif /* HAVE_LIBNL */
+
 #ifdef IW_MODE_MONITOR
-		if (handle->md.must_clear & MUST_CLEAR_RFMON) {
+		if (handle->md.must_do_on_close & MUST_CLEAR_RFMON) {
 			/*
 			 * We put the interface into rfmon mode;
 			 * take it out of rfmon mode.
@@ -474,7 +1082,7 @@ static void	pcap_cleanup_linux( pcap_t *handle )
 				    strerror(errno));
 			}
 		}
-#endif
+#endif /* IW_MODE_MONITOR */
 
 		/*
 		 * Take this pcap out of the list of pcaps for which we
@@ -483,6 +1091,10 @@ static void	pcap_cleanup_linux( pcap_t *handle )
 		pcap_remove_from_pcaps_to_close(handle);
 	}
 
+	if (handle->md.mondevice != NULL) {
+		free(handle->md.mondevice);
+		handle->md.mondevice = NULL;
+	}
 	if (handle->md.device != NULL) {
 		free(handle->md.device);
 		handle->md.device = NULL;
@@ -503,7 +1115,6 @@ pcap_activate_linux(pcap_t *handle)
 {
 	const char	*device;
 	int		status = 0;
-	int		activate_ok = 0;
 
 	device = handle->opt.source;
 
@@ -518,12 +1129,11 @@ pcap_activate_linux(pcap_t *handle)
 	handle->stats_op = pcap_stats_linux;
 
 	/*
-	 * NULL and "any" are special devices which give us the hint to
-	 * monitor all devices.
+	 * The "any" device is a special device which causes us not
+	 * to bind to a particular device and thus to look at all
+	 * devices.
 	 */
-	if (!device || strcmp(device, "any") == 0) {
-		device			= NULL;
-		handle->md.device	= strdup("any");
+	if (strcmp(device, "any") == 0) {
 		if (handle->opt.promisc) {
 			handle->opt.promisc = 0;
 			/* Just a warning. */
@@ -531,15 +1141,22 @@ pcap_activate_linux(pcap_t *handle)
 			    "Promiscuous mode not supported on the \"any\" device");
 			status = PCAP_WARNING_PROMISC_NOTSUP;
 		}
+	}
 
-	} else
-		handle->md.device	= strdup(device);
-
+	handle->md.device	= strdup(device);
 	if (handle->md.device == NULL) {
 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
 			 pcap_strerror(errno) );
 		return PCAP_ERROR;
 	}
+	
+	/*
+	 * If we're in promiscuous mode, then we probably want 
+	 * to see when the interface drops packets too, so get an
+	 * initial count from /proc/net/dev
+	 */
+	if (handle->opt.promisc)
+		handle->md.proc_dropped = linux_if_drops(handle->md.device);
 
 	/*
 	 * Current Linux kernels use the protocol family PF_PACKET to
@@ -552,27 +1169,57 @@ pcap_activate_linux(pcap_t *handle)
 	 */
 
 	if ((status = activate_new(handle)) == 1) {
-		activate_ok = 1;
 		/*
+		 * Success.
 		 * Try to use memory-mapped access.
 		 */
-		if (activate_mmap(handle) == 1)
-			return 0;	/* we succeeded; nothing more to do */
+		switch (activate_mmap(handle)) {
+
+		case 1:
+			/* we succeeded; nothing more to do */
+			return 0;
+
+		case 0:
+			/*
+			 * Kernel doesn't support it - just continue
+			 * with non-memory-mapped access.
+			 */
+			status = 0;
+			break;
+
+		case -1:
+			/*
+			 * We failed to set up to use it, or kernel
+			 * supports it, but we failed to enable it;
+			 * return an error.  handle->errbuf contains
+			 * an error message.
+			 */
+			status = PCAP_ERROR;
+			goto fail;
+		}
 	}
 	else if (status == 0) {
 		/* Non-fatal error; try old way */
-		if ((status = activate_old(handle)) == 1)
-			activate_ok = 1;
-	}
-	if (!activate_ok) {
+		if ((status = activate_old(handle)) != 1) {
+			/*
+			 * Both methods to open the packet socket failed.
+			 * Tidy up and report our failure (handle->errbuf
+			 * is expected to be set by the functions above).
+			 */
+			goto fail;
+		}
+	} else {
 		/*
-		 * Both methods to open the packet socket failed. Tidy
-		 * up and report our failure (ebuf is expected to be
-		 * set by the functions above).
+		 * Fatal error with the new way; just fail.
+		 * status has the error return; if it's PCAP_ERROR,
+		 * handle->errbuf has been set appropriately.
 		 */
 		goto fail;
 	}
 
+	/*
+	 * We set up the socket, but not with memory-mapped access.
+	 */
 	if (handle->opt.buffer_size != 0) {
 		/*
 		 * Set the socket buffer size to the specified value.
@@ -708,12 +1355,12 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 		 */
 		if (handle->break_loop) {
 			/*
-			 * Yes - clear the flag that indicates that it
-			 * has, and return -2 as an indication that we
-			 * were told to break out of the loop.
+			 * Yes - clear the flag that indicates that it has,
+			 * and return PCAP_ERROR_BREAK as an indication that
+			 * we were told to break out of the loop.
 			 */
 			handle->break_loop = 0;
-			return -2;
+			return PCAP_ERROR_BREAK;
 		}
 
 #if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
@@ -725,17 +1372,32 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 			handle->bufsize - offset, MSG_TRUNC,
 			(struct sockaddr *) &from, &fromlen);
 #endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
-	} while (packet_len == -1 && (errno == EINTR || errno == ENETDOWN));
+	} while (packet_len == -1 && errno == EINTR);
 
 	/* Check if an error occured */
 
 	if (packet_len == -1) {
-		if (errno == EAGAIN)
+		switch (errno) {
+
+		case EAGAIN:
 			return 0;	/* no packet there */
-		else {
+
+		case ENETDOWN:
+			/*
+			 * The device on which we're capturing went away.
+			 *
+			 * XXX - we should really return
+			 * PCAP_ERROR_IFACE_NOT_UP, but pcap_dispatch()
+			 * etc. aren't defined to return that.
+			 */
+			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				"The interface went down");
+			return PCAP_ERROR;
+
+		default:
 			snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 				 "recvfrom: %s", pcap_strerror(errno));
-			return -1;
+			return PCAP_ERROR;
 		}
 	}
 
@@ -893,7 +1555,7 @@ pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
 	if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) {
 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 			 "SIOCGSTAMP: %s", pcap_strerror(errno));
-		return -1;
+		return PCAP_ERROR;
 	}
 	pcap_header.caplen	= caplen;
 	pcap_header.len		= packet_len;
@@ -1008,6 +1670,18 @@ pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats)
 	socklen_t len = sizeof (struct tpacket_stats);
 #endif
 
