spaces
Added interfaces sorting function
Used pcap_add_if() to avoid double free error.
ISUP() and ISRUNNING() added.
Merge pull request #337 from crondaemon/master

Added interfaces sorting function
Fix indentation.
Document new flags, fix typo.
Make pcap_if_sort() static and get rid of unused variables.

pcap_if_sort() isn't used outside this file, so make it static.

Clean up indentation while we're at it.
Don't exclude interfaces that aren't up.

On some platforms, you can capture on those interfaces, which might be
useful if you want to start a capture before the interface is up, so
that the capture starts capturing as soon as it's up.

Those interfaces will not appear in the interface list on platforms
where you can't open them for capturing, and they'll now be sorted after
the interfaces that *are* up, so there's not much harm in including
them.
Return the value of pcap_add_if() from septel_findalldevs().

That way, errors are reflected to the caller.

Also, just pass strings directly to pcap_add_if(), and get rid of unused
variables.
Pull the code to add an address to an interface into a routine.

Call that routine from fad-win32.c, rather than duplicating the code.
Don't lose the addresses for interfaces.

pcap_add_if() doesn't add addresses; instead of the existing sort code
called by pcap_findalldevs(), change the code for inserting interfaces
into the list to use a "figure of merit" that takes the running, up, and
loopback bits into account, as well as the number from the interface
name, rather than just the interface name, into account.
Another check for IFF_UP removed.
Pull the code to add an address-less Linux interface into a routine.

The code to scan /sys/class/net and the code to scan /proc/net/dev had
common code to, when they found an interface, add it to the interface
list; pull that code into a common routine.
Fix/update some comments.
Pull the code to get an interface description into a separate routine().
Don't treat all open errors as reasons not to list an interface.

Only treat "the capture mechanism doesn't know about this device" and
"you can't capture on the interface because it isn't up" as reasons not
to list it, as there's no point in showing those interfaces to users.
For all other reasons, show it to the user, so they can try to capture
on it and then find out why it doesn't work (e.g., you're not running
with sufficient permissions).
Don't support D-Bus sniffing on OS X.

See freedesktop.org bug 74029:

	https://bugs.freedesktop.org/show_bug.cgi?id=74029

for details.
resolve a Clang warning in can_read_linux()

./pcap-can-linux.c:246:18: warning: comparison of unsigned expression < 0 is
always false [-Wtautological-compare]
if (pkth.caplen < 0)
~~~~~~~~~~~ ^ ~
Byte-swap the T and L in TLVs as necessary when reading an NFLOG file.

That means that, when reading a LINKTYPE_NFLOG file, the type and length
values are in the byte order of the host *reading* the file, rather than
the host that *wrote* the file, just as they're in the byte order of the
host capturing the traffic if you're doing a live capture of NFLOG
messages.

That way, when reading a LINKTYPE_NFLOG file and writing another one
from those packets, the type and length in the output file will be in
the byte order of the host writing the file, rather than the byte order
of the host that wrote the input file.

Export the nflog.h file containing the declarations and definitions we
need, for use by tcpdump and other programs reading LINKTYPE_NFLOG
files.

Put the bulk of the byte-swapping code into a common routine, for use by
pcap and pcap-ng readers, while we're at it.