375 lines
16 KiB
Plaintext
375 lines
16 KiB
Plaintext
To build libpcap, run "./configure" (a shell script). The configure
|
|
script will determine your system attributes and generate an
|
|
appropriate Makefile from Makefile.in. Next run "make". If everything
|
|
goes well you can su to root and run "make install". However, you need
|
|
not install libpcap if you just want to build tcpdump; just make sure
|
|
the tcpdump and libpcap directory trees have the same parent
|
|
directory.
|
|
|
|
If configure says:
|
|
|
|
configure: warning: cannot determine packet capture interface
|
|
configure: warning: (see INSTALL for more info)
|
|
|
|
then your system either does not support packet capture or your system
|
|
does support packet capture but libpcap does not support that
|
|
particular type. (If you have HP-UX, see below.) If your system uses a
|
|
packet capture not supported by libpcap, please send us patches; don't
|
|
forget to include an autoconf fragment suitable for use in
|
|
configure.ac.
|
|
|
|
It is possible to override the default packet capture type, although
|
|
the circumstance where this works are limited. For example if you have
|
|
installed bpf under SunOS 4 and wish to build a snit libpcap:
|
|
|
|
./configure --with-pcap=snit
|
|
|
|
Another example is to force a supported packet capture type in the case
|
|
where the configure scripts fails to detect it.
|
|
|
|
You will need an ANSI C compiler to build libpcap. The configure script
|
|
will abort if your compiler is not ANSI compliant. If this happens, use
|
|
the generally available GNU C compiler (GCC).
|
|
|
|
You will need either Flex 2.5.31 or later, or a version of Lex
|
|
compatible with it (if any exist), to build libpcap. The configure
|
|
script will abort if there isn't any such program. If you have an older
|
|
version of Flex, or don't have a compatible version of Lex, the current
|
|
version of flex is available at flex.sourceforge.net.
|
|
|
|
You will need either Bison, Berkeley YACC, or a version of YACC
|
|
compatible with them (if any exist), to build libpcap. The configure
|
|
script will abort if there isn't any such program. If you don't have
|
|
any such program, the current version of Bison can be found at
|
|
http://ftp.gnu.org/gnu/bison/ and the current version of Berkeley YACC
|
|
can be found at http://invisible-island.net/byacc/.
|
|
|
|
Sometimes the stock C compiler does not interact well with Flex and
|
|
Bison. The list of problems includes undefined references for alloca.
|
|
You can get around this by installing GCC.
|
|
|
|
If you use Solaris, there is a bug with bufmod(7) that is fixed in
|
|
Solaris 2.3.2 (aka SunOS 5.3.2). Setting a snapshot length with the
|
|
broken bufmod(7) results in data be truncated from the FRONT of the
|
|
packet instead of the end. The work around is to not set a snapshot
|
|
length but this results in performance problems since the entire packet
|
|
is copied to user space. If you must run an older version of Solaris,
|
|
there is a patch available from Sun; ask for bugid 1149065. After
|
|
installing the patch, use "setenv BUFMOD_FIXED" to enable use of
|
|
bufmod(7). However, we recommend you run a more current release of
|
|
Solaris.
|
|
|
|
If you use the SPARCompiler, you must be careful to not use the
|
|
/usr/ucb/cc interface. If you do, you will get bogus warnings and
|
|
perhaps errors. Either make sure your path has /opt/SUNWspro/bin
|
|
before /usr/ucb or else:
|
|
|
|
setenv CC /opt/SUNWspro/bin/cc
|
|
|
|
before running configure. (You might have to do a "make distclean"
|
|
if you already ran configure once).
|
|
|
|
Also note that "make depend" won't work; while all of the known
|
|
universe uses -M, the SPARCompiler uses -xM to generate makefile
|
|
dependencies.
|
|
|
|
If you are trying to do packet capture with a FORE ATM card, you may or
|
|
may not be able to. They usually only release their driver in object
|
|
code so unless their driver supports packet capture, there's not much
|
|
libpcap can do.
