Wireshark-1.12.4

朴灿烈づ我的快乐病毒、 2022-08-07 16:56 142阅读 0赞

## Introduction to Wireshark ##

The Wireshark package contains a network protocol analyzer, also known as a “sniffer”. This is useful for analyzing data captured “off the wire” from a live network connection, or data read from a capture file.

Wireshark provides both a graphical and a TTY-mode front-end for examining captured network packets from over 500 protocols, as well as the capability to read capture files from many other popular network analyzers.

This package is known to build and work properly using an LFS-7.7 platform.

### Package Information ###

*  Download (HTTP): [https://www.wireshark.org/download/src/all-versions/wireshark-1.12.4.tar.bz2][https_www.wireshark.org_download_src_all-versions_wireshark-1.12.4.tar.bz2]
 *  Download (FTP): [ftp://ftp.uni-kl.de/pub/wireshark/src/wireshark-1.12.4.tar.bz2][ftp_ftp.uni-kl.de_pub_wireshark_src_wireshark-1.12.4.tar.bz2]
 *  Download MD5 sum: acfa156fd35cb66c867b1ace992e4b5b
 *  Download size: 28 MB
 *  Estimated disk space required: 1.2 GB (1.4 GB, with the Qt GUI)
 *  Estimated build time: 4.3 SBU (5.3 SBU, with the Qt GUI)

### Additional Downloads ###

*  Optional patch: [http://www.linuxfromscratch.org/patches/blfs/svn/wireshark-1.12.4-lua\_5\_3\_0-1.patch][http_www.linuxfromscratch.org_patches_blfs_svn_wireshark-1.12.4-lua_5_3_0-1.patch] (allows to build the LUA bindings if[Lua-5.3.0][] is installed and LUA is not disabled by passing `--without-lua` to **configure**)
 *  Additional Documentation: [https://www.wireshark.org/download/docs/][https_www.wireshark.org_download_docs] (contains links to several different docs in a variety of formats)

### Wireshark dependencies ###

#### Required ####

[GLib-2.44.0][]

#### Recommended ####

[GTK+-3.16.2][GTK_-3.16.2] (to build the Gtk+3 GUI) and [libpcap-1.7.2][] (required to capture data)

#### Optional ####

[GnuTLS-3.3.14][], [libgcrypt-1.6.3][], [Lua-5.3.0][], [MIT Kerberos V5-1.13.1][], [OpenSSL-1.0.2a][], [adns][], [GeoIP][], and [PortAudio][]

#### Optional (to build more GUI front-ends) ####

[GTK+-2.24.27][GTK_-2.24.27], [Qt-4.8.6][], or [Qt-5.4.1][]

![\[Note\]][Note]

### Note ###

The GTK+ GUI needs one of [GTK+-2.24.27][GTK_-2.24.27] or [GTK+-3.16.2][GTK_-3.16.2]. If both are installed, GTK+3 is used by default.

The Qt GUI needs one of [Qt-4.8.6][] or [Qt-5.4.1][]. If both are installed, Qt5 is used by default.

Both GTK+ and Qt GUI can be built at the same time. If you want to override the defaults, some configure switches have to be set (see “Command Explanations”) or some special instructions have to be issued (see below) when both Qt4 and Qt5 are installed and you want to use Qt4. SBU and disk space required are larger for the Qt GUI. The instructions below suppose you only want to build the GTK+3 GUI.

User Notes: [http://wiki.linuxfromscratch.org/blfs/wiki/wireshark][http_wiki.linuxfromscratch.org_blfs_wiki_wireshark]

## Kernel Configuration ##

The kernel must have the Packet protocol enabled for Wireshark to capture live packets from the network:

[*] Networking support ---> [CONFIG_NET]
 Networking options --->
 <*/M> Packet socket [CONFIG_PACKET]

If built as a module, the name is `af_packet.ko`.

## Installation of Wireshark ##

Optionally, fix the description of the program in the title. The first change overwrites the default “SVN Unknown” in the title and the second overwrites a utility script that resets the version to “unknown”.

cat > svnversion.h << "EOF" &&
 #define SVNVERSION "BLFS"
 #define SVNPATH "source"
 EOF
 
 cat > make-version.pl << "EOF"
 #!/usr/bin/perl
 EOF

Wireshark is a very large and complex application. These instructions provide additional security measures to ensure that only trusted users are allowed to view network traffic. First, set up a system group for wireshark. As the `root` user:

groupadd -g 62 wireshark

If you want to build a Qt GUI and have both Qt4 and 5 installed, issue either:

source setqt5

if you want the Qt5 GUI built, or:

source setqt4 &&
    sed -i 's/Qt5 Qt/Qt/' configure

if you want the Qt4 GUI built.