+	long if_dropped = 0;
+	
+	/* 
+	 *	To fill in ps_ifdrop, we parse /proc/net/dev for the number
+	 */
+	if (handle->opt.promisc)
+	{
+		if_dropped = handle->md.proc_dropped;
+		handle->md.proc_dropped = linux_if_drops(handle->md.device);
+		handle->md.stat.ps_ifdrop += (handle->md.proc_dropped - if_dropped);
+	}
+
 #ifdef HAVE_TPACKET_STATS
 	/*
 	 * Try to get the packet counts from the kernel.
@@ -1028,6 +1702,8 @@ pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats)
 		 *	dropped by the interface driver.  It counts only
 		 *	packets that passed the filter.
 		 *
+		 *	See above for ps_ifdrop. 
+		 *
 		 *	Both statistics include packets not yet read from
 		 *	the kernel by libpcap, and thus not yet seen by
 		 *	the application.
@@ -1091,20 +1767,300 @@ pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats)
 	 *
 	 *	"ps_drop" is not supported.
 	 *
+	 *	"ps_ifdrop" is supported. It will return the number
+	 *	of drops the interface reports in /proc/net/dev,
+	 *	if that is available.
+	 *
 	 *	"ps_recv" doesn't include packets not yet read from
 	 *	the kernel by libpcap.
 	 *
 	 * We maintain the count of packets processed by libpcap in
 	 * "md.packets_read", for reasons described in the comment
 	 * at the end of pcap_read_packet().  We have no idea how many
-	 * packets were dropped.
+	 * packets were dropped by the kernel buffers -- but we know 
+	 * how many the interface dropped, so we can return that.
 	 */
+	 
 	stats->ps_recv = handle->md.packets_read;
 	stats->ps_drop = 0;
+	stats->ps_ifdrop = handle->md.stat.ps_ifdrop;
 	return 0;
 }
 
 /*
+ * Get from "/sys/class/net" all interfaces listed there; if they're
+ * already in the list of interfaces we have, that won't add another
+ * instance, but if they're not, that'll add them.
+ *
+ * We don't bother getting any addresses for them; it appears you can't
+ * use SIOCGIFADDR on Linux to get IPv6 addresses for interfaces, and,
+ * although some other types of addresses can be fetched with SIOCGIFADDR,
+ * we don't bother with them for now.
+ *
+ * We also don't fail if we couldn't open "/sys/class/net"; we just leave
+ * the list of interfaces as is, and return 0, so that we can try
+ * scanning /proc/net/dev.
+ */
+static int
+scan_sys_class_net(pcap_if_t **devlistp, char *errbuf)
+{
+	DIR *sys_class_net_d;
+	int fd;
+	struct dirent *ent;
+	char *p;
+	char name[512];	/* XXX - pick a size */
+	char *q, *saveq;
+	struct ifreq ifrflags;
+	int ret = 1;
+
+	sys_class_net_d = opendir("/sys/class/net");
+	if (sys_class_net_d == NULL && errno == ENOENT)
+		return (0);
+
+	/*
+	 * Create a socket from which to fetch interface information.
+	 */
+	fd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (fd < 0) {
+		(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+		    "socket: %s", pcap_strerror(errno));
+		return (-1);
+	}
+
+	for (;;) {
+		errno = 0;
+		ent = readdir(sys_class_net_d);
+		if (ent == NULL) {
+			/*
+			 * Error or EOF; if errno != 0, it's an error.
+			 */
+			break;
+		}
+
+		/*
+		 * Ignore directories (".", "..", and any subdirectories).
+		 */
+		if (ent->d_type == DT_DIR)
+			continue;
+
+		/*
+		 * Get the interface name.
+		 */
+		p = &ent->d_name[0];
+		q = &name[0];
+		while (*p != '\0' && isascii(*p) && !isspace(*p)) {
+			if (*p == ':') {
+				/*
+				 * This could be the separator between a
+				 * name and an alias number, or it could be
+				 * the separator between a name with no
+				 * alias number and the next field.
+				 *
+				 * If there's a colon after digits, it
+				 * separates the name and the alias number,
+				 * otherwise it separates the name and the
+				 * next field.
+				 */
+				saveq = q;
+				while (isascii(*p) && isdigit(*p))
+					*q++ = *p++;
+				if (*p != ':') {
+					/*
+					 * That was the next field,
+					 * not the alias number.
+					 */
+					q = saveq;
+				}
+				break;
+			} else
+				*q++ = *p++;
+		}
+		*q = '\0';
+
+		/*
+		 * Get the flags for this interface, and skip it if
+		 * it's not up.
+		 */
+		strncpy(ifrflags.ifr_name, name, sizeof(ifrflags.ifr_name));
+		if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifrflags) < 0) {
+			if (errno == ENXIO)
+				continue;
+			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+			    "SIOCGIFFLAGS: %.*s: %s",
+			    (int)sizeof(ifrflags.ifr_name),
+			    ifrflags.ifr_name,
+			    pcap_strerror(errno));
+			ret = -1;
+			break;
+		}
+		if (!(ifrflags.ifr_flags & IFF_UP))
+			continue;
+
+		/*
+		 * Add an entry for this interface, with no addresses.
+		 */
+		if (pcap_add_if(devlistp, name, ifrflags.ifr_flags, NULL,
+		    errbuf) == -1) {
+			/*
+			 * Failure.
+			 */
+			ret = -1;
+			break;
+		}
+	}
+	if (ret != -1) {
+		/*
+		 * Well, we didn't fail for any other reason; did we
+		 * fail due to an error reading the directory?
+		 */
+		if (errno != 0) {
+			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+			    "Error reading /sys/class/net: %s",
+			    pcap_strerror(errno));
+			ret = -1;
+		}
+	}
+
+	(void)close(fd);
+	(void)closedir(sys_class_net_d);
+	return (ret);
+}
+
+/*
+ * Get from "/proc/net/dev" all interfaces listed there; if they're
+ * already in the list of interfaces we have, that won't add another
+ * instance, but if they're not, that'll add them.
+ *
+ * See comments from scan_sys_class_net().
+ */
+static int
+scan_proc_net_dev(pcap_if_t **devlistp, char *errbuf)
+{
+	FILE *proc_net_f;
+	int fd;
+	char linebuf[512];
+	int linenum;
+	char *p;
+	char name[512];	/* XXX - pick a size */
+	char *q, *saveq;
+	struct ifreq ifrflags;
+	int ret = 0;
+
+	proc_net_f = fopen("/proc/net/dev", "r");
+	if (proc_net_f == NULL && errno == ENOENT)
+		return (0);
+
+	/*
+	 * Create a socket from which to fetch interface information.
+	 */
+	fd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (fd < 0) {
+		(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+		    "socket: %s", pcap_strerror(errno));
+		return (-1);
+	}
+
+	for (linenum = 1;
+	    fgets(linebuf, sizeof linebuf, proc_net_f) != NULL; linenum++) {
+		/*
+		 * Skip the first two lines - they're headers.
+		 */
+		if (linenum <= 2)
+			continue;
+
+		p = &linebuf[0];
+
+		/*
+		 * Skip leading white space.
+		 */
+		while (*p != '\0' && isascii(*p) && isspace(*p))
+			p++;
+		if (*p == '\0' || *p == '\n')
+			continue;	/* blank line */
+
+		/*
+		 * Get the interface name.
+		 */
+		q = &name[0];
+		while (*p != '\0' && isascii(*p) && !isspace(*p)) {
+			if (*p == ':') {
+				/*
+				 * This could be the separator between a
+				 * name and an alias number, or it could be
+				 * the separator between a name with no
+				 * alias number and the next field.
+				 *
+				 * If there's a colon after digits, it
+				 * separates the name and the alias number,
+				 * otherwise it separates the name and the
+				 * next field.
+				 */
+				saveq = q;
+				while (isascii(*p) && isdigit(*p))
+					*q++ = *p++;
+				if (*p != ':') {
+					/*
+					 * That was the next field,
+					 * not the alias number.
+					 */
+					q = saveq;
+				}
+				break;
+			} else
+				*q++ = *p++;
+		}
+		*q = '\0';
+
+		/*
+		 * Get the flags for this interface, and skip it if
+		 * it's not up.
+		 */
+		strncpy(ifrflags.ifr_name, name, sizeof(ifrflags.ifr_name));
+		if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifrflags) < 0) {
+			if (errno == ENXIO)
+				continue;
+			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+			    "SIOCGIFFLAGS: %.*s: %s",
+			    (int)sizeof(ifrflags.ifr_name),
+			    ifrflags.ifr_name,
+			    pcap_strerror(errno));
+			ret = -1;
+			break;
+		}
+		if (!(ifrflags.ifr_flags & IFF_UP))
+			continue;
+
+		/*
+		 * Add an entry for this interface, with no addresses.
+		 */
+		if (pcap_add_if(devlistp, name, ifrflags.ifr_flags, NULL,
+		    errbuf) == -1) {
+			/*
+			 * Failure.
+			 */
+			ret = -1;
+			break;
+		}
+	}
+	if (ret != -1) {
+		/*
+		 * Well, we didn't fail for any other reason; did we
+		 * fail due to an error reading the file?
+		 */
+		if (ferror(proc_net_f)) {
+			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+			    "Error reading /proc/net/dev: %s",
+			    pcap_strerror(errno));
+			ret = -1;
+		}
+	}
+
+	(void)close(fd);
+	(void)fclose(proc_net_f);
+	return (ret);
+}
+
+/*
  * Description string for the "any" device.
  */
 static const char any_descr[] = "Pseudo-device that captures on all interfaces";
@@ -1112,25 +2068,66 @@ static const char any_descr[] = "Pseudo-device that captures on all interfaces";
 int
 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
 {
+	int ret;
+
+	/*
+	 * Read "/sys/class/net", and add to the list of interfaces all
+	 * interfaces listed there that we don't already have, because,
+	 * on Linux, SIOCGIFCONF reports only interfaces with IPv4 addresses,
+	 * and even getifaddrs() won't return information about
+	 * interfaces with no addresses, so you need to read "/sys/class/net"
+	 * to get the names of the rest of the interfaces.
+	 */
+	ret = scan_sys_class_net(alldevsp, errbuf);
+	if (ret == -1)
+		return (-1);	/* failed */
+	if (ret == 0) {
+		/*
+		 * No /sys/class/net; try reading /proc/net/dev instead.
+		 */
+		if (scan_proc_net_dev(alldevsp, errbuf) == -1)
+			return (-1);
+	}
+
+	/*
+	 * Add the "any" device.
+	 */
 	if (pcap_add_if(alldevsp, "any", 0, any_descr, errbuf) < 0)
 		return (-1);
 
