Beyond Linux® From Scratch (systemd Edition) - Version r12.0-816

Chapter 16. Networking Utilities

Wireshark-4.2.0

Introduction to Wireshark

The Wireshark package contains a network protocol analyzer, also known as a “sniffer”. This is useful for analyzing data captured “off the wire” from a live network connection, or data read from a capture file.

Wireshark provides both a graphical and a TTY-mode front-end for examining captured network packets from over 500 protocols, as well as the capability to read capture files from many other popular network analyzers.

[Note]

Note

Development versions of BLFS may not build or run some packages properly if LFS or dependencies have been updated since the most recent stable versions of the books.

Package Information

  • Download (HTTP): https://www.wireshark.org/download/src/all-versions/wireshark-4.2.0.tar.xz

  • Download MD5 sum: 37658796acb4e7a04a84fa8c5393c9a1

  • Download size: 43 MB

  • Estimated disk space required: 911 MB (with all optional dependencies available in the BLFS book; 168 MB installed)

  • Estimated build time: 2.9 SBU (with parallelism=4 and all optional dependencies available in the BLFS book)

Additional Downloads

Wireshark dependencies

Required

CMake-3.27.8, c-ares-1.22.1, GLib-2.78.1, libgcrypt-1.10.3, and Qt-6.6.1

[Note]

Note

Qt-6.6.1 is not strictly required, since it can be replaced with Qt5. See “Command explanations” below.

Recommended

libpcap-1.10.4 (required to capture data)

Optional

asciidoctor-2.0.20, Brotli-1.1.0, Doxygen-1.9.8, git-2.43.0, GnuTLS-3.8.2, libnl-3.8.0, libxslt-1.1.39, libxml2-2.12.1, Lua-5.2.4, MIT Kerberos V5-1.21.2, nghttp2-1.58.0, (Qt-5.15.11 or qt-components-5.15.11 with qtmultimedia) (required if Qt-6.6.1 is not installed), SBC-2.0, Speex-1.2.1, BCG729, libilbc, libsmi, lz4, libssh, MaxMindDB, Minizip, Snappy, and Spandsp

Kernel Configuration

The kernel must have the Packet protocol enabled for Wireshark to capture live packets from the network: 

[*] Networking support --->                                                [NET]
  Networking options --->
    <*/M> Packet socket                                                 [PACKET]

If built as a module, the name is af_packet.ko.

Installation of Wireshark

Wireshark is a very large and complex application. These instructions provide additional security measures to ensure that only trusted users are allowed to view network traffic. First, set up a system group for wireshark. As the root user: 

groupadd -g 62 wireshark

Continue to install Wireshark by running the following commands: 

mkdir build &&
cd    build &&

cmake -DCMAKE_INSTALL_PREFIX=/usr \
      -DCMAKE_BUILD_TYPE=Release  \
      -DCMAKE_INSTALL_DOCDIR=/usr/share/doc/wireshark-4.2.0 \
      -G Ninja \
      .. &&
ninja

This package does not come with a test suite.

Now, as the root user: 

ninja install &&

install -v -m755 -d /usr/share/doc/wireshark-4.2.0 &&
install -v -m644    ../README.linux ../doc/README.* ../doc/randpkt.txt \
                    /usr/share/doc/wireshark-4.2.0 &&

pushd /usr/share/doc/wireshark-4.2.0 &&
   for FILENAME in ../../wireshark/*.html; do
      ln -s -v -f $FILENAME .
   done &&
popd
unset FILENAME

If you downloaded any of the documentation files from the page listed in the 'Additional Downloads', install them by issuing the following commands as the root user: 

install -v -m644 <Downloaded_Files> \
                 /usr/share/doc/wireshark-4.2.0

Now, set ownership and permissions of sensitive applications to only allow authorized users. As the root user: 

chown -v root:wireshark /usr/bin/{tshark,dumpcap} &&
chmod -v 6550 /usr/bin/{tshark,dumpcap}

Finally, add any users to the wireshark group (as root user): 

usermod -a -G wireshark <username>

If you are installing wireshark for the first time, it will be necessary to logout of your session and login again. This will put wireshark in your groups, because otherwise Wireshark will not function properly.

Command Explanations

-DUSE_qt6=OFF: Use this switch if Qt-6.6.1 is not available. You'll need Qt-5.15.11 or at least qt-components-5.15.11 with qtmultimedia in this case.

Configuring Wireshark

Config Files

/etc/wireshark.conf and ~/.config/wireshark/* (unless there is already ~/.wireshark/* in the system)

Configuration Information

Though the default configuration parameters are very sane, reference the configuration section of the Wireshark User's Guide for configuration information. Most of Wireshark 's configuration can be accomplished using the menu options of the wireshark graphical interfaces.

[Note]

Note

If you want to look at packets, make sure you don't filter them out with iptables-1.8.10. If you want to exclude certain classes of packets, it is more efficient to do it with iptables than it is with Wireshark.

Contents

Installed Programs: capinfos, captype, dumpcap, editcap, idl2wrs, mergecap, randpkt, rawshark, reordercap, sharkd, text2pcap, tshark, and wireshark
Installed Libraries: libwireshark.so, libwiretap.so, libwsutil.so, and numerous modules under /usr/lib/wireshark/plugins
Installed Directories: /usr/{lib,share}/wireshark and /usr/share/doc/wireshark-4.2.0

Short Descriptions

capinfos

reads a saved capture file and returns any or all of several statistics about that file. It is able to detect and read any capture supported by the Wireshark package

captype

prints the file types of capture files

dumpcap

is a network traffic dump tool. It lets you capture packet data from a live network and write the packets to a file

editcap

edits and/or translates the format of capture files. It knows how to read libpcap capture files, including those of tcpdump, Wireshark and other tools that write captures in that format

idl2wrs

is a program that takes a user specified CORBA IDL file and generates “C” source code for a Wireshark “plugin”. It relies on two Python programs wireshark_be.py and wireshark_gen.py, which are not installed by default. They have to be copied manually from the tools directory to the $PYTHONPATH/site-packages/ directory

mergecap

combines multiple saved capture files into a single output file

randpkt

creates random-packet capture files

rawshark

dumps and analyzes raw libpcap data

reordercap

reorders timestamps of input file frames into an output file

sharkd

is a daemon that listens on UNIX sockets

text2pcap

reads in an ASCII hex dump and writes the data described into a libpcap-style capture file

tshark

is a TTY-mode network protocol analyzer. It lets you capture packet data from a live network or read packets from a previously saved capture file

wireshark

is the Qt GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file

libwireshark.so

contains functions used by the Wireshark programs to perform filtering and packet capturing

libwiretap.so

is a library being developed as a future replacement for libpcap, the current standard Unix library for packet capturing. For more information, see the README file in the source wiretap directory