Wireshark-2.6.6

#### Beyond Linux® From Scratch - Version 2019-02-27

### Chapter 16. Networking Utilities

- Prev

  Whois-5.4.1

- Next

  Networking Libraries

- Up
- Home

# Wireshark-2.6.6

## Introduction to Wireshark

The Wireshark package contains a network protocol analyzer, also known as a “sniffer”. This is useful for analyzing data captured “off the wire” from a live network connection, or data read from a capture file.

Wireshark provides both a graphical and a TTY-mode front-end for examining captured network packets from over 500 protocols, as well as the capability to read capture files from many other popular network analyzers.

This package is known to build and work properly using an LFS-8.4 platform.

### Package Information

- Download (HTTP): https://www.wireshark.org/download/src/all-versions/wireshark-2.6.6.tar.xz

- Download MD5 sum: b30ba5b9b48ed2ff91c0ce357d33b46b

- Download size: 27 MB

- Estimated disk space required: 2.0 GB (with default GUI front-end, and all optional dependencies available in the BLFS book)

- Estimated build time: 4.0 SBU (with parallelism=4, default GUI front-end, and all optional dependencies available in the BLFS book)

### Additional Downloads

- Optional patch: http://www.linuxfromscratch.org/patches/blfs/svn/wireshark-2.6.6-lua_5_3-1.patch (allows building the LUA bindings if Lua-5.3.5 is installed and LUA is not disabled by passing `--without-lua` to configure)

- Additional Documentation: https://www.wireshark.org/download/docs/ (contains links to several different docs in a variety of formats)

### Wireshark dependencies

#### Required

GLib-2.58.3 and libgcrypt-1.8.4

#### Recommended

libpcap-1.9.0 (required to capture data), and Qt-5.12.1 (for the Qt5 GUI)

#### Optional

c-ares-1.15.0, GnuTLS-3.6.6, GTK+-3.24.5 or GTK+-2.24.32 (for the legacy GTK GUI), libnl-3.4.0, Lua-5.3.5, MIT Kerberos V5-1.17, nghttp2-1.36.0, SBC-1.4, libsmi, lz4, GeoIP, libssh, PortAudio (for GTK+ RTP player), Snappy, and Spandsp

### Note

The Qt GUI front-end is built by default, if Qt-5.12.1 is found. If you want to build the GTK+ GUI front-end, some configure switches have to be set (see “Command Explanations”).

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/wireshark

## Kernel Configuration

The kernel must have the Packet protocol enabled for Wireshark to capture live packets from the network:

    [*] Networking support --->          [CONFIG_NET]
          Networking options --->
            <*/M> Packet socket          [CONFIG_PACKET]

If built as a module, the name is `af_packet.ko`.

## Installation of Wireshark

Wireshark is a very large and complex application. These instructions provide additional security measures to ensure that only trusted users are allowed to view network traffic. First, set up a system group for wireshark. As the `root` user:

    groupadd -g 62 wireshark

Continue to install Wireshark by running the following commands:

    patch -Np1 -i ../wireshark-2.6.6-lua_5_3-1.patch  &&

    ./configure --prefix=/usr --sysconfdir=/etc &&
    make

This package does not come with a test suite.

Now, as the `root` user:

    make install &&

    install -v -m755 -d /usr/share/doc/wireshark-2.6.6 &&
    install -v -m644    README.linux doc/README.* doc/*.{pod,txt} \
                        /usr/share/doc/wireshark-2.6.6 &&

    pushd /usr/share/doc/wireshark-2.6.6 &&
       for FILENAME in ../../wireshark/*.html; do
          ln -s -v -f $FILENAME .
       done &&
    popd
    unset FILENAME

If you downloaded any of the documentation files from the page listed in the 'Additional Downloads', install them by issuing the following commands as the `root` user:

    install -v -m644 <Downloaded_Files> \
                     /usr/share/doc/wireshark-2.6.6

Now, set ownership and permissions of sensitive applications to only allow authorized users. As the `root` user:

    chown -v root:wireshark /usr/bin/{tshark,dumpcap} &&
    chmod -v 6550 /usr/bin/{tshark,dumpcap}

Finally, add any users to the wireshark group (as `root` user):

    usermod -a -G wireshark <username>

If you are installing wireshark for the first time, it will be necessary to leave the session and login again, thus you will now have wireshark between your groups, otherwise, it will not run properly.

