1*6f9cba8fSJoseph Mingrone# libpcap installation notes 2*6f9cba8fSJoseph MingroneLibpcap can be built either with the configure script and `make`, or 3*6f9cba8fSJoseph Mingronewith CMake and any build system supported by CMake. 4*6f9cba8fSJoseph Mingrone 5*6f9cba8fSJoseph MingroneTo build libpcap with the configure script and `make`: 6*6f9cba8fSJoseph Mingrone 7*6f9cba8fSJoseph Mingrone* Run `./configure` (a shell script). The configure script will 8*6f9cba8fSJoseph Mingronedetermine your system attributes and generate an appropriate `Makefile` 9*6f9cba8fSJoseph Mingronefrom `Makefile.in`. The configure script has a number of options to 10*6f9cba8fSJoseph Mingronecontrol the configuration of libpcap; `./configure --help`` will show 11*6f9cba8fSJoseph Mingronethem. 12*6f9cba8fSJoseph Mingrone 13*6f9cba8fSJoseph Mingrone* Next, run `make`. If everything goes well, you can 14*6f9cba8fSJoseph Mingrone`su` to root and run `make install`. However, you need not install 15*6f9cba8fSJoseph Mingronelibpcap if you just want to build tcpdump; just make sure the tcpdump 16*6f9cba8fSJoseph Mingroneand libpcap directory trees have the same parent directory. 17*6f9cba8fSJoseph Mingrone 18*6f9cba8fSJoseph MingroneTo build libpcap with CMake and the build system of your choice, from 19*6f9cba8fSJoseph Mingronethe command line: 20*6f9cba8fSJoseph Mingrone 21*6f9cba8fSJoseph Mingrone* Create a build directory into which CMake will put the build files it 22*6f9cba8fSJoseph Mingronegenerates; CMake does not work as well with builds done in the source 23*6f9cba8fSJoseph Mingronecode directory as does the configure script. The build directory may be 24*6f9cba8fSJoseph Mingronecreated as a subdirectory of the source directory or as a directory 25*6f9cba8fSJoseph Mingroneoutside the source directory. 26*6f9cba8fSJoseph Mingrone 27*6f9cba8fSJoseph Mingrone* Change to the build directory and run CMake with the path from the 28*6f9cba8fSJoseph Mingronebuild directory to the source directory as an argument. The `-G` flag 29*6f9cba8fSJoseph Mingronecan be used to select the CMake "generator" appropriate for the build 30*6f9cba8fSJoseph Mingronesystem you're using; various `-D` flags can be used to control the 31*6f9cba8fSJoseph Mingroneconfiguration of libpcap. 32*6f9cba8fSJoseph Mingrone 33*6f9cba8fSJoseph Mingrone* Run the build tool. If everything goes well, you can `su` to root and 34*6f9cba8fSJoseph Mingronerun the build tool with the `install` target. Building tcpdump from a 35*6f9cba8fSJoseph Mingronelibpcap in a build directory is not supported. 36*6f9cba8fSJoseph Mingrone 37*6f9cba8fSJoseph MingroneAn `uninstall` target is supported with both `./configure` and CMake. 38*6f9cba8fSJoseph Mingrone 39*6f9cba8fSJoseph Mingrone***DO NOT*** run the build as root; there is no need to do so, running 40*6f9cba8fSJoseph Mingroneanything as root that doesn't need to be run as root increases the risk 41*6f9cba8fSJoseph Mingroneof damaging your system, and running the build as root will put files in 42*6f9cba8fSJoseph Mingronethe build directory that are owned by root and that probably cannot be 43*6f9cba8fSJoseph Mingroneoverwritten, removed, or replaced except by root, which could cause 44*6f9cba8fSJoseph Mingronepermission errors in subsequent builds. 