2021-12-22 22:02:13 +08:00
|
|
|
# tcpdump installation notes
|
2007-06-16 04:12:32 +08:00
|
|
|
If you have not built libpcap, and your system does not have libpcap
|
|
|
|
installed, install libpcap first. Your system might provide a version
|
|
|
|
of libpcap that can be installed; if so, to compile tcpdump you might
|
|
|
|
need to install a "developer" version of libpcap as well as the
|
|
|
|
"run-time" version. You can also install tcpdump.org's version of
|
2021-12-22 22:02:13 +08:00
|
|
|
libpcap; see [this file](README.md) for the location.
|
1999-10-08 07:47:09 +08:00
|
|
|
|
2021-11-19 22:33:22 +08:00
|
|
|
You will need a C99 compiler to build tcpdump. The build system
|
|
|
|
will abort if your compiler is not C99 compliant. If this happens, use
|
|
|
|
the generally available GNU C compiler (GCC) or Clang.
|
1999-10-08 07:47:09 +08:00
|
|
|
|
2021-12-22 22:02:13 +08:00
|
|
|
After libpcap has been built (either install it with `make install` or
|
2000-07-29 14:50:51 +08:00
|
|
|
make sure both the libpcap and tcpdump source trees are in the same
|
2023-01-31 18:11:12 +08:00
|
|
|
directory), do the following steps:
|
|
|
|
|
|
|
|
* If you build from a git clone rather than from a release archive,
|
|
|
|
run `./autogen.sh` (a shell script). The autogen.sh script will
|
|
|
|
build the `configure` and `config.h.in` files.
|
|
|
|
|
|
|
|
On some system, you may need to set the `AUTORECONF` variable, like:
|
|
|
|
`AUTORECONF=autoreconf-2.69 ./autogen.sh`
|
|
|
|
to select the `autoreconf` version you want to use.
|
|
|
|
|
|
|
|
* Run `./configure` (a shell script). The configure script will
|
2021-12-22 22:02:13 +08:00
|
|
|
determine your system attributes and generate an appropriate `Makefile`
|
2023-01-31 18:11:12 +08:00
|
|
|
from `Makefile.in`. The configure script has a number of options to
|
|
|
|
control the configuration of tcpdump; `./configure --help` will show
|
|
|
|
them.
|
|
|
|
|
|
|
|
* Next, build tcpdump by running `make`.
|
|
|
|
|
|
|
|
On OpenBSD, you may need to set, before the `make`, the `AUTOCONF_VERSION`
|
|
|
|
variable like:
|
|
|
|
`AUTOCONF_VERSION=2.69 make`
|
1999-10-08 07:47:09 +08:00
|
|
|
|
2021-12-22 22:02:13 +08:00
|
|
|
If everything builds ok, `su` and type `make install`. This will install
|
2007-06-16 04:12:32 +08:00
|
|
|
tcpdump and the manual entry. Any user will be able to use tcpdump to
|
|
|
|
read saved captures. Whether a user will be able to capture traffic
|
2021-12-22 22:02:13 +08:00
|
|
|
depends on the OS and the configuration of the system; see the
|
|
|
|
[tcpdump man page](https://www.tcpdump.org/manpages/tcpdump.1.html)
|
|
|
|
for details. DO NOT give untrusted users the ability to
|
2007-06-16 04:12:32 +08:00
|
|
|
capture traffic. If a user can capture traffic, he or she could use
|
|
|
|
utilities such as tcpdump to capture any traffic on your net, including
|
|
|
|
passwords.
|
1999-10-08 07:47:09 +08:00
|
|
|
|
2000-07-29 14:50:51 +08:00
|
|
|
Note that most systems ship tcpdump, but usually an older version.
|
2021-11-19 22:33:22 +08:00
|
|
|
Building tcpdump from source as explained above will usually install the
|
2021-12-22 22:02:13 +08:00
|
|
|
binary as `/usr/local/bin/tcpdump`. If your system has other tcpdump
|
2021-11-19 22:33:22 +08:00
|
|
|
binaries, you might need to deinstall these or to set the PATH environment
|
2021-12-22 22:02:13 +08:00
|
|
|
variable if you need the `tcpdump` command to run the new binary
|
|
|
|
(`tcpdump --version` can be used to tell different versions apart).