|
|
|
|
If you get an error like:
|
|
|
|
tcpdump: recv_ack: bind error 0x???
|
|
|
|
when using DLPI, look for the DL_ERROR_ACK error return values, usually
|
|
in /usr/include/sys/dlpi.h, and find the corresponding value.
|
|
|
|
Under {DEC OSF/1, Digital UNIX, Tru64 UNIX}, packet capture must be
|
|
enabled before it can be used. For instructions on how to enable packet
|
|
filter support, see:
|
|
|
|
ftp://ftp.digital.com/pub/Digital/dec-faq/Digital-UNIX
|
|
|
|
Look for the "How do I configure the Berkeley Packet Filter and capture
|
|
tcpdump traces?" item.
|
|
|
|
Once you enable packet filter support, your OSF system will support bpf
|
|
natively.
|
|
|
|
Under Ultrix, packet capture must be enabled before it can be used. For
|
|
instructions on how to enable packet filter support, see:
|
|
|
|
ftp://ftp.digital.com/pub/Digital/dec-faq/ultrix
|
|
|
|
If you use HP-UX, you must have at least version 9 and either the
|
|
version of cc that supports ANSI C (cc -Aa) or else use the GNU C
|
|
compiler. You must also buy the optional streams package. If you don't
|
|
have:
|
|
|
|
/usr/include/sys/dlpi.h
|
|
/usr/include/sys/dlpi_ext.h
|
|
|
|
then you don't have the streams package. In addition, we believe you
|
|
need to install the "9.X LAN and DLPI drivers cumulative" patch
|
|
(PHNE_6855) to make the version 9 DLPI work with libpcap.
|
|
|
|
The DLPI streams package is standard starting with HP-UX 10.
|
|
|
|
The HP implementation of DLPI is a little bit eccentric. Unlike
|
|
Solaris, you must attach /dev/dlpi instead of the specific /dev/*
|
|
network pseudo device entry in order to capture packets. The PPA is
|
|
based on the ifnet "index" number. Under HP-UX 9, it is necessary to
|
|
read /dev/kmem and the kernel symbol file (/hp-ux). Under HP-UX 10,
|
|
DLPI can provide information for determining the PPA. It does not seem
|
|
to be possible to trace the loopback interface. Unlike other DLPI
|
|
implementations, PHYS implies MULTI and SAP and you get an error if you
|
|
try to enable more than one promiscuous mode at a time.
|
|
|
|
It is impossible to capture outbound packets on HP-UX 9. To do so on
|
|
HP-UX 10, you will, apparently, need a late "LAN products cumulative
|
|
patch" (at one point, it was claimed that this would be PHNE_18173 for
|
|
s700/10.20; at another point, it was claimed that the required patches
|
|
were PHNE_20892, PHNE_20725 and PHCO_10947, or newer patches), and to do
|
|
so on HP-UX 11 you will, apparently, need the latest lancommon/DLPI
|
|
patches and the latest driver patch for the interface(s) in use on HP-UX
|
|
11 (at one point, it was claimed that patches PHNE_19766, PHNE_19826,
|
|
PHNE_20008, and PHNE_20735 did the trick).
|
|
|
|
Furthermore, on HP-UX 10, you will need to turn on a kernel switch by
|
|
doing
|
|
|
|
echo 'lanc_outbound_promisc_flag/W 1' | adb -w /stand/vmunix /dev/mem
|
|
|
|
You would have to arrange that this happen on reboots; the right way to
|
|
do that would probably be to put it into an executable script file
|
|
"/sbin/init.d/outbound_promisc" and making
|
|
"/sbin/rc2.d/S350outbound_promisc" a symbolic link to that script.
|
|
|
|
Finally, testing shows that there can't be more than one simultaneous
|
|
DLPI user per network interface.