 #ifdef HAVE_DAG_API
+	/*
+	 * Add DAG devices.
+	 */
 	if (dag_platform_finddevs(alldevsp, errbuf) < 0)
 		return (-1);
 #endif /* HAVE_DAG_API */
 
 #ifdef HAVE_SEPTEL_API
+	/*
+	 * Add Septel devices.
+	 */
 	if (septel_platform_finddevs(alldevsp, errbuf) < 0)
 		return (-1);
 #endif /* HAVE_SEPTEL_API */
 
+#ifdef HAVE_SNF_API
+	if (snf_platform_finddevs(alldevsp, errbuf) < 0)
+		return (-1);
+#endif /* HAVE_SNF_API */
+
 #ifdef PCAP_SUPPORT_BT
+	/*
+	 * Add Bluetooth devices.
+	 */
 	if (bt_platform_finddevs(alldevsp, errbuf) < 0)
 		return (-1);
 #endif
 
 #ifdef PCAP_SUPPORT_USB
+	/*
+	 * Add USB devices.
+	 */
 	if (usb_platform_finddevs(alldevsp, errbuf) < 0)
 		return (-1);
 #endif
@@ -1142,7 +2139,8 @@ pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
  *  Attach the given BPF code to the packet capture device.
  */
 static int
-pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter)
+pcap_setfilter_linux_common(pcap_t *handle, struct bpf_program *filter,
+    int is_mmapped)
 {
 #ifdef SO_ATTACH_FILTER
 	struct sock_fprog	fcode;
@@ -1195,13 +2193,13 @@ pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter)
 		 *
 		 * Oh, and we also need to fix it up so that all "ret"
 		 * instructions with non-zero operands have 65535 as the
-		 * operand, and so that, if we're in cooked mode, all
-		 * memory-reference instructions use special magic offsets
-		 * in references to the link-layer header and assume that
-		 * the link-layer payload begins at 0; "fix_program()"
-		 * will do that.
+		 * operand if we're not capturing in memory-mapped modee,
+		 * and so that, if we're in cooked mode, all memory-reference
+		 * instructions use special magic offsets in references to
+		 * the link-layer header and assume that the link-layer
+		 * payload begins at 0; "fix_program()" will do that.
 		 */
-		switch (fix_program(handle, &fcode)) {
+		switch (fix_program(handle, &fcode, is_mmapped)) {
 
 		case -1:
 		default:
@@ -1275,6 +2273,13 @@ pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter)
 	return 0;
 }
 