|
1999-10-08 07:47:09 +08:00
|
|
|
|
|
|
|
If your system is not one which we have tested tcpdump on, you may have
|
2021-12-22 22:02:13 +08:00
|
|
|
to modify the `configure` script and `Makefile.in`. Please
|
|
|
|
[send us patches](https://www.tcpdump.org/index.html#patches)
|
2000-01-25 08:47:09 +08:00
|
|
|
for any modifications you need to make.
|
1999-10-08 07:47:09 +08:00
|
|
|
|
2021-12-22 22:02:13 +08:00
|
|
|
Please see [this file](README.md) for notes about tested platforms.
|
2000-01-15 02:05:45 +08:00
|
|
|
|
|
|
|
|
2021-12-22 22:02:13 +08:00
|
|
|
## Description of files
|
|
|
|
```
|
2003-12-15 10:38:32 +08:00
|
|
|
CHANGES - description of differences between releases
|
2022-06-09 17:14:26 +08:00
|
|
|
CONTRIBUTING.md - guidelines for contributing
|
2000-07-29 14:50:51 +08:00
|
|
|
CREDITS - people that have helped tcpdump along
|
2021-12-22 22:02:13 +08:00
|
|
|
INSTALL.md - this file
|
2002-07-16 12:36:08 +08:00
|
|
|
LICENSE - the license under which tcpdump is distributed
|
1999-10-08 07:47:09 +08:00
|
|
|
Makefile.in - compilation rules (input to the configure script)
|
2021-04-17 01:25:11 +08:00
|
|
|
README.md - description of distribution
|
1999-10-08 07:47:09 +08:00
|
|
|
VERSION - version of this release
|
|
|
|
aclocal.m4 - autoconf macros
|
|
|
|
addrtoname.c - address to hostname routines
|
|
|
|
addrtoname.h - address to hostname definitions
|
2018-07-29 05:03:57 +08:00
|
|
|
addrtostr.c - address to printable string routines
|
|
|
|
addrtostr.h - address to printable string definitions
|
2002-07-16 12:36:08 +08:00
|
|
|
ah.h - IPSEC Authentication Header definitions
|
1999-10-08 07:47:09 +08:00
|
|
|
appletalk.h - AppleTalk definitions
|
2015-06-12 06:47:44 +08:00
|
|
|
ascii_strcasecmp.c - locale-independent case-independent string comparison
|
|
|
|
routines
|
1999-10-08 07:47:09 +08:00
|
|
|
atime.awk - TCP ack awk script
|
2002-07-16 12:46:41 +08:00
|
|
|
atm.h - ATM traffic type definitions
|
2023-01-31 18:11:12 +08:00
|
|
|
autogen.sh - build configure and config.h.in (run this first)
|
2002-07-16 12:36:08 +08:00
|
|
|
bpf_dump.c - BPF program printing routines, in case libpcap doesn't
|
|
|
|
have them
|
|
|
|
chdlc.h - Cisco HDLC definitions
|
2004-10-12 05:27:43 +08:00
|
|
|
cpack.c - functions to extract packed data
|
|
|
|
cpack.h - declarations of functions to extract packed data
|
1999-10-08 07:47:09 +08:00
|
|
|
config.guess - autoconf support
|
|
|
|
config.sub - autoconf support
|
2017-12-01 02:20:37 +08:00
|
|
|
configure.ac - configure script source
|
2022-07-18 20:06:59 +08:00
|
|
|
doc/README.* - some building documentation
|
2002-07-16 12:36:08 +08:00
|
|
|
ethertype.h - Ethernet type value definitions
|
1999-10-08 07:47:09 +08:00
|
|
|
extract.h - alignment definitions
|
2003-06-10 07:28:08 +08:00
|
|
|
gmpls.c - GMPLS definitions
|
|
|
|
gmpls.h - GMPLS declarations
|
1999-10-08 07:47:09 +08:00
|
|
|
install-sh - BSD style install script
|
|
|
|
interface.h - globals, prototypes and definitions