|
|
|
|
If you use Linux, this version of libpcap is known to compile and run
|
|
under Red Hat 4.0 with the 2.0.25 kernel. It may work with earlier 2.X
|
|
versions but is guaranteed not to work with 1.X kernels. Running more
|
|
than one libpcap program at a time, on a system with a 2.0.X kernel, can
|
|
cause problems since promiscuous mode is implemented by twiddling the
|
|
interface flags from the libpcap application; the packet capture
|
|
mechanism in the 2.2 and later kernels doesn't have this problem. Also,
|
|
packet timestamps aren't very good. This appears to be due to haphazard
|
|
handling of the timestamp in the kernel.
|
|
|
|
Note well: there is rumoured to be a version of tcpdump floating around
|
|
called 3.0.3 that includes libpcap and is supposed to support Linux.
|
|
You should be advised that neither the Network Research Group at LBNL
|
|
nor the Tcpdump Group ever generated a release with this version number.
|
|
The LBNL Network Research Group notes with interest that a standard
|
|
cracker trick to get people to install trojans is to distribute bogus
|
|
packages that have a version number higher than the current release.
|
|
They also noted with annoyance that 90% of the Linux related bug reports
|
|
they got are due to changes made to unofficial versions of their page.
|
|
If you are having trouble but aren't using a version that came from
|
|
tcpdump.org, please try that before submitting a bug report!
|
|
|
|
On Linux, libpcap will not work if the kernel does not have the packet
|
|
socket option enabled; see the README.linux file for information about
|
|
this.
|
|
|
|
If you use AIX, you may not be able to build libpcap from this release.
|
|
We do not have an AIX system in house so it's impossible for us to test
|
|
AIX patches submitted to us. We are told that you must link against
|
|
/lib/pse.exp, that you must use AIX cc or a GNU C compiler newer than
|
|
2.7.2, and that you may need to run strload before running a libpcap
|
|
application.
|
|
|
|
Read the README.aix file for information on installing libpcap and
|
|
configuring your system to be able to support libpcap.
|
|
|
|
If you use NeXTSTEP, you will not be able to build libpcap from this
|
|
release.
|
|
|
|
If you use SINIX, you should be able to build libpcap from this
|
|
release. It is known to compile and run on SINIX-Y/N 5.42 with the C-DS
|
|
V1.0 or V1.1 compiler. But note that in some releases of SINIX, yacc
|
|
emits incorrect code; if grammar.y fails to compile, change every
|
|
occurence of:
|
|
|
|
#ifdef YYDEBUG
|
|
|
|
to:
|
|
#if YYDEBUG
|
|
|
|
Another workaround is to use flex and bison.
|
|
|
|
If you use SCO, you might have trouble building libpcap from this
|
|
release. We do not have a machine running SCO and have not had reports
|
|
of anyone successfully building on it; the current release of libpcap
|
|
does not compile on SCO OpenServer 5. Although SCO apparently supports
|
|
DLPI to some extent, the DLPI in OpenServer 5 is very non-standard, and
|
|
it appears that completely new code would need to be written to capture
|
|
network traffic. SCO do not appear to provide tcpdump binaries for
|
|
OpenServer 5 or OpenServer 6 as part of SCO Skunkware:
|
|
|
|
http://www.sco.com/skunkware/
|
|
|
|
If you use UnixWare, you might be able to build libpcap from this
|
|
release, or you might not. We do not have a machine running UnixWare,
|
|
so we have not tested it; however, SCO provide packages for libpcap
|
|
0.6.2 and tcpdump 3.7.1 in the UnixWare 7/Open UNIX 8 part of SCO
|
|
Skunkware, and the source package for libpcap 0.6.2 is not changed from
|
|
the libpcap 0.6.2 source release, so this release of libpcap might also
|
|
build without changes on UnixWare 7.
|
|
|
|
If linking tcpdump fails with "Undefined: _alloca" when using bison on
|
|
a Sun4, your version of Bison is broken. In any case version 1.16 or
|
|
higher is recommended (1.14 is known to cause problems 1.16 is known to
|
|
work). Either pick up a current version from:
|
|
|
|
http://ftp.gnu.org/gnu/bison/
|
|
|
|
or hack around it by inserting the lines:
|
|
|
|
#ifdef __GNUC__
|
|
#define alloca __builtin_alloca
|
|
#else
|
|
#ifdef sparc
|
|
#include <alloca.h>
|
|
#else
|
|
char *alloca ();
|
|
#endif
|
|
#endif
|
|
|
|
right after the (100 line!) GNU license comment in bison.simple, remove
|
|
grammar.[co] and fire up make again.
