Chris February 2016

Include only the necessary functions from libpcap

I have a C++ JNI Library (that I did not write myself) that uses the functionality of libpcap. There are only a few functions that are actually being used from libpcap but when the library is compiled, every function gets included. Perhaps it's a flag? I've searched and can't seem to find an answer to my question.

The older developers were using BJAM to do the compile, and I've recently been tasked to convert it to GNU Make.

Here are all the pcap symbols in my Make compile:

00000000000197f0 T _pcap_activate
0000000000019d00 T _pcap_breakloop
0000000000019070 T _pcap_can_set_rfmon
0000000000019bb0 T _pcap_close
000000000001b560 T _pcap_compile
000000000001c180 T _pcap_compile_nopcap
00000000000192c0 T _pcap_create
0000000000019d10 T _pcap_datalink
0000000000019d30 T _pcap_datalink_ext
0000000000019ff0 T _pcap_datalink_name_to_val
000000000001a080 T _pcap_datalink_val_to_description
0000000000019f70 T _pcap_datalink_val_to_name
00000000000191c0 T _pcap_dispatch
000000000003b660 T _pcap_dump
000000000003bde0 T _pcap_dump_close
000000000003bda0 T _pcap_dump_file
000000000003bdc0 T _pcap_dump_flush
000000000003b8d0 T _pcap_dump_fopen
000000000003bdb0 T _pcap_dump_ftell
000000000003b6d0 T _pcap_dump_open
000000000003b940 T _pcap_dump_open_append
000000000003a650 T _pcap_ether_aton
000000000003a780 T _pcap_ether_hostton
000000000001a240 T _pcap_file
000000000001a250 T _pcap_fileno
0000000000019220 T _pcap_findalldevs
000000000003acd0 T _pcap_fopen_offline
000000000003a910 T _pcap_fopen_offline_with_tstamp_precision
0000000000019e20 T _pcap_free_datalinks
0000000000019140 T _pcap_free_tstamp_types
000000000001af60 T _pcap_freealldevs
000000000001c1f0 T _pcap_freecode
000000000001a260 T _pcap_get_selectable_fd
00000000000197e0 T _pcap_get_tstamp_precision
000000000001a2a0 T _pcap_geterr
000000000001a2b0 T _pcap_getnonblock
000000000001a760 T _pcap_inject
000000000001a1e0 T _pcap_is_swapped
000000000001a7a0 T _pcap_lib_version
0000000000019d        

Answers


Guy Harris February 2016

Without an indication of what command built the BJAM version, there are strict limits on what I can suggest if you want to make the Makefile build the same way BJAM did, given that I don't know what BJAM did.

However, if we look at the command used for Make, it's not linking with the system version of libpcap, it's linking with a snapshot of tcpdump.org's master branch:

c++ ... -L/Users/vdawn/src/3rdparty/pcap/libpcap/1.8.0-PRE-GIT/ -lpcap ...

If what's being linked with is a static version of libpcap, then it will include every object file in the static library that contains a symbol to which the JNI library refers.

This means that if you use, for example, pcap_open_live(), it will include the object file that defines it. That's pcap.o, and pcap.o defines the following symbols:

                 U ___bzero
                 U ___error
                 U ___snprintf_chk
                 U ___stderrp
                 U ___strlcpy_chk
                 U _atexit
                 U _bpf_filter
                 U _calloc
000000000000c160 S _capture_source_types
0000000000008ed0 s _charmap
                 U _close
000000000000c18a b _did_atexit
0000000000009000 s _dlt_choices
                 U _fcntl
                 U _fprintf
                 U _free
                 U _malloc
                 U _memcpy
00000000000007e0 T _pcap_activate
00000000000017e0 T _pcap_add_to_pcaps_to_close
0000000000000440 t _pcap_alloc_pcap_t
0000000000000cd0 T _pcap_breakloop
0000000000000000 T _pcap_can_set_rfmon
00000000000004e0 t _pcap_cant_set_rfmon
0000000000000530 T _pcap_check_activated
00000000000019d0 t _pcap_cleanup_dead
0000000000001850 T _pcap_cleanup_live_common
0000000000000b80 T _pcap_close
0000000000001790 t _pcap_close_all
0000000000000250 T _pcap_create
00000000000002d0 T _pcap_create_common
                 U _pcap_create_interface
0000000000000ce0 T _pcap_datalink
 

Post Status

Asked in February 2016
Viewed 3,251 times
Voted 7
Answered 1 times

Search




Leave an answer