|
2002-07-16 12:36:08 +08:00
|
|
|
ip.h - IP definitions
|
|
|
|
ip6.h - IPv6 definitions
|
2004-10-12 05:27:43 +08:00
|
|
|
ipproto.c - IP protocol type value-to-name table
|
2003-06-07 19:57:51 +08:00
|
|
|
ipproto.h - IP protocol type value definitions
|
2004-10-12 05:27:43 +08:00
|
|
|
l2vpn.c - L2VPN encapsulation value-to-name table
|
|
|
|
l2vpn.h - L2VPN encapsulation definitions
|
2002-07-16 12:36:08 +08:00
|
|
|
lbl/os-*.h - OS-dependent defines and prototypes
|
1999-10-08 07:47:09 +08:00
|
|
|
llc.h - LLC definitions
|
|
|
|
machdep.c - machine dependent routines
|
|
|
|
machdep.h - machine dependent definitions
|
|
|
|
makemib - mib to header script
|
|
|
|
mib.h - mib definitions
|
2000-01-25 08:47:09 +08:00
|
|
|
missing/* - replacements for missing library functions
|
2018-10-04 02:19:37 +08:00
|
|
|
ntp.c - functions to handle ntp structs
|
|
|
|
ntp.h - declarations of functions to handle ntp structs
|
1999-10-08 07:47:09 +08:00
|
|
|
mkdep - construct Makefile dependency list
|
2004-10-12 05:27:43 +08:00
|
|
|
mpls.h - MPLS definitions
|
2000-07-29 14:50:51 +08:00
|
|
|
nameser.h - DNS definitions
|
2004-10-12 05:27:43 +08:00
|
|
|
netdissect.h - definitions and declarations for tcpdump-as-library
|
|
|
|
(under development)
|
2000-01-25 08:47:09 +08:00
|
|
|
nfs.h - Network File System V2 definitions
|
1999-10-08 07:47:09 +08:00
|
|
|
nfsfh.h - Network File System file handle definitions
|
2004-10-12 05:27:43 +08:00
|
|
|
nlpid.c - OSI NLPID value-to-name table
|
|
|
|
nlpid.h - OSI NLPID definitions
|
1999-10-08 07:47:09 +08:00
|
|
|
ospf.h - Open Shortest Path First definitions
|
|
|
|
packetdat.awk - TCP chunk summary awk script
|
|
|
|
parsenfsfh.c - Network File System file parser routines
|
2002-12-19 17:27:54 +08:00
|
|
|
pcap-missing.h - declarations of functions possibly missing from libpcap
|
1999-10-08 07:47:09 +08:00
|
|
|
ppp.h - Point to Point Protocol definitions
|
2016-08-10 02:56:03 +08:00
|
|
|
print.c - Top-level routines for protocol printing
|
2016-08-14 21:42:19 +08:00
|
|
|
print-*.c - The netdissect printers
|
2004-12-27 08:41:29 +08:00
|
|
|
rpc_auth.h - definitions for ONC RPC authentication
|
|
|
|
rpc_msg.h - definitions for ONC RPC messages
|
1999-10-08 07:47:09 +08:00
|
|
|
send-ack.awk - unidirectional tcp send/ack awk script
|
2002-07-16 12:36:08 +08:00
|
|
|
slcompress.h - SLIP/PPP Van Jacobson compression (RFC1144) definitions
|
|
|
|
smb.h - SMB/CIFS definitions
|
|
|
|
smbutil.c - SMB/CIFS utility routines
|
1999-10-08 07:47:09 +08:00
|
|
|
stime.awk - TCP send awk script
|
2002-07-16 12:36:08 +08:00
|
|
|
tcp.h - TCP definitions
|
1999-10-08 07:47:09 +08:00
|
|
|
tcpdump.1 - manual entry
|
|
|
|
tcpdump.c - main program
|
2015-07-03 01:14:49 +08:00
|
|
|
timeval-operations.h - timeval operations macros
|
2002-07-16 12:36:08 +08:00
|
|
|
udp.h - UDP definitions
|
2016-08-10 02:56:03 +08:00
|
|
|
util-print.c - utility routines for protocol printers
|
2021-12-22 22:02:13 +08:00
|
|
|
```
|