+static int
+pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter)
+{
+	return pcap_setfilter_linux_common(handle, filter, 0);
+}
+
+
 /*
  * Set direction flag: Which packets do we accept on a forwarding
  * single device? IN, OUT or both?
@@ -1405,6 +2410,12 @@ static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok)
 	case ARPHRD_CHAOS:
 		handle->linktype = DLT_CHAOS;
 		break;
+#ifndef ARPHRD_CAN
+#define ARPHRD_CAN 280
+#endif
+	case ARPHRD_CAN:
+		handle->linktype = DLT_CAN_SOCKETCAN;
+		break;
 
 #ifndef ARPHRD_IEEE802_TR
 #define ARPHRD_IEEE802_TR 800	/* From Linux 2.4 */
@@ -1657,19 +2668,24 @@ static int
 activate_new(pcap_t *handle)
 {
 #ifdef HAVE_PF_PACKET_SOCKETS
-	int			sock_fd = -1, arptype, val;
+	const char		*device = handle->opt.source;
+	int			is_any_device = (strcmp(device, "any") == 0);
+	int			sock_fd = -1, arptype;
+#ifdef HAVE_PACKET_AUXDATA
+	int			val;
+#endif
 	int			err = 0;
 	struct packet_mreq	mr;
-	const char* device = handle->opt.source;
 
 	/*
-	 * Open a socket with protocol family packet. If a device is
-	 * given we try to open it in raw mode otherwise we use
-	 * the cooked interface.
+	 * Open a socket with protocol family packet. If the
+	 * "any" device was specified, we open a SOCK_DGRAM
+	 * socket for the cooked interface, otherwise we first
+	 * try a SOCK_RAW socket for the raw interface.
 	 */
-	sock_fd = device ?
-		socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))
-	      : socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL));
+	sock_fd = is_any_device ?
+		socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) :
+		socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
 
 	if (sock_fd == -1) {
 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "socket: %s",
@@ -1704,7 +2720,7 @@ activate_new(pcap_t *handle)
 	 * to cooked mode if we have an unknown interface type
 	 * or a type we know doesn't work well in raw mode.
 	 */
-	if (device) {
+	if (!is_any_device) {
 		/* Assume for now we don't need cooked mode. */
 		handle->md.cooked = 0;
 
@@ -1715,7 +2731,7 @@ activate_new(pcap_t *handle)
 			 * because entering monitor mode could change
 			 * the link-layer type.
 			 */
-			err = enter_rfmon_mode_wext(handle, sock_fd, device);
+			err = enter_rfmon_mode(handle, sock_fd, device);
 			if (err < 0) {
 				/* Hard failure */
 				close(sock_fd);
@@ -1729,6 +2745,15 @@ activate_new(pcap_t *handle)
 				close(sock_fd);
 				return PCAP_ERROR_RFMON_NOTSUP;
 			}
+
+			/*
+			 * Either monitor mode has been turned on for
+			 * the device, or we've been given a different
+			 * device to open for monitor mode.  If we've
+			 * been given a different device, use it.
+			 */
+			if (handle->md.mondevice != NULL)
+				device = handle->md.mondevice;
 		}
 		arptype	= iface_get_arptype(sock_fd, device, handle->errbuf);
 		if (arptype < 0) {
@@ -1819,15 +2844,23 @@ activate_new(pcap_t *handle)
 		}
 	} else {
 		/*
-		 * This is cooked mode.
+		 * The "any" device.
+		 */
+		if (handle->opt.rfmon) {
+			/*
+			 * It doesn't support monitor mode.
+			 */
+			return PCAP_ERROR_RFMON_NOTSUP;
+		}
+
+		/*
+		 * It uses cooked mode.
 		 */
 		handle->md.cooked = 1;
 		handle->linktype = DLT_LINUX_SLL;
 
 		/*
 		 * We're not bound to a device.
-		 * XXX - true?  Or true only if we're using
-		 * the "any" device?
 		 * For now, we're using this as an indication
 		 * that we can't transmit; stop doing that only
 		 * if we figure out how to transmit in cooked
@@ -1852,10 +2885,13 @@ activate_new(pcap_t *handle)
 
 	/*
 	 * Hmm, how can we set promiscuous mode on all interfaces?
-	 * I am not sure if that is possible at all.
+	 * I am not sure if that is possible at all.  For now, we
+	 * silently ignore attempts to turn promiscuous mode on
+	 * for the "any" device (so you don't have to explicitly
+	 * disable it in programs such as tcpdump).
 	 */
 
-	if (device && handle->opt.promisc) {
+	if (!is_any_device && handle->opt.promisc) {
 		memset(&mr, 0, sizeof(mr));
 		mr.mr_ifindex = handle->md.ifindex;
 		mr.mr_type    = PACKET_MR_PROMISC;
@@ -1920,16 +2956,32 @@ activate_mmap(pcap_t *handle)
 #ifdef HAVE_PACKET_RING
 	int ret;
 
+	/*
+	 * Attempt to allocate a buffer to hold the contents of one
+	 * packet, for use by the oneshot callback.
+	 */
+	handle->md.oneshot_buffer = malloc(handle->snapshot);
+	if (handle->md.oneshot_buffer == NULL) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+			 "can't allocate oneshot buffer: %s",
+			 pcap_strerror(errno));
+		return PCAP_ERROR;
+	}
+
 	if (handle->opt.buffer_size == 0) {
 		/* by default request 2M for the ring buffer */
 		handle->opt.buffer_size = 2*1024*1024;
 	}
 	ret = prepare_tpacket_socket(handle);
-	if (ret == 0)
+	if (ret != 1) {
+		free(handle->md.oneshot_buffer);
 		return ret;
+	}
 	ret = create_ring(handle);
-	if (ret == 0)
+	if (ret != 1) {
+		free(handle->md.oneshot_buffer);
 		return ret;
+	}
 