|
|
|
|
If you use SunOS 4, your kernel must support streams NIT. If you run a
|
|
libpcap program and it dies with:
|
|
|
|
/dev/nit: No such device
|
|
|
|
You must add streams NIT support to your kernel configuration, run
|
|
config and boot the new kernel.
|
|
|
|
If you are running a version of SunOS earlier than 4.1, you will need
|
|
to replace the Sun supplied /sys/sun{3,4,4c}/OBJ/nit_if.o with the
|
|
appropriate version from this distribution's SUNOS4 subdirectory and
|
|
build a new kernel:
|
|
|
|
nit_if.o.sun3-sunos4 (any flavor of sun3)
|
|
nit_if.o.sun4c-sunos4.0.3c (SS1, SS1+, IPC, SLC, etc.)
|
|
nit_if.o.sun4-sunos4 (Sun4's not covered by
|
|
nit_if.o.sun4c-sunos4.0.3c)
|
|
|
|
These nit replacements fix a bug that makes nit essentially unusable in
|
|
pre-SunOS 4.1. In addition, our sun4c-sunos4.0.3c nit gives you
|
|
timestamps to the resolution of the SS-1 clock (1 us) rather than the
|
|
lousy 20ms timestamps Sun gives you (tcpdump will print out the full
|
|
timestamp resolution if it finds it's running on a SS-1).
|
|
|
|
FILES
|
|
-----
|
|
CHANGES - description of differences between releases
|
|
ChmodBPF/* - Mac OS X startup item to set ownership and permissions
|
|
on /dev/bpf*
|
|
CMakeLists.txt - CMake file
|
|
CREDITS - people that have helped libpcap along
|
|
INSTALL.txt - this file
|
|
LICENSE - the license under which tcpdump is distributed
|
|
Makefile.in - compilation rules (input to the configure script)
|
|
README - description of distribution
|
|
README.aix - notes on using libpcap on AIX
|
|
README.dag - notes on using libpcap to capture on Endace DAG devices
|
|
README.hpux - notes on using libpcap on HP-UX
|
|
README.linux - notes on using libpcap on Linux
|
|
README.macosx - notes on using libpcap on Mac OS X
|
|
README.septel - notes on using libpcap to capture on Intel/Septel devices
|
|
README.sita - notes on using libpcap to capture on SITA devices
|
|
README.tru64 - notes on using libpcap on Digital/Tru64 UNIX
|
|
README.Win32 - notes on using libpcap on Win32 systems (with WinPcap)
|
|
SUNOS4 - pre-SunOS 4.1 replacement kernel nit modules
|
|
VERSION - version of this release
|
|
acconfig.h - support for post-2.13 autoconf
|
|
aclocal.m4 - autoconf macros
|
|
arcnet.h - ARCNET definitions
|
|
atmuni31.h - ATM Q.2931 definitions
|
|
bpf/net - copy of bpf_filter.c
|
|
bpf_dump.c - BPF program printing routines
|
|
bpf_filter.c - symlink to bpf/net/bpf_filter.c
|
|
bpf_image.c - BPF disassembly routine
|
|
config.guess - autoconf support
|
|
config.h.in - autoconf input
|
|
config.sub - autoconf support
|
|
configure - configure script (run this first)
|
|
configure.ac - configure script source
|
|
dlpisubs.c - DLPI-related functions for pcap-dlpi.c and pcap-libdlpi.c
|
|
dlpisubs.h - DLPI-related function declarations
|
|
etherent.c - /etc/ethers support routines
|
|
ethertype.h - Ethernet protocol types and names definitions
|
|
fad-getad.c - pcap_findalldevs() for systems with getifaddrs()
|
|
fad-gifc.c - pcap_findalldevs() for systems with only SIOCGIFLIST
|
|
fad-glifc.c - pcap_findalldevs() for systems with SIOCGLIFCONF
|
|
filtertest.c - test program for BPF compiler
|
|
findalldevstest.c - test program for pcap_findalldevs()