## Command Explanations

`--with-gtk=[yes/no/2/3]`: For the Gtk+ GUI. Default is no. If both Gtk+2 and 3 are installed, and “yes” is selected, default is 3. Obviously, GTK+-2.24.32 or GTK+-3.24.5 must have been built for this to work.

`--with-qt=[yes/no/4/5]`: For the Qt GUI. Default is yes, if Qt-5.12.1 is found on the system.

`--disable-wireshark`: Use this switch if you have Qt installed but do not want to build any of the GUIs.

## Configuring Wireshark

### Config Files

`/etc/wireshark.conf` and `~/.config/wireshark/*` (unless there is already `~/.wireshark/*` in the system)

### Configuration Information

Though the default configuration parameters are very sane, reference the configuration section of the Wireshark User's Guide for configuration information. Most of Wireshark's configuration can be accomplished using the menu options of the wireshark graphical interfaces.

### Note

If you want to look at packets, make sure you don't filter them out with Iptables-1.8.2. If you want to exclude certain classes of packets, it is more efficient to do it with iptables than it is with Wireshark.

## Contents

Installed Programs: capinfos, captype, dftest, dumpcap, editcap, idl2wrs, mergecap, randpkt, rawshark, reordercap, sharkd, text2pcap, tshark, wireshark, and wireshark-gtk (optional)
Installed Libraries: libwireshark.so, libwiretap.so, libwscodecs.so (optional), libwsutil.so, and numerous modules under /usr/lib/wireshark/plugins
Installed Directories: /usr/{lib,share}/wireshark and /usr/share/doc/wireshark-2.6.6

### Short Descriptions

capinfos | reads a saved capture file and returns any or all of several statistics about that file. It is able to detect and read any capture supported by the Wireshark package.
captype | prints the file types of capture files.
dftest | is a display-filter-compiler test program.
dumpcap | is a network traffic dump tool. It lets you capture packet data from a live network and write the packets to a file.
editcap | edits and/or translates the format of capture files. It knows how to read libpcap capture files, including those of tcpdump, Wireshark and other tools that write captures in that format.
idl2wrs | is a program that takes a user specified CORBA IDL file and generates “C” source code for a Wireshark “plugin”. It relies on two Python programs wireshark_be.py and wireshark_gen.py, which are not installed by default. They have to be copied manually from the `tools` directory to the `$PYTHONPATH/site-packages/` directory.
mergecap | combines multiple saved capture files into a single output file.
randpkt | creates random-packet capture files.
rawshark | dump and analyze raw libpcap data.
reordercap | reorder timestamps of input file frames into output file.
sharkd | is a daemon that listens on UNIX sockets.
text2pcap | reads in an ASCII hex dump and writes the data described into a libpcap-style capture file.
tshark | is a TTY-mode network protocol analyzer. It lets you capture packet data from a live network or read packets from a previously saved capture file.
wireshark | is the Qt GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file.
wireshark-gtk | is the Gtk+ GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file (optional).
`libwireshark.so` | contains functions used by the Wireshark programs to perform filtering and packet capturing.
`libwiretap.so` | is a library being developed as a future replacement for `libpcap`, the current standard Unix library for packet capturing. For more information, see the `README` file in the source `wiretap` directory.

Last updated on 2019-02-19 15:58:07 -0600

- Prev

  Whois-5.4.1

- Next

  Networking Libraries

- Up
- Home