# Install libpcap with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper Portable library for network traffic capture. Version 1.10.6 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:libpcap ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install libpcap ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install libpcap ``` Evidence: MacPorts ports tree: net/libpcap/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add libpcap ``` Evidence: Alpine Linux edge package indexes: libpcap from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install libpcap-dev ``` Evidence: Debian stable package indexes: libpcap-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install libpcap ``` Evidence: Fedora Rawhide package metadata: libpcap from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#libpcap ``` Evidence: nixpkgs package indexes: pkgs/by-name/li/libpcap/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S libpcap ``` Evidence: Arch Linux sync databases: libpcap from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz - zypper (92%): ```sh sudo zypper install libpcap-devel ``` Evidence: openSUSE Tumbleweed package metadata: libpcap-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:libpcap - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.10.6 - **Source summary:** Portable library for network traffic capture - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-3-Clause - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - pcap-config (cli) - pcap-config (alias) ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.10.6 - Local data: ok - Upstream repository: https://www.tcpdump.org/ - info: No package-manager update timestamp was available. - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage libpcap is the portable packet-capture library maintained with tcpdump by The Tcpdump Group. It gives programs a common C API for capturing packets and compiling packet filters across Unix-like operating systems whose native capture interfaces differ. ### Project history The project grew out of the tcpdump and Berkeley Packet Filter lineage. Steve McCanne's SharkFest 2011 talk traces the packet-capture work back to a 1988 Berkeley/Lawrence Berkeley Laboratory setting, while the 1993 BPF paper documents the kernel/user-level filtering architecture that made efficient capture practical. The Tcpdump Group later maintained libpcap as a separate library paired with tcpdump. The repository and CHANGES file show long-running attention to operating-system capture backends, filter syntax, savefile reading, remote capture support, and ABI concerns. ### Adoption history libpcap became infrastructure rather than an end-user application: tcpdump, analyzers, monitors, and security tools can link against one API while relying on each operating system's capture mechanism underneath. The upstream README explicitly addresses Linux distributions and BSD systems that ship libpcap and warns packagers not to encode release-specific sonames. Its adoption is also tied to the pcap file and filter culture around tcpdump: packet captures, reproducible troubleshooting, and command-line network forensics all use libpcap conventions even when users interact through higher-level tools. ### How it is used Developers use libpcap to enumerate capture devices, open live or saved captures, compile packet filters, and read packet records. Package-manager users usually install it as a dependency of network tools or as development headers for software that needs packet capture. The small `pcap-config` utility is package-nerd visible because build systems and ports use it to discover compiler and linker flags for libpcap. ### Why package nerds care libpcap matters because it is a thin but durable portability layer over messy kernel capture APIs. It is the package that turns packet capture from an operating-system-specific problem into a linkable library dependency. It is also a classic packaging stress test: headers, shared-library ABI, privileged capture behavior, optional capture backends, and security-sensitive parsers all meet in one small C library. ### Timeline - 1988: tcpdump and BPF lineage begins in the Berkeley/Lawrence Berkeley Laboratory packet-capture work described by Steve McCanne. - 1993: The BSD Packet Filter paper documents the efficient packet filtering architecture behind the tcpdump/libpcap family. - 2003-11-12: The libpcap CHANGES file records the 0.8 release summary. - 2008-10-27: The libpcap CHANGES file records the 1.0.0 release summary. - 2023-04-07: The libpcap CHANGES file records the 1.10.4 release summary. ### Related projects - tcpdump is libpcap's sibling command-line analyzer and the most direct companion project. - BPF is the filtering architecture behind libpcap filter compilation and efficient packet selection. - WinPcap and Npcap are Windows-oriented relatives in the pcap ecosystem, while Wireshark is a major downstream packet-analysis application in the same capture-file culture. ### Sources - - - - - ## Security Notes library-like package without higher-risk signals. - **Geiger risk:** green / low - library-like package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** libpcap - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** yes - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - libpcap-dev - 1.10.5-2: normalized package name match | Debian stable package indexes: libpcap-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | development library for libpcap (transitional package) | https://www.tcpdump.org/ - Debian apt - libpcap0.8-dev - 1.10.5-2: normalized package name match | Debian stable package indexes: libpcap0.8-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | development library and header files for libpcap0.8t64 | https://www.tcpdump.org/ - Debian apt - libpcap0.8t64 - 1.10.5-2: normalized package name match | Debian stable package indexes: libpcap0.8t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | system interface for user-level packet capture | https://www.tcpdump.org/ - Nix - libpcap: normalized package name match | nixpkgs package indexes: pkgs/by-name/li/libpcap/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - libpcap-dev - 1.10.4-4.1ubuntu3: normalized package name match | Ubuntu 24.04 LTS package indexes: libpcap-dev from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | development library for libpcap (transitional package) | https://www.tcpdump.org/ - Ubuntu apt - libpcap0.8-dev - 1.10.4-4.1ubuntu3: normalized package name match | Ubuntu 24.04 LTS package indexes: libpcap0.8-dev from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | development library and header files for libpcap0.8t64 | https://www.tcpdump.org/ - Ubuntu apt - libpcap0.8t64 - 1.10.4-4.1ubuntu3: normalized package name match | Ubuntu 24.04 LTS package indexes: libpcap0.8t64 from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz | system interface for user-level packet capture | https://www.tcpdump.org/ - apk - libpcap - 1.10.6-r1: normalized package name match | Alpine Linux edge package indexes: libpcap from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Portable library for network traffic capture | https://www.tcpdump.org/ - apk - libpcap-dev - 1.10.6-r1: normalized package name match | Alpine Linux edge package indexes: libpcap-dev from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Portable library for network traffic capture (development files) | https://www.tcpdump.org/ - apk - libpcap-doc - 1.10.6-r1: normalized package name match | Alpine Linux edge package indexes: libpcap-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Portable library for network traffic capture (documentation) | https://www.tcpdump.org/ - dnf - libpcap - 1.10.6-2.fc44: normalized package name match | Fedora Rawhide package metadata: libpcap from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | A system-independent interface for user-level packet capture | https://www.tcpdump.org/ - dnf - libpcap-devel - 1.10.6-2.fc44: normalized package name match | Fedora Rawhide package metadata: libpcap-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Libraries and header files for the libpcap library | https://www.tcpdump.org/ - pacman - libpcap - 1.10.6-1: normalized package name match | Arch Linux sync databases: libpcap from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz | A system-independent interface for user-level packet capture | https://www.tcpdump.org/ - zypper - libpcap-devel - 1.10.6-1.4: normalized package name match | openSUSE Tumbleweed package metadata: libpcap-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | A Library for Network Sniffers | https://www.tcpdump.org/ - zypper - libpcap-devel-32bit - 1.10.6-1.4: normalized package name match | openSUSE Tumbleweed package metadata: libpcap-devel-32bit from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | A Library for Network Sniffers | https://www.tcpdump.org/ - zypper - libpcap-devel-static - 1.10.6-1.4: normalized package name match | openSUSE Tumbleweed package metadata: libpcap-devel-static from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | A Library for Network Sniffers | https://www.tcpdump.org/ ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [iptables](https://www.automicvault.com/pkg/brew/iptables/) - Popular package that depends on this formula. - [ngrep](https://www.automicvault.com/pkg/brew/ngrep/) - Popular package that depends on this formula. - [pcl](https://www.automicvault.com/pkg/brew/pcl/) - Popular package that depends on this formula. - [rtabmap](https://www.automicvault.com/pkg/brew/rtabmap/) - Popular package that depends on this formula. - [snort](https://www.automicvault.com/pkg/brew/snort/) - Popular package that depends on this formula. - [ssldump](https://www.automicvault.com/pkg/brew/ssldump/) - Popular package that depends on this formula. - [sslsplit](https://www.automicvault.com/pkg/brew/sslsplit/) - Popular package that depends on this formula. - [synscan](https://www.automicvault.com/pkg/brew/synscan/) - Popular package that depends on this formula. - [tcpdump](https://www.automicvault.com/pkg/brew/tcpdump/) - Shares the same upstream homepage. - [daemonlogger](https://www.automicvault.com/pkg/brew/daemonlogger/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [bittwist](https://www.automicvault.com/pkg/brew/bittwist/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [gensio](https://www.automicvault.com/pkg/brew/gensio/) - Shares av.db curated category or tags: c-library, cli, networking. - [gsasl](https://www.automicvault.com/pkg/brew/gsasl/) - Shares av.db curated category or tags: c-library, cli, networking. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Shares av.db curated category or tags: cli, networking, packet-capture, tcpdump. - [ldns](https://www.automicvault.com/pkg/brew/ldns/) - Shares av.db curated category or tags: c-library, cli, networking. - [libdnet](https://www.automicvault.com/pkg/brew/libdnet/) - Shares av.db curated category or tags: c-library, cli, networking. - [libnl](https://www.automicvault.com/pkg/brew/libnl/) - Shares av.db curated category or tags: c-library, cli, networking. - [sniffer](https://www.automicvault.com/pkg/brew/sniffer/) - Local metadata places this package in an adjacent workflow. Shared terms: capture, cli, network, networking, packet. ## Combined YAML source View the package source record on GitHub. [combined/libpcap.yml](https://github.com/automic-vault/db/blob/main/combined/libpcap.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph