Digging into tcpdump implementation, I can see that it actually loads the libpcap.so dynamic library in userspace.
However, by use of strace, I can't see any occurrence of calls to any function exported by libpcap.
Is the above an expected behaviour of tcpdump? Thank you.
root@eve-ng02:~# tcpdump --help
tcpdump version 4.9.2
libpcap version 1.7.4
OpenSSL 1.0.2g 1 Mar 2016
Edit: from received comments I tried with ltrace but it seems no call to dynamic library is done as well.
root@eve-ng02:~# ltrace tcpdump -i lo
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
^C--- SIGINT (Interrupt) ---
0 packets captured
126 packets received by filter
98 packets dropped by kernel
+++ exited (status 0) +++
root@eve-ng02:~#
straceis meant for system calls not function calls as far as I know.ltrace.