OpenBSD's tcpdump(1) is fork of tcpdump.org, a lot of early work went into adding security features to bpf to facilitate implementation of privilege dropping/se

OpenBSD's tcpdump(1) is fork of tcpdump.org, a lot of early work went into adding security features to bpf to facilitate implementation of privilege dropping/separation in bpf programs. In 2003, the first parts were added, bpf write filters and descriptor locking, this considerably limits the scope of access to bpf writers and byte packet parsers. http://marc.info/?l=openbsd-cvs&m=106684834031056&w=2 http://marc.info/?l=openbsd-cvs&m=106684834031056&w=2 By 2004, initial privilege separation support was already committed to tcpdump(1) by Can E. Acar and Otto Moerbeek. http://marc.info/?l=openbsd-cvs&m=107531986114887&w=2 http://marc.info/?l=openbsd-cvs&m=107531986114887&w=2 With the introduction of pledge in 2015; the privilege separation work had been further refined, with the packet parser limited to now just stdio operations, unable to read/write files or open network connections. http://marc.info/?l=openbsd-cvs&m=144383352229927&w=2 http://marc.info/?l=openbsd-cvs&m=144383352229927&w=2 http://marc.info/?l=openbsd-cvs&m=146908579408853&w=2 http://marc.info/?l=openbsd-cvs&m=146908579408853&w=2 So, tcpdump is a fine network security analysis tool.. on OpenBSD today.