There's usually some questions that get asked multiple times on either the forum or github issues. This section tries to tackle some of them so as to save developers time when they come across them.
When libpcap 1.5.0 was released, they made some changes to the way packets are captured by introducing TPACKET_V3, a different way for the kernel to deliver packets to userland. As a default, this packet capture mechanism uses a buffered mode, which will try to create batches of packets before delivering to userspace. As a result, you might see that you get chunks of packets every e.g. one second. That is, you won't see any packets being captured and suddenly you'll get a burst of several of them.
As much as this is expected using TPACKET_V3, they did introduce a way to use a non buffered mode in case you need to implement low latency packet capture applications. This can be configured by using the immediate mode capture on libpcap handles. On libtins, this can be done the following way:
// Create a sniffer configuration and configure the immediate mode
SnifferConfiguration config;
config.set_immediate_mode(true);
// Now create the sniffer object using the configuration
Sniffer sniffer("eth0", config);The TCPStreamFollower class was a very dirty piece of code that was written for an unrelated reason and somehow made it to the library. It is a very limited interface to reassembling TCP streams and it should have never been included in libtins. This class is currently deprecated, so you should try moving away from it soon, although hopefully nobody is actually using it.
After a few years, the TCP stream reassembling code was re-written, now using C++11 functions as callbacks, providing a much cleaner and powerful way to do the same. Check the TCP streams tutorial to get started with it.
The tins/config.h is generated by CMake after it finishes configuring the project. Therefore, you need to run CMake before you can actually build and use the library, assuming you're building it from the source code. Make sure to check the downloads section which explains how to build the library.
If you get some error like the following when trying to build an application that is using libtins:
test.cpp:(.text+0x83): undefined reference to `Tins::operator<<(std::ostream&, Tins::IPv4Address const&)'
test.cpp:(.text+0xb7): undefined reference to `Tins::operator<<(std::ostream&, Tins::IPv4Address const&)'Then you're very likely not linking it against libtins. Make sure to follow the instructions under the using libtins section of the website
Capturing packets requires administrator privileges. If you're on GNU/Linux or OSX/FreeBSD, make sure you're running your application as root.
If you're using Windows, you need to have the WinPCAP driver installed and running to be able to capture packets. Note that this is different from the WinPCAP libraries/include files that you would need in order to build libtins.