4557e22627SCy Schubert 4657e22627SCy SchubertIf configure says: 4757e22627SCy Schubert 4857e22627SCy Schubert configure: warning: cannot determine packet capture interface 49*6f9cba8fSJoseph Mingrone configure: warning: (see INSTALL.md file for more info) 50*6f9cba8fSJoseph Mingrone 51*6f9cba8fSJoseph Mingroneor CMake says: 52*6f9cba8fSJoseph Mingrone 53*6f9cba8fSJoseph Mingrone cannot determine packet capture interface 54*6f9cba8fSJoseph Mingrone 55*6f9cba8fSJoseph Mingrone (see the INSTALL.md file for more info) 5657e22627SCy Schubert 5757e22627SCy Schubertthen your system either does not support packet capture or your system 5857e22627SCy Schubertdoes support packet capture but libpcap does not support that 5957e22627SCy Schubertparticular type. (If you have HP-UX, see below.) If your system uses a 6057e22627SCy Schubertpacket capture not supported by libpcap, please send us patches; don't 6157e22627SCy Schubertforget to include an autoconf fragment suitable for use in 62*6f9cba8fSJoseph Mingrone`configure.ac`. 6357e22627SCy Schubert 64*6f9cba8fSJoseph MingroneIt is possible to override the default packet capture type with the 65*6f9cba8fSJoseph Mingrone`--with-pcap`` option to `./configure` or the `-DPCAP_TYPE` option to 66*6f9cba8fSJoseph MingroneCMake, although the circumstances where this works are limited. One 67*6f9cba8fSJoseph Mingronepossible reason to do that would be to force a supported packet capture 68*6f9cba8fSJoseph Mingronetype in the case where the configure or CMake scripts fails to detect 69*6f9cba8fSJoseph Mingroneit. 7057e22627SCy Schubert 71*6f9cba8fSJoseph MingroneYou will need a C99 compiler to build libpcap. The configure script 72*6f9cba8fSJoseph Mingronewill abort if your compiler is not C99 compliant. If this happens, use 73*6f9cba8fSJoseph Mingronethe generally available GNU C compiler (GCC) or Clang. 7457e22627SCy Schubert 7557e22627SCy SchubertYou will need either Flex 2.5.31 or later, or a version of Lex 7657e22627SCy Schubertcompatible with it (if any exist), to build libpcap. The configure 77*6f9cba8fSJoseph Mingronescript will abort if there isn't any such program; CMake fails if Flex 78*6f9cba8fSJoseph Mingroneor Lex cannot be found, but doesn't ensure that it's compatible with 79*6f9cba8fSJoseph MingroneFlex 2.5.31 or later. If you have an older version of Flex, or don't 80*6f9cba8fSJoseph Mingronehave a compatible version of Lex, the current version of Flex is 81*6f9cba8fSJoseph Mingroneavailable [here](https://github.com/westes/flex). 8257e22627SCy Schubert 8357e22627SCy SchubertYou will need either Bison, Berkeley YACC, or a version of YACC 8457e22627SCy Schubertcompatible with them (if any exist), to build libpcap. The configure 85*6f9cba8fSJoseph Mingronescript will abort if there isn't any such program; CMake fails if Bison 86*6f9cba8fSJoseph Mingroneor some form of YACC cannot be found, but doesn't ensure that it's 87*6f9cba8fSJoseph Mingronecompatible with Bison or Berkeley YACC. If you don't have any such 88*6f9cba8fSJoseph Mingroneprogram, the current version of Bison can be found 89*6f9cba8fSJoseph Mingrone[here](https://ftp.gnu.org/gnu/bison/) and the current version of 90*6f9cba8fSJoseph MingroneBerkeley YACC can be found [here](https://invisible-island.net/byacc/). 9157e22627SCy Schubert 9257e22627SCy SchubertSometimes the stock C compiler does not interact well with Flex and 93*6f9cba8fSJoseph MingroneBison. The list of problems includes undefined references for alloca(3). 9457e22627SCy SchubertYou can get around this by installing GCC. 9557e22627SCy Schubert 96*6f9cba8fSJoseph Mingrone## Linux specifics 97*6f9cba8fSJoseph MingroneOn Linux, libpcap will not work if the kernel does not have the packet 98*6f9cba8fSJoseph Mingronesocket option enabled; see [this file](doc/README.linux) for more 99*6f9cba8fSJoseph Mingroneinformation. 