Continue to install Wireshark by running the following commands:

patch -Np1 -i ../wireshark-1.12.4-lua_5_3_0-1.patch  &&
    
    ./configure --prefix=/usr     \
                --with-gtk3       \
                --without-qt      \
                --sysconfdir=/etc &&
    make

This package does not come with a test suite.

Now, as the `root` user:

make install &&
    
    install -v -m755 -d /usr/share/doc/wireshark-1.12.4 &&
    install -v -m755 -d /usr/share/pixmaps/wireshark &&
    
    install -v -m644    README{,.linux} doc/README.* doc/*.{pod,txt} \
                        /usr/share/doc/wireshark-1.12.4 &&
    
    pushd /usr/share/doc/wireshark-1.12.4 &&
       for FILENAME in ../../wireshark/*.html; do
          ln -s -v -f $FILENAME .
       done &&
    popd &&
    unset FILENAME
    
    install -v -m644 -D wireshark.desktop \
                        /usr/share/applications/wireshark.desktop &&
    
    install -v -m644 -D image/wsicon48.png \
                        /usr/share/pixmaps/wireshark.png &&
    
    install -v -m644    image/*.{png,ico,xpm,bmp} \
                        /usr/share/pixmaps/wireshark

If you downloaded any of the documentation files from the page listed in the 'Additional Downloads', install them by issuing the following commands as the`root` user:

install -v -m644 <Downloaded_Files> /usr/share/doc/wireshark-1.12.4

Now, set ownership and permissions of sensitive applications to only allow authorized users. As the `root` user:

chown -v root:wireshark /usr/bin/{tshark,dumpcap} &&
    chmod -v 6550 /usr/bin/{tshark,dumpcap}

Finally, add any users to the wireshark group (as `root` user):

usermod -a -G wireshark <username>

## Command Explanations ##

**sed -i 's/Qt5 Qt/Qt/' ...**: This command is required because, without it, libraries and includes from Qt5 are found and used first, if both versions are installed, when trying to build with Qt4, and **make** does not complete.

*`--with-gtk3`*: By default, the build machinery will build a GUI for both Qt and GTK+, if those libraries are found. If Qt is installed and you do not want the GUI for it to be built, you need to pass *`--without-qt`* to the configure script. That overrides the default, so that you must specify *`--with-gtk3`* or *`--with-gtk2`* in order to have the GTK+ GUI built.

*`--without-qt`*: disables building of the Qt GUI.

`--disable-wireshark`: Use this switch if you have GTK+ installed but do not want to build any of the GUIs.

`--with-gtk2`: Use this option if you want the GTK+2 GUI. Notice that the GUI for only one GTK+ version (either 2 or 3) can be built.

## Configuring Wireshark ##

### Config Files ###

`/etc/wireshark.conf` and `~/.wireshark/*`

### Configuration Information ###

Though the default configuration parameters are very sane, reference the configuration section of the [Wireshark User's Guide][Wireshark User_s Guide] for configuration information. Most of Wireshark's configuration can be accomplished using the menu options of the **wireshark** graphical interfaces.

### Desktop file for the Qt GUI ###

If Qt GUI was built and you wish an entry in the desktop menu, there are two possibilities (instructions must be run as root).

If only the Qt GUI was built:

mv -v /usr/share/applications/wireshark.desktop \
          /usr/share/applications/wireshark-qt.desktop

If both, GTK+ and Qt GUIs were built:

cp -v /usr/share/applications/wireshark.desktop \
          /usr/share/applications/wireshark-qt.desktop

Now, fix it for **wireshark-qt**:

sed -e 's/ireshark/&-qt/' \
        -e 's/^$Icon=wireshark$-qt/\1/' \
        -i /usr/share/applications/wireshark-qt.desktop

![\[Note\]][Note]

### Note ###

If you want to look at packets, make sure you don't filter them out with [Iptables-1.4.21][]. If you want to exclude certain classes of packets, it is more efficient to do it with iptables than it is with Wireshark.

## Contents ##

Installed Programs: capinfos, captype, dftest, dumpcap, editcap, mergecap, randpkt, rawshark, reordercap, text2pcap, tshark, wireshark, and optionally wireshark-qt

Installed Libraries: libfiletap.so, libwireshark.so, libwiretap.so, libwsutil.so, and numerous modules under /usr/lib/wireshark/plugins

Installed Directories: /usr/lib/wireshark, /usr/share/doc/wireshark-1.12.4, /usr/share/pixmaps/wireshark, and /usr/share/wireshark