 	/* override some defaults and inherit the other fields from
 	 * activate_new
@@ -1940,6 +2992,7 @@ activate_mmap(pcap_t *handle)
 	handle->setfilter_op = pcap_setfilter_linux_mmap;
 	handle->setnonblock_op = pcap_setnonblock_mmap;
 	handle->getnonblock_op = pcap_getnonblock_mmap;
+	handle->oneshot_callback = pcap_oneshot_mmap;
 	handle->selectable_fd = handle->fd;
 	return 1;
 #else /* HAVE_PACKET_RING */
@@ -1965,11 +3018,13 @@ prepare_tpacket_socket(pcap_t *handle)
 	len = sizeof(val);
 	if (getsockopt(handle->fd, SOL_PACKET, PACKET_HDRLEN, &val, &len) < 0) {
 		if (errno == ENOPROTOOPT)
-			return 1;
+			return 1;	/* no - just drive on */
+
+		/* Yes - treat as a failure. */
 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
-			 "can't get TPACKET_V2 header len on socket %d: %d-%s",
-			 handle->fd, errno, pcap_strerror(errno));
-		return 0;
+		    "can't get TPACKET_V2 header len on packet socket: %s",
+		    pcap_strerror(errno));
+		return -1;
 	}
 	handle->md.tp_hdrlen = val;
 
@@ -1977,9 +3032,9 @@ prepare_tpacket_socket(pcap_t *handle)
 	if (setsockopt(handle->fd, SOL_PACKET, PACKET_VERSION, &val,
 		       sizeof(val)) < 0) {
 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
-			 "can't activate TPACKET_V2 on socket %d: %d-%s",
-			 handle->fd, errno, pcap_strerror(errno));
-		return 0;
+		    "can't activate TPACKET_V2 on packet socket: %s",
+		    pcap_strerror(errno));
+		return -1;
 	}
 	handle->md.tp_version = TPACKET_V2;
 
@@ -1988,33 +3043,19 @@ prepare_tpacket_socket(pcap_t *handle)
 	if (setsockopt(handle->fd, SOL_PACKET, PACKET_RESERVE, &val,
 		       sizeof(val)) < 0) {
 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
-			 "can't set up reserve on socket %d: %d-%s",
-			 handle->fd, errno, pcap_strerror(errno));
-		return 0;
+		    "can't set up reserve on packet socket: %s",
+		    pcap_strerror(errno));
+		return -1;
 	}
 
 #endif /* HAVE_TPACKET2 */
 	return 1;
 }
 
-static void
-compute_ring_block(int frame_size, unsigned *block_size, unsigned *frames_per_block)
-{
-	/* compute the minumum block size that will handle this frame. 
-	 * The block has to be page size aligned. 
-	 * The max block size allowed by the kernel is arch-dependent and 
-	 * it's not explicitly checked here. */
-	*block_size = getpagesize();
-	while (*block_size < frame_size) 
-		*block_size <<= 1;
-
-	*frames_per_block = *block_size/frame_size;
-}
-
 static int
 create_ring(pcap_t *handle)
 {
-	unsigned i, j, ringsize, frames_per_block;
+	unsigned i, j, frames_per_block;
 	struct tpacket_req req;
 
 	/* Note that with large snapshot (say 64K) only a few frames 
@@ -2026,53 +3067,83 @@ create_ring(pcap_t *handle)
 					  TPACKET_ALIGN(handle->md.tp_hdrlen) +
 					  sizeof(struct sockaddr_ll));
 	req.tp_frame_nr = handle->opt.buffer_size/req.tp_frame_size;
-	compute_ring_block(req.tp_frame_size, &req.tp_block_size, &frames_per_block);
-	req.tp_block_nr = req.tp_frame_nr / frames_per_block;
 
-	/* req.tp_frame_nr is requested to match frames_per_block*req.tp_block_nr */
-	req.tp_frame_nr = req.tp_block_nr * frames_per_block;
+	/* compute the minumum block size that will handle this frame. 
+	 * The block has to be page size aligned. 
+	 * The max block size allowed by the kernel is arch-dependent and 
+	 * it's not explicitly checked here. */
+	req.tp_block_size = getpagesize();
+	while (req.tp_block_size < req.tp_frame_size) 
+		req.tp_block_size <<= 1;
+
+	frames_per_block = req.tp_block_size/req.tp_frame_size;
 
 	/* ask the kernel to create the ring */
 retry:
+	req.tp_block_nr = req.tp_frame_nr / frames_per_block;
+
+	/* req.tp_frame_nr is requested to match frames_per_block*req.tp_block_nr */
+	req.tp_frame_nr = req.tp_block_nr * frames_per_block;
+	
 	if (setsockopt(handle->fd, SOL_PACKET, PACKET_RX_RING,
 					(void *) &req, sizeof(req))) {
-		/* try to reduce requested ring size to prevent memory failure */
 		if ((errno == ENOMEM) && (req.tp_block_nr > 1)) {
-			req.tp_frame_nr >>= 1;
-			req.tp_block_nr = req.tp_frame_nr/frames_per_block;
+			/*
+			 * Memory failure; try to reduce the requested ring
+			 * size.
+			 *
+			 * We used to reduce this by half -- do 5% instead.
+			 * That may result in more iterations and a longer
+			 * startup, but the user will be much happier with
+			 * the resulting buffer size.
+			 */
+			if (req.tp_frame_nr < 20)
+				req.tp_frame_nr -= 1;
+			else
+				req.tp_frame_nr -= req.tp_frame_nr/20;
 			goto retry;
 		}
-		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "can't create rx ring on "
-				"packet socket %d: %d-%s", handle->fd, errno, 
-				pcap_strerror(errno));
-		return 0;
+		if (errno == ENOPROTOOPT) {
+			/*
+			 * We don't have ring buffer support in this kernel.
+			 */
+			return 0;
+		}
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "can't create rx ring on packet socket: %s",
+		    pcap_strerror(errno));
+		return -1;
 	}
 
 	/* memory map the rx ring */
-	ringsize = req.tp_block_nr * req.tp_block_size;
-	handle->bp = mmap(0, ringsize, PROT_READ| PROT_WRITE, MAP_SHARED, 
-					handle->fd, 0);
-	if (handle->bp == MAP_FAILED) {
-		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "can't mmap rx ring: %d-%s",
-			errno, pcap_strerror(errno));
+	handle->md.mmapbuflen = req.tp_block_nr * req.tp_block_size;
+	handle->md.mmapbuf = mmap(0, handle->md.mmapbuflen,
+	    PROT_READ|PROT_WRITE, MAP_SHARED, handle->fd, 0);
+	if (handle->md.mmapbuf == MAP_FAILED) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "can't mmap rx ring: %s", pcap_strerror(errno));
 
 		/* clear the allocated ring on error*/
 		destroy_ring(handle);
-		return 0;
+		return -1;
 	}
 
 	/* allocate a ring for each frame header pointer*/
 	handle->cc = req.tp_frame_nr;
 	handle->buffer = malloc(handle->cc * sizeof(union thdr *));
 	if (!handle->buffer) {
+		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+		    "can't allocate ring of frame headers: %s",
+		    pcap_strerror(errno));
+
 		destroy_ring(handle);
-		return 0;
+		return -1;
 	}
 