|
|
gencode.c - BPF code generation routines
|
|
gencode.h - BPF code generation definitions
|
|
grammar.y - filter string grammar
|
|
ieee80211.h - 802.11 definitions
|
|
inet.c - network routines
|
|
install-sh - BSD style install script
|
|
lbl/os-*.h - OS-dependent defines and prototypes
|
|
llc.h - 802.2 LLC SAP definitions
|
|
missing/* - replacements for missing library functions
|
|
mkdep - construct Makefile dependency list
|
|
msdos/* - drivers for MS-DOS capture support
|
|
nametoaddr.c - hostname to address routines
|
|
nlpid.h - OSI network layer protocol identifier definitions
|
|
net - symlink to bpf/net
|
|
optimize.c - BPF optimization routines
|
|
pcap/bluetooth.h - public definition of DLT_BLUETOOTH_HCI_H4_WITH_PHDR header
|
|
pcap/bpf.h - BPF definitions
|
|
pcap/namedb.h - public libpcap name database definitions
|
|
pcap/pcap.h - public libpcap definitions
|
|
pcap/sll.h - public definition of DLT_LINUX_SLL header
|
|
pcap/usb.h - public definition of DLT_USB header
|
|
pcap-bpf.c - BSD Packet Filter support
|
|
pcap-bpf.h - header for backwards compatibility
|
|
pcap-bt-linux.c - Bluetooth capture support for Linux
|
|
pcap-bt-linux.h - Bluetooth capture support for Linux
|
|
pcap-dag.c - Endace DAG device capture support
|
|
pcap-dag.h - Endace DAG device capture support
|
|
pcap-dlpi.c - Data Link Provider Interface support
|
|
pcap-dos.c - MS-DOS capture support
|
|
pcap-dos.h - headers for MS-DOS capture support
|
|
pcap-enet.c - enet support
|
|
pcap-int.h - internal libpcap definitions
|
|
pcap-libdlpi.c - Data Link Provider Interface support for systems with libdlpi
|
|
pcap-linux.c - Linux packet socket support
|
|
pcap-namedb.h - header for backwards compatibility
|
|
pcap-nit.c - SunOS Network Interface Tap support
|
|
pcap-nit.h - SunOS Network Interface Tap definitions
|
|
pcap-null.c - dummy monitor support (allows offline use of libpcap)
|
|
pcap-pf.c - Ultrix and Digital/Tru64 UNIX Packet Filter support
|
|
pcap-pf.h - Ultrix and Digital/Tru64 UNIX Packet Filter definitions
|
|
pcap-septel.c - Intel/Septel device capture support
|
|
pcap-septel.h - Intel/Septel device capture support
|
|
pcap-sita.c - SITA device capture support
|
|
pcap-sita.h - SITA device capture support
|
|
pcap-sita.html - SITA device capture documentation
|
|
pcap-stdinc.h - includes and #defines for compiling on Win32 systems
|
|
pcap-snit.c - SunOS 4.x STREAMS-based Network Interface Tap support
|
|
pcap-snoop.c - IRIX Snoop network monitoring support
|
|
pcap-usb-linux.c - USB capture support for Linux
|
|
pcap-usb-linux.h - USB capture support for Linux
|
|
pcap-win32.c - WinPcap capture support
|
|
pcap.3pcap - manual entry for the library
|
|
pcap.c - pcap utility routines
|
|
pcap.h - header for backwards compatibility
|
|
pcap_*.3pcap - manual entries for library functions
|
|
pcap-filter.4 - manual entry for filter syntax
|
|
pcap-linktype.4 - manual entry for link-layer header types
|
|
ppp.h - Point to Point Protocol definitions
|
|
savefile.c - offline support
|
|
scanner.l - filter string scanner
|
|
sunatmpos.h - definitions for SunATM capturing
|
|
Win32 - headers and routines for building on Win32 systems
|