10057e22627SCy Schubert 101*6f9cba8fSJoseph Mingrone## Solaris specifics 10257e22627SCy SchubertIf you use the SPARCompiler, you must be careful to not use the 103*6f9cba8fSJoseph Mingrone`/usr/ucb/cc` interface. If you do, you will get bogus warnings and 104*6f9cba8fSJoseph Mingroneperhaps errors. Either make sure your path has `/opt/SUNWspro/bin` 105*6f9cba8fSJoseph Mingronebefore `/usr/ucb` or else: 10657e22627SCy Schubert 10757e22627SCy Schubert setenv CC /opt/SUNWspro/bin/cc 10857e22627SCy Schubert 109*6f9cba8fSJoseph Mingronebefore running configure. (You might have to do a `make distclean` 110*6f9cba8fSJoseph Mingroneif you already ran `configure` once). 11157e22627SCy Schubert 112*6f9cba8fSJoseph MingroneSee [this file](doc/README.solaris.md) for more up to date 113*6f9cba8fSJoseph MingroneSolaris-related information. 11457e22627SCy Schubert 115*6f9cba8fSJoseph Mingrone## HP-UX specifics 11657e22627SCy SchubertIf you use HP-UX, you must have at least version 9 and either the 117*6f9cba8fSJoseph Mingroneversion of `cc` that supports C99 (`cc -AC99`) or else use the GNU C 11857e22627SCy Schubertcompiler. You must also buy the optional streams package. If you don't 11957e22627SCy Schuberthave: 12057e22627SCy Schubert 12157e22627SCy Schubert /usr/include/sys/dlpi.h 12257e22627SCy Schubert /usr/include/sys/dlpi_ext.h 12357e22627SCy Schubert 12457e22627SCy Schubertthen you don't have the streams package. In addition, we believe you 12557e22627SCy Schubertneed to install the "9.X LAN and DLPI drivers cumulative" patch 12657e22627SCy Schubert(PHNE_6855) to make the version 9 DLPI work with libpcap. 12757e22627SCy Schubert 12857e22627SCy SchubertThe DLPI streams package is standard starting with HP-UX 10. 12957e22627SCy Schubert 13057e22627SCy SchubertThe HP implementation of DLPI is a little bit eccentric. Unlike 131*6f9cba8fSJoseph MingroneSolaris, you must attach `/dev/dlpi` instead of the specific `/dev/*` 13257e22627SCy Schubertnetwork pseudo device entry in order to capture packets. The PPA is 13357e22627SCy Schubertbased on the ifnet "index" number. Under HP-UX 9, it is necessary to 134*6f9cba8fSJoseph Mingroneread `/dev/kmem` and the kernel symbol file (`/hp-ux`). Under HP-UX 10, 13557e22627SCy SchubertDLPI can provide information for determining the PPA. It does not seem 13657e22627SCy Schubertto be possible to trace the loopback interface. Unlike other DLPI 13757e22627SCy Schubertimplementations, PHYS implies MULTI and SAP and you get an error if you 13857e22627SCy Schuberttry to enable more than one promiscuous mode at a time. 13957e22627SCy Schubert 14057e22627SCy SchubertIt is impossible to capture outbound packets on HP-UX 9. To do so on 14157e22627SCy SchubertHP-UX 10, you will, apparently, need a late "LAN products cumulative 14257e22627SCy Schubertpatch" (at one point, it was claimed that this would be PHNE_18173 for 14357e22627SCy Schuberts700/10.20; at another point, it was claimed that the required patches 14457e22627SCy Schubertwere PHNE_20892, PHNE_20725 and PHCO_10947, or newer patches), and to do 14557e22627SCy Schubertso on HP-UX 11 you will, apparently, need the latest lancommon/DLPI 14657e22627SCy Schubertpatches and the latest driver patch for the interface(s) in use on HP-UX 14757e22627SCy Schubert11 (at one point, it was claimed that patches PHNE_19766, PHNE_19826, 14857e22627SCy SchubertPHNE_20008, and PHNE_20735 did the trick). 14957e22627SCy Schubert 15057e22627SCy SchubertFurthermore, on HP-UX 10, you will need to turn on a kernel switch by 15157e22627SCy Schubertdoing 15257e22627SCy Schubert 15357e22627SCy Schubert echo 'lanc_outbound_promisc_flag/W 1' | adb -w /stand/vmunix /dev/mem 15457e22627SCy Schubert 155*6f9cba8fSJoseph MingroneYou would have to arrange that this happens on reboots; the right way to 15657e22627SCy Schubertdo that would probably be to put it into an executable script file 157*6f9cba8fSJoseph Mingrone`/sbin/init.d/outbound_promisc` and making 158*6f9cba8fSJoseph Mingrone`/sbin/rc2.d/S350outbound_promisc` a symbolic link to that script. 