 	/* fill the header ring with proper frame ptr*/
 	handle->offset = 0;
 	for (i=0; i<req.tp_block_nr; ++i) {
-		void *base = &handle->bp[i*req.tp_block_size];
+		void *base = &handle->md.mmapbuf[i*req.tp_block_size];
 		for (j=0; j<frames_per_block; ++j, ++handle->offset) {
 			RING_GET_FRAME(handle) = base;
 			base += req.tp_frame_size;
@@ -2095,21 +3166,49 @@ destroy_ring(pcap_t *handle)
 				(void *) &req, sizeof(req));
 
 	/* if ring is mapped, unmap it*/
-	if (handle->bp) {
-		/* need to re-compute the ring size */
-		unsigned frames_per_block, block_size;
-		compute_ring_block(handle->bufsize, &block_size, &frames_per_block);
-
-		/* do not perform sanity check here: we can't recover any error */
-		munmap(handle->bp, block_size * handle->cc / frames_per_block);
-		handle->bp = 0;
+	if (handle->md.mmapbuf) {
+		/* do not test for mmap failure, as we can't recover from any error */
+		munmap(handle->md.mmapbuf, handle->md.mmapbuflen);
+		handle->md.mmapbuf = NULL;
 	}
 }
 
+/*
+ * Special one-shot callback, used for pcap_next() and pcap_next_ex(),
+ * for Linux mmapped capture.
+ *
+ * The problem is that pcap_next() and pcap_next_ex() expect the packet
+ * data handed to the callback to be valid after the callback returns,
+ * but pcap_read_linux_mmap() has to release that packet as soon as
+ * the callback returns (otherwise, the kernel thinks there's still
+ * at least one unprocessed packet available in the ring, so a select()
+ * will immediately return indicating that there's data to process), so,
+ * in the callback, we have to make a copy of the packet.
+ *
+ * Yes, this means that, if the capture is using the ring buffer, using
+ * pcap_next() or pcap_next_ex() requires more copies than using
+ * pcap_loop() or pcap_dispatch().  If that bothers you, don't use
+ * pcap_next() or pcap_next_ex().
+ */
+static void
+pcap_oneshot_mmap(u_char *user, const struct pcap_pkthdr *h,
+    const u_char *bytes)
+{
+	struct oneshot_userdata *sp = (struct oneshot_userdata *)user;
+
+	*sp->hdr = *h;
+	memcpy(sp->pd->md.oneshot_buffer, bytes, h->caplen);
+	*sp->pkt = sp->pd->md.oneshot_buffer;
+}
+    
 static void
 pcap_cleanup_linux_mmap( pcap_t *handle )
 {
 	destroy_ring(handle);
+	if (handle->md.oneshot_buffer != NULL) {
+		free(handle->md.oneshot_buffer);
+		handle->md.oneshot_buffer = NULL;
+	}
 	pcap_cleanup_linux(handle);
 }
 
@@ -2127,11 +3226,26 @@ pcap_setnonblock_mmap(pcap_t *p, int nonblock, char *errbuf)
 	/* map each value to the corresponding 2's complement, to 
 	 * preserve the timeout value provided with pcap_set_timeout */
 	if (nonblock) {
-		if (p->md.timeout > 0)
+		if (p->md.timeout >= 0) {
+			/*
+			 * Timeout is non-negative, so we're not already
+			 * in non-blocking mode; set it to the 2's
+			 * complement, to make it negative, as an
+			 * indication that we're in non-blocking mode.
+			 */
 			p->md.timeout = p->md.timeout*-1 - 1;
-	} else 
-		if (p->md.timeout < 0)
+		}
+	} else {
+		if (p->md.timeout < 0) {
+			/*
+			 * Timeout is negative, so we're not already
+			 * in blocking mode; reverse the previous
+			 * operation, to make the timeout non-negative
+			 * again.
+			 */
 			p->md.timeout = (p->md.timeout+1)*-1;
+		}
+	}
 	return 0;
 }
 
@@ -2158,35 +3272,95 @@ pcap_get_ring_frame(pcap_t *handle, int status)
 	return h.raw;
 }
 
+#ifndef POLLRDHUP
+#define POLLRDHUP 0
+#endif
+
 static int
 pcap_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, 
 		u_char *user)
 {
+	int timeout;
 	int pkts = 0;
+	char c;
 
 	/* wait for frames availability.*/
-	if ((handle->md.timeout >= 0) &&
-	    !pcap_get_ring_frame(handle, TP_STATUS_USER)) {
+	if (!pcap_get_ring_frame(handle, TP_STATUS_USER)) {
 		struct pollfd pollinfo;
 		int ret;
 
 		pollinfo.fd = handle->fd;
 		pollinfo.events = POLLIN;
 
+		if (handle->md.timeout == 0)
+			timeout = -1;	/* block forever */
+		else if (handle->md.timeout > 0)
+			timeout = handle->md.timeout;	/* block for that amount of time */
+		else
+			timeout = 0;	/* non-blocking mode - poll to pick up errors */
 		do {
-			/* poll() requires a negative timeout to wait forever */
-			ret = poll(&pollinfo, 1, (handle->md.timeout > 0)?
-			 			handle->md.timeout: -1);
-			if ((ret < 0) && (errno != EINTR)) {
+			ret = poll(&pollinfo, 1, timeout);
+			if (ret < 0 && errno != EINTR) {
 				snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 
-					 "can't poll on packet socket fd %d: %d-%s",
-					handle->fd, errno, pcap_strerror(errno));
-				return -1;
-			}
+					"can't poll on packet socket: %s",
+					pcap_strerror(errno));
+				return PCAP_ERROR;
+			} else if (ret > 0 &&
+			    (pollinfo.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) {
+				/*
+				 * There's some indication other than
+				 * "you can read on this descriptor" on
+				 * the descriptor.
+				 */
+				if (pollinfo.revents & (POLLHUP | POLLRDHUP)) {
+					snprintf(handle->errbuf,
+						PCAP_ERRBUF_SIZE,
+						"Hangup on packet socket");
+					return PCAP_ERROR;
+				}
+				if (pollinfo.revents & POLLERR) {
+					/*
+					 * A recv() will give us the
+					 * actual error code.
+					 *
+					 * XXX - make the socket non-blocking?
+					 */
+					if (recv(handle->fd, &c, sizeof c,
+					    MSG_PEEK) != -1)
+						continue;	/* what, no error? */
+					if (errno == ENETDOWN) {
+						/*
+						 * The device on which we're
+						 * capturing went away.
+						 *
+						 * XXX - we should really return
+						 * PCAP_ERROR_IFACE_NOT_UP,
+						 * but pcap_dispatch() etc.
+						 * aren't defined to return
+						 * that.
+						 */
+						snprintf(handle->errbuf,
+							PCAP_ERRBUF_SIZE,
+							"The interface went down");
+					} else {
+						snprintf(handle->errbuf,
+							PCAP_ERRBUF_SIZE, 
+							"Error condition on packet socket: %s",
+							strerror(errno));
+					}
+					return PCAP_ERROR;
+				}
+				if (pollinfo.revents & POLLNVAL) {
+					snprintf(handle->errbuf,
+						PCAP_ERRBUF_SIZE, 
+						"Invalid polling request on packet socket");
+					return PCAP_ERROR;
+				}
+  			}
 			/* check for break loop condition on interrupted syscall*/
 			if (handle->break_loop) {
 				handle->break_loop = 0;
-				return -2;
+				return PCAP_ERROR_BREAK;
 			}
 		} while (ret < 0);
 	}
@@ -2258,11 +3432,33 @@ pcap_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback,
 					tp_len, tp_snaplen) == 0))
 			goto skip;
 