### Short Descriptions ###

<table style="width:auto; margin:0px 1em"> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>capinfos </td> 
 <td style="vertical-align:top"> reads a saved capture file and returns any or all of several statistics about that file. It is able to detect and read any capture supported by the&nbsp;Wireshark&nbsp;package. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>captype </td> 
 <td style="vertical-align:top"> prints the file types of capture files. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>dftest </td> 
 <td style="vertical-align:top"> is a display-filter-compiler test program. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>dumpcap </td> 
 <td style="vertical-align:top"> is a network traffic dump tool. It lets you capture packet data from a live network and write the packets to a file. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>editcap </td> 
 <td style="vertical-align:top"> edits and/or translates the format of capture files. It knows how to read&nbsp;libpcap&nbsp;capture files, including those of&nbsp;tcpdump,&nbsp;Wiresharkand other tools that write captures in that format. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>mergecap </td> 
 <td style="vertical-align:top"> combines multiple saved capture files into a single output file. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>randpkt </td> 
 <td style="vertical-align:top"> creates random-packet capture files. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>rawshark </td> 
 <td style="vertical-align:top"> dump and analyze raw libpcap data. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>reordercap </td> 
 <td style="vertical-align:top"> reorder timestamps of input file frames into output file. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>text2pcap </td> 
 <td style="vertical-align:top"> reads in an ASCII hex dump and writes the data described into a&nbsp;libpcap-style capture file. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>tshark </td> 
 <td style="vertical-align:top"> is a TTY-mode network protocol analyzer. It lets you capture packet data from a live network or read packets from a previously saved capture file. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>wireshark </td> 
 <td style="vertical-align:top"> is the GTK+ GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a>wireshark-qt </td> 
 <td style="vertical-align:top"> is the Qt GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a><code>libwireshark.so</code> </td> 
 <td style="vertical-align:top"> contains functions used by the&nbsp;Wireshark&nbsp;programs to perform filtering and packet capturing. </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top"> <a rel="nofollow"></a><code>libwiretap.so</code> </td> 
 <td style="vertical-align:top"> is a library being developed as a future replacement for&nbsp;<code>libpcap</code>, the current standard Unix library for packet capturing. For more information, see the&nbsp;<code>README</code>&nbsp;file in the source&nbsp;<code>wiretap</code>&nbsp;directory. </td> 
 </tr> 
 </tbody> 
</table>

[https_www.wireshark.org_download_src_all-versions_wireshark-1.12.4.tar.bz2]: https://www.wireshark.org/download/src/all-versions/wireshark-1.12.4.tar.bz2
[ftp_ftp.uni-kl.de_pub_wireshark_src_wireshark-1.12.4.tar.bz2]: ftp://ftp.uni-kl.de/pub/wireshark/src/wireshark-1.12.4.tar.bz2
[http_www.linuxfromscratch.org_patches_blfs_svn_wireshark-1.12.4-lua_5_3_0-1.patch]: http://www.linuxfromscratch.org/patches/blfs/svn/wireshark-1.12.4-lua_5_3_0-1.patch
[Lua-5.3.0]: http://www.linuxfromscratch.org/blfs/view/svn/general/lua.html
[https_www.wireshark.org_download_docs]: https://www.wireshark.org/download/docs/
[GLib-2.44.0]: http://www.linuxfromscratch.org/blfs/view/svn/general/glib2.html
[GTK_-3.16.2]: http://www.linuxfromscratch.org/blfs/view/svn/x/gtk3.html
[libpcap-1.7.2]: http://www.linuxfromscratch.org/blfs/view/svn/basicnet/libpcap.html
[GnuTLS-3.3.14]: http://www.linuxfromscratch.org/blfs/view/svn/postlfs/gnutls.html
[libgcrypt-1.6.3]: http://www.linuxfromscratch.org/blfs/view/svn/general/libgcrypt.html
[MIT Kerberos V5-1.13.1]: http://www.linuxfromscratch.org/blfs/view/svn/postlfs/mitkrb.html
[OpenSSL-1.0.2a]: http://www.linuxfromscratch.org/blfs/view/svn/postlfs/openssl.html
[adns]: http://www.gnu.org/software/adns/adns.html
[GeoIP]: http://www.maxmind.com/app/c
[PortAudio]: http://www.portaudio.com/download.html
[GTK_-2.24.27]: http://www.linuxfromscratch.org/blfs/view/svn/x/gtk2.html
[Qt-4.8.6]: http://www.linuxfromscratch.org/blfs/view/svn/x/qt4.html
[Qt-5.4.1]: http://www.linuxfromscratch.org/blfs/view/svn/x/qt5.html
[Note]: /images/20220805/4e348b964c4f411d9d7c502740668676.png
[http_wiki.linuxfromscratch.org_blfs_wiki_wireshark]: http://wiki.linuxfromscratch.org/blfs/wiki/wireshark
[Wireshark User_s Guide]: http://www.wireshark.org/docs/wsug_html/
[Iptables-1.4.21]: http://www.linuxfromscratch.org/blfs/view/svn/postlfs/iptables.html