FAQ
Q: Do I need libpcap?
A: Yes, you can get it at www.tcpdump.org
Q: Error “open socket: Too many open files”
A: The software need to bind a lot of ports. Change your ulimit settings: “ulimit -n 1024”.
Q: Why do I need root privileges?
A: Root privileges are needed because of raw sockets and to be able to open the pcap interface.
Q: Why is there a TCP option on SYN packets?
A: During test a strange firewall doesn't reply on TCP SYN with empty options, so I decided to put MSS (Maximum Segment Size) on them.
Q: Does it work under windows?
A: I don't know, never tested it, but I think there will be problems due to the raw sockets.