Introduction to Wireshark
The Wireshark package contains a
network protocol analyzer, also known as a “sniffer”. This is useful for analyzing data
captured “off the wire” from
a live network connection, or data read from a capture file.
Wireshark provides both a
graphical and a TTY-mode front-end for examining captured network
packets from over 500 protocols, as well as the capability to read
capture files from many other popular network analyzers.
This package is known to build and work properly using an LFS-7.8
platform.
Package Information
Additional Downloads
Wireshark dependencies
Required
GLib-2.44.1
Recommended
GTK+-3.16.6 (to build the Gtk+3 GUI) and libpcap-1.7.4 (required to
capture data)
Optional
GnuTLS-3.4.4.1, libgcrypt-1.6.3, Lua-5.3.1, MIT Kerberos V5-1.13.2, OpenSSL-1.0.2d, adns, GeoIP, and
PortAudio
Optional (to build more GUI front-ends)
GTK+-2.24.28, Qt-4.8.7, or Qt-5.5.0
![[Note]](../images/note.png)
Note
The GTK+ GUI needs one of
GTK+-2.24.28 or GTK+-3.16.6. If both are
installed, GTK+3 is used by default.
The Qt GUI needs one of
Qt-4.8.7 or Qt-5.5.0. If both are installed, Qt5 is used
by default.
Both GTK+ and Qt GUI can be built at the same time. If you want
to override the defaults, some configure switches have to be set
(see “Command
Explanations”) or some special instructions have to
be issued (see below) when both Qt4 and Qt5 are installed and you
want to use Qt4. SBU and disk space required are larger for the
Qt GUI. The instructions below suppose you only want to build the
GTK+3 GUI.
User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/wireshark
Installation of Wireshark
Optionally, fix the description of the program in the title. The
first change overwrites the default “SVN
Unknown” in the title and the second overwrites a
utility script that resets the version to “unknown”.
cat > svnversion.h << "EOF" &&
#define SVNVERSION "BLFS"
#define SVNPATH "source"
EOF
cat > make-version.pl << "EOF"
#!/usr/bin/perl
EOF
Wireshark is a very large and
complex application. These instructions provide additional security
measures to ensure that only trusted users are allowed to view
network traffic. First, set up a system group for wireshark. As the
root user:
groupadd -g 62 wireshark
If you want to build the Qt GUI (see “Command Explanations”), for the Qt5 GUI, issue:
source setqt5 &&
sed -e 's/"-fPIE"/""/' \
-e 's/"-pie"/""/' \
-i configure
and add CXXFLAGS="-fPIC" to the
configure line, or, for the Qt4
GUI, issue:
source setqt4 &&
sed -i 's/Qt5 Qt/Qt/' configure
Continue to install Wireshark by
running the following commands:
patch -Np1 -i ../wireshark-1.12.7-lua_5_3_0-1.patch &&
./configure --prefix=/usr \
--with-gtk3 \
--without-qt \
--sysconfdir=/etc &&
make
This package does not come with a test suite.
Now, as the root user:
make install &&
install -v -m755 -d /usr/share/doc/wireshark-1.12.7 &&
install -v -m755 -d /usr/share/pixmaps/wireshark &&
install -v -m644 README{,.linux} doc/README.* doc/*.{pod,txt} \
/usr/share/doc/wireshark-1.12.7 &&
pushd /usr/share/doc/wireshark-1.12.7 &&
for FILENAME in ../../wireshark/*.html; do
ln -s -v -f $FILENAME .
done &&
popd &&
unset FILENAME
install -v -m644 -D wireshark.desktop \
/usr/share/applications/wireshark.desktop &&
install -v -m644 -D image/wsicon48.png \
/usr/share/pixmaps/wireshark.png &&
install -v -m644 image/*.{png,ico,xpm,bmp} \
/usr/share/pixmaps/wireshark
If you downloaded any of the documentation files from the page
listed in the 'Additional Downloads', install them by issuing the
following commands as the root
user:
install -v -m644 <Downloaded_Files> \
/usr/share/doc/wireshark-1.12.7
Now, set ownership and permissions of sensitive applications to
only allow authorized users. As the root user:
chown -v root:wireshark /usr/bin/{tshark,dumpcap} &&
chmod -v 6550 /usr/bin/{tshark,dumpcap}
Finally, add any users to the wireshark group (as root user):
usermod -a -G wireshark <username>
Command Explanations
sed -e 's/"-fPIE"/""/' ...
configure: This command is required for Qt-5.5,
because it is necessary to compile with CXXFLAGS="-fPIC".
sed -i 's/Qt5 Qt/Qt/'
...: This command is required because, without it,
libraries and includes from Qt5
are found and used first, if both versions are installed, when
trying to build with Qt4, and
make does not
complete.
--with-gtk3: By default,
the build machinery will build a GUI for both Qt and GTK+, if those
libraries are found. If Qt is installed and you do not want the GUI
for it to be built, you need to pass --without-qt to the configure script.
That overrides the default, so that you must specify --with-gtk3 or --with-gtk2 in order to have the GTK+
GUI built.
--without-qt: disables
building of the Qt GUI.
--disable-wireshark: Use this switch if
you have GTK+ installed but do not
want to build any of the GUIs.
--with-gtk2: Use this option if you
want the GTK+2 GUI. Notice that
the GUI for only one GTK+ version (either 2 or 3) can be built.
Configuring Wireshark
Config Files
/etc/wireshark.conf and
~/.wireshark/*
Configuration Information
Though the default configuration parameters are very sane,
reference the configuration section of the Wireshark User's
Guide for configuration information. Most of Wireshark's configuration can be
accomplished using the menu options of the wireshark graphical interfaces.
Desktop file for the Qt GUI
If Qt GUI was built and you wish an entry in the desktop menu,
there are two possibilities (instructions must be run as root).
If only the Qt GUI was built:
mv -v /usr/share/applications/wireshark.desktop \
/usr/share/applications/wireshark-qt.desktop
If both, GTK+ and Qt GUIs were built:
cp -v /usr/share/applications/wireshark.desktop \
/usr/share/applications/wireshark-qt.desktop
Now, fix it for wireshark-qt:
sed -e 's/ireshark/&-qt/' \
-e 's/^\(Icon=wireshark\)-qt/\1/' \
-i /usr/share/applications/wireshark-qt.desktop
Note
If you want to look at packets, make sure you don't filter them
out with Iptables-1.4.21. If you want to exclude
certain classes of packets, it is more efficient to do it with
iptables than it is with
Wireshark.