-		/* check direction and interface index */
+		/*
+		 * Do checks based on packet direction.
+		 */
 		sll = (void *)h.raw + TPACKET_ALIGN(handle->md.tp_hdrlen);
-		if ((sll->sll_ifindex == handle->md.lo_ifindex) &&
-					(sll->sll_pkttype == PACKET_OUTGOING))
-			goto skip;
+		if (sll->sll_pkttype == PACKET_OUTGOING) {
+			/*
+			 * Outgoing packet.
+			 * If this is from the loopback device, reject it;
+			 * we'll see the packet as an incoming packet as well,
+			 * and we don't want to see it twice.
+			 */
+			if (sll->sll_ifindex == handle->md.lo_ifindex)
+				goto skip;
+
+			/*
+			 * If the user only wants incoming packets, reject it.
+			 */
+			if (handle->direction == PCAP_D_IN)
+				goto skip;
+		} else {
+			/*
+			 * Incoming packet.
+			 * If the user only wants outgoing packets, reject it.
+			 */
+			if (handle->direction == PCAP_D_OUT)
+				goto skip;
+		}
 
 		/* get required packet info from ring header */
 		pcaphdr.ts.tv_sec = tp_sec;
@@ -2331,6 +3527,18 @@ pcap_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback,
 		}
 #endif
 
+		/*
+		 * The only way to tell the kernel to cut off the
+		 * packet at a snapshot length is with a filter program;
+		 * if there's no filter program, the kernel won't cut
+		 * the packet off.
+		 *
+		 * Trim the snapshot length to be no longer than the
+		 * specified snapshot length.
+		 */
+		if (pcaphdr.caplen > handle->snapshot)
+			pcaphdr.caplen = handle->snapshot;
+
 		/* pass the packet to the user */
 		pkts++;
 		callback(user, &pcaphdr, bp);
@@ -2354,7 +3562,7 @@ skip:
 		/* check for break loop condition*/
 		if (handle->break_loop) {
 			handle->break_loop = 0;
-			return -2;
+			return PCAP_ERROR_BREAK;
 		}
 	}
 	return pkts;
@@ -2364,7 +3572,15 @@ static int
 pcap_setfilter_linux_mmap(pcap_t *handle, struct bpf_program *filter)
 {
 	int n, offset;
-	int ret = pcap_setfilter_linux(handle, filter);
+	int ret;
+
+	/*
+	 * Don't rewrite "ret" instructions; we don't need to, as
+	 * we're not reading packets with recvmsg(), and we don't
+	 * want to, as, by not rewriting them, the kernel can avoid
+	 * copying extra data.
+	 */
+	ret = pcap_setfilter_linux_common(handle, filter, 1);
 	if (ret < 0)
 		return ret;
 
@@ -2478,6 +3694,7 @@ iface_bind(int fd, int ifindex, char *ebuf)
 	return 1;
 }
 
+#ifdef IW_MODE_MONITOR
 /*
  * Check whether the device supports the Wireless Extensions.
  * Returns 1 if it does, 0 if it doesn't, PCAP_ERROR_NO_SUCH_DEVICE
@@ -2486,7 +3703,6 @@ iface_bind(int fd, int ifindex, char *ebuf)
 static int
 has_wext(int sock_fd, const char *device, char *ebuf)
 {
-#ifdef IW_MODE_MONITOR
 	struct iwreq ireq;
 
 	strncpy(ireq.ifr_ifrn.ifrn_name, device,
@@ -2498,7 +3714,6 @@ has_wext(int sock_fd, const char *device, char *ebuf)
 	    "%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
 	if (errno == ENODEV)
 		return PCAP_ERROR_NO_SUCH_DEVICE;
-#endif
 	return 0;
 }
 
@@ -2534,7 +3749,6 @@ typedef enum {
 static int
 enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 {
-#ifdef IW_MODE_MONITOR
 	/*
 	 * XXX - at least some adapters require non-Wireless Extensions
 	 * mechanisms to turn monitor mode on.
@@ -2622,7 +3836,7 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 	strncpy(ireq.ifr_ifrn.ifrn_name, device,
 	    sizeof ireq.ifr_ifrn.ifrn_name);
 	ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
-	ireq.u.data.pointer = args;
+	ireq.u.data.pointer = (void *)args;
 	ireq.u.data.length = 0;
 	ireq.u.data.flags = 0;
 	if (ioctl(sock_fd, SIOCGIWPRIV, &ireq) != -1) {
@@ -2652,7 +3866,7 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 			 "malloc: %s", pcap_strerror(errno));
 		return PCAP_ERROR;
 	}
-	ireq.u.data.pointer = priv;
+	ireq.u.data.pointer = (void *)priv;
 	if (ioctl(sock_fd, SIOCGIWPRIV, &ireq) == -1) {
 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
 		    "%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
@@ -2672,8 +3886,10 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 			 * Hostap driver, use this one.
 			 * Set monitor mode first.
 			 * You can set it to 0 to get DLT_IEEE80211,
-			 * 1 to get DLT_PRISM, or 2 to get
-			 * DLT_IEEE80211_RADIO_AVS.
+			 * 1 to get DLT_PRISM, 2 to get
+			 * DLT_IEEE80211_RADIO_AVS, and, with more
+			 * recent versions of the driver, 3 to get
+			 * DLT_IEEE80211_RADIO.
 			 */
 			if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
 				break;
@@ -2887,7 +4103,7 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 			 * Note that we have to put the old mode back
 			 * when we close the device.
 			 */
-			handle->md.must_clear |= MUST_CLEAR_RFMON;
+			handle->md.must_do_on_close |= MUST_CLEAR_RFMON;
 
