libpcap can print to standard error under certain conditions

[infrastation]

git grep stderr returns quite a few results, some of which are on popular code paths, for example, pcap_setfilter_linux() and pcap_cleanup_linux(). This is wrong for a library and should be fixed. If there is a genuine need to convey device close errors to the library user, perhaps it would make sense to introduce pcap_close_ex(), which would return a status code.

[guyharris]

And pcap_setfilter() has a problem, too. For pcap_open_live(), we use a trick wherein, to report a warning, we put the warning message into the error message buffer handed to pcap_open_live(), and recommend that the caller initialize that buffer to an empty string and, if pcap_open_live() succeeds, check if the error buffer has a non-null string in it and, if so, report it.

As pcap_setfilter() isn't passed an error buffer, but fills in the error buffer member of the pcap_t structure, the caller can't clear that - we could clear it ourselves, as we do with the buffer handed to pcap_open_live(), but code can't count on that, as it might be using an older libpcap that doesn't do that.

We should, at some point, have a pointer to a mallocated error buffer in pcap_t, and provide a routine to fetch that, in order to deal with the warnings we get from various compilers about formatting calls truncating messages. We can guarantee that any code that uses that API will only get a message if a warning is to be issued.

For now, we can just remove the fprintf()s in pcap_setfilter_linux() and note that we should, in the future, provide a way to return a warning in this case.