Hi Guix,

libpcap comes with a couple of backends that are disabled by default.
Among those available backends is “pcap-linux”.  By default the only
backends are

    pcap-null
    pcap-usb-linux
    pcap-can-linux
    pcap-netfilter-linux
    pcap-common

‘netfilter-linux’ doesn’t work out of the box and I think it requires
loading iptables/netfilter kernel modules (I have not yet found the
correct modules to load, so I can only guess).  When “--with-pcap=linux”
is passed “pcap-linux.c” is compiled as well, which makes tcpdump work
out of the box without the need to load any further modules.

Thanks to Ludovic for providing a crucial bit of information!

~~ Ricardo