 			/*
 			 * Add this to the list of pcaps to close
@@ -2936,8 +4152,19 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 
 	case MONITOR_HOSTAP:
 		/*
-		 * Select the AVS header if we can, otherwise
-		 * select the Prism header.
+		 * Try to select the radiotap header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 3;	/* request radiotap header */
+		memcpy(ireq.u.name, args, sizeof (int));
+		if (ioctl(sock_fd, cmd, &ireq) != -1)
+			break;	/* success */
+
+		/*
+		 * That failed.  Try to select the AVS header.
 		 */
 		memset(&ireq, 0, sizeof ireq);
 		strncpy(ireq.ifr_ifrn.ifrn_name, device,
@@ -2945,18 +4172,19 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
 		args[0] = 2;	/* request AVS header */
 		memcpy(ireq.u.name, args, sizeof (int));
-		if (ioctl(sock_fd, cmd, &ireq) == -1) {
-			/*
-			 * Failure - try the Prism header.
-			 */
-			memset(&ireq, 0, sizeof ireq);
-			strncpy(ireq.ifr_ifrn.ifrn_name, device,
-			    sizeof ireq.ifr_ifrn.ifrn_name);
-			ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
-			args[0] = 1;	/* request Prism header */
-			memcpy(ireq.u.name, args, sizeof (int));
-			ioctl(sock_fd, cmd, &ireq);
-		}
+		if (ioctl(sock_fd, cmd, &ireq) != -1)
+			break;	/* success */
+
+		/*
+		 * That failed.  Try to select the Prism header.
+		 */
+		memset(&ireq, 0, sizeof ireq);
+		strncpy(ireq.ifr_ifrn.ifrn_name, device,
+		    sizeof ireq.ifr_ifrn.ifrn_name);
+		ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
+		args[0] = 1;	/* request Prism header */
+		memcpy(ireq.u.name, args, sizeof (int));
+		ioctl(sock_fd, cmd, &ireq);
 		break;
 
 	case MONITOR_PRISM:
@@ -3067,7 +4295,7 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 	 * Note that we have to put the old mode back when we
 	 * close the device.
 	 */
-	handle->md.must_clear |= MUST_CLEAR_RFMON;
+	handle->md.must_do_on_close |= MUST_CLEAR_RFMON;
 
 	/*
 	 * Add this to the list of pcaps to close when we exit.
@@ -3075,13 +4303,41 @@ enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
 	pcap_add_to_pcaps_to_close(handle);
 
 	return 1;
-#else
+}
+#endif /* IW_MODE_MONITOR */
+
+/*
+ * Try various mechanisms to enter monitor mode.
+ */
+static int
+enter_rfmon_mode(pcap_t *handle, int sock_fd, const char *device)
+{
+#if defined(HAVE_LIBNL) || defined(IW_MODE_MONITOR)
+	int ret;
+#endif
+
+#ifdef HAVE_LIBNL
+	ret = enter_rfmon_mode_mac80211(handle, sock_fd, device);
+	if (ret < 0)
+		return ret;	/* error attempting to do so */
+	if (ret == 1)
+		return 1;	/* success */
+#endif /* HAVE_LIBNL */
+
+#ifdef IW_MODE_MONITOR
+	ret = enter_rfmon_mode_wext(handle, sock_fd, device);
+	if (ret < 0)
+		return ret;	/* error attempting to do so */
+	if (ret == 1)
+		return 1;	/* success */
+#endif /* IW_MODE_MONITOR */
+
 	/*
-	 * We don't have the Wireless Extensions available, so we can't
-	 * do monitor mode.
+	 * Either none of the mechanisms we know about work or none
+	 * of those mechanisms are available, so we can't do monitor
+	 * mode.
 	 */
 	return 0;
-#endif
 }
 
 #endif /* HAVE_PF_PACKET_SOCKETS */
@@ -3118,7 +4374,7 @@ activate_old(pcap_t *handle)
 
 	/* Bind to the given device */
 
-	if (!device) {
+	if (strcmp(device, "any") == 0) {
 		strncpy(handle->errbuf, "pcap_activate: The \"any\" device isn't supported on 2.0[.x]-kernel systems",
 			PCAP_ERRBUF_SIZE);
 		return PCAP_ERROR;
@@ -3183,7 +4439,7 @@ activate_old(pcap_t *handle)
 					 pcap_strerror(errno));
 				return PCAP_ERROR;
 			}
-			handle->md.must_clear |= MUST_CLEAR_PROMISC;
+			handle->md.must_do_on_close |= MUST_CLEAR_PROMISC;
 
 			/*
 			 * Add this to the list of pcaps
@@ -3358,7 +4614,7 @@ iface_get_arptype(int fd, const char *device, char *ebuf)
 
 #ifdef SO_ATTACH_FILTER
 static int
-fix_program(pcap_t *handle, struct sock_fprog *fcode)
+fix_program(pcap_t *handle, struct sock_fprog *fcode, int is_mmapped)
 {
 	size_t prog_size;
 	register int i;
@@ -3391,26 +4647,33 @@ fix_program(pcap_t *handle, struct sock_fprog *fcode)
 
 		case BPF_RET:
 			/*
-			 * It's a return instruction; is the snapshot
-			 * length a constant, rather than the contents
-			 * of the accumulator?
+			 * It's a return instruction; are we capturing
+			 * in memory-mapped mode?
 			 */
-			if (BPF_MODE(p->code) == BPF_K) {
+			if (!is_mmapped) {
 				/*
-				 * Yes - if the value to be returned,
-				 * i.e. the snapshot length, is anything
-				 * other than 0, make it 65535, so that
-				 * the packet is truncated by "recvfrom()",
-				 * not by the filter.
-				 *
-				 * XXX - there's nothing we can easily do
-				 * if it's getting the value from the
-				 * accumulator; we'd have to insert
-				 * code to force non-zero values to be
-				 * 65535.
+				 * No; is the snapshot length a constant,
+				 * rather than the contents of the
+				 * accumulator?
 				 */
-				if (p->k != 0)
-					p->k = 65535;
+				if (BPF_MODE(p->code) == BPF_K) {
+					/*
+					 * Yes - if the value to be returned,
+					 * i.e. the snapshot length, is
+					 * anything other than 0, make it
+					 * 65535, so that the packet is
+					 * truncated by "recvfrom()",
+					 * not by the filter.
+					 *
+					 * XXX - there's nothing we can
+					 * easily do if it's getting the
+					 * value from the accumulator; we'd
+					 * have to insert code to force
+					 * non-zero values to be 65535.
+					 */
+					if (p->k != 0)
+						p->k = 65535;
+				}
 			}
 			break;