Autoconf, libpcap, and one line.

Dependencies

libpcap	Required. Available from the tcpdump/libpcap project or your package manager.
c-ares	Optional, recommended: asynchronous reverse DNS during the trace. Works with the versions distributions ship. -Q disables it at run time.
ncurses	Only for --watch.

./configure finds Homebrew, /usr/local, /opt/local and /opt/pkg prefixes on its own.

The easy way

Configure, build and install in one go (root required for the install step):

Why the binary needs privilege — briefly

Tracing needs a raw socket to send probes and a capture handle to receive replies. On Linux, make install uses setcap(8) to grant exactly cap_net_raw,cap_net_admin — no setuid root. On FreeBSD and the other BSDs, LFT installs setuid root. On macOS, setuid root is required: ChmodBPF (the mechanism Wireshark uses) grants access to BPF capture devices only and does not grant the ability to create raw sockets, and macOS has no setcap equivalent — ping and traceroute ship setuid root for the same reason.

Whatever the platform, LFT drops root immediately after opening those two handles, the drop is verified, and it aborts if the drop fails. All parsing, name resolution, whois and output happen unprivileged; there is no system, exec or popen anywhere. The build enables stack protection, fortified calls, PIE and RELRO where the toolchain supports them. whob is never privileged.

"Root for two syscalls, then never again."

Installing by hand

Linux — preferred, least privilege:

BSD / macOS — setuid root (required):

lft -v prints the linked-library capabilities.

Windows

A Visual C makefile targeting the Npcap SDK is included (makefile.vc). Windows is a best-effort build, not a release platform, and TCP tracing on Windows is not supported.

Reporting bugs

Send reports through the contact form (choose Technical Support) with level-2 verbose output attached: lft -VV <target>.