15957e22627SCy Schubert 16057e22627SCy SchubertFinally, testing shows that there can't be more than one simultaneous 16157e22627SCy SchubertDLPI user per network interface. 16257e22627SCy Schubert 163*6f9cba8fSJoseph MingroneSee [this file](doc/README.hpux) for more information specific to HP-UX. 16457e22627SCy Schubert 165*6f9cba8fSJoseph Mingrone## AIX specifics 166*6f9cba8fSJoseph MingroneSee [this file](doc/README.aix) for information on installing libpcap and 16757e22627SCy Schubertconfiguring your system to be able to support libpcap. 16857e22627SCy Schubert 169*6f9cba8fSJoseph Mingrone## other specifics 170*6f9cba8fSJoseph MingroneIf you are trying to do packet capture with a FORE ATM card, you may or 171*6f9cba8fSJoseph Mingronemay not be able to. They usually only release their driver in object 172*6f9cba8fSJoseph Mingronecode so unless their driver supports packet capture, there's not much 173*6f9cba8fSJoseph Mingronelibpcap can do. 17457e22627SCy Schubert 175*6f9cba8fSJoseph MingroneIf you get an error like: 17657e22627SCy Schubert 177*6f9cba8fSJoseph Mingrone tcpdump: recv_ack: bind error 0x??? 17857e22627SCy Schubert 179*6f9cba8fSJoseph Mingronewhen using DLPI, look for the DL_ERROR_ACK error return values, usually 180*6f9cba8fSJoseph Mingronein `/usr/include/sys/dlpi.h`, and find the corresponding value. 18157e22627SCy Schubert 182*6f9cba8fSJoseph Mingrone## Description of files 18357e22627SCy Schubert CHANGES - description of differences between releases 184*6f9cba8fSJoseph Mingrone ChmodBPF/* - macOS startup item to set ownership and permissions on /dev/bpf* 18557e22627SCy Schubert CMakeLists.txt - CMake file 186*6f9cba8fSJoseph Mingrone CONTRIBUTING.md - guidelines for contributing 18757e22627SCy Schubert CREDITS - people that have helped libpcap along 18857e22627SCy Schubert INSTALL.md - this file 18957e22627SCy Schubert LICENSE - the license under which tcpdump is distributed 19057e22627SCy Schubert Makefile.in - compilation rules (input to the configure script) 19157e22627SCy Schubert README.md - description of distribution 19257e22627SCy Schubert doc/README.aix - notes on using libpcap on AIX 19357e22627SCy Schubert doc/README.dag - notes on using libpcap to capture on Endace DAG devices 19457e22627SCy Schubert doc/README.hpux - notes on using libpcap on HP-UX 195*6f9cba8fSJoseph Mingrone doc/README.linux - notes on using libpcap on Linux 19657e22627SCy Schubert doc/README.macos - notes on using libpcap on macOS 19757e22627SCy Schubert doc/README.septel - notes on using libpcap to capture on Intel/Septel devices 19857e22627SCy Schubert doc/README.sita - notes on using libpcap to capture on SITA devices 199*6f9cba8fSJoseph Mingrone doc/README.solaris.md - notes on using libpcap on Solaris 200*6f9cba8fSJoseph Mingrone doc/README.Win32.md - notes on using libpcap on Win32 systems (with Npcap) 20157e22627SCy Schubert VERSION - version of this release 20257e22627SCy Schubert aclocal.m4 - autoconf macros 20357e22627SCy Schubert arcnet.h - ARCNET definitions 20457e22627SCy Schubert atmuni31.h - ATM Q.2931 definitions 20557e22627SCy Schubert bpf_dump.c - BPF program printing routines 20657e22627SCy Schubert bpf_filter.c - BPF filtering routines 20757e22627SCy Schubert bpf_image.c - BPF disassembly routine 20857e22627SCy Schubert config.guess - autoconf support 20957e22627SCy Schubert config.h.in - autoconf input 21057e22627SCy Schubert config.sub - autoconf support 21157e22627SCy Schubert configure - configure script (run this first) 21257e22627SCy Schubert configure.ac - configure script source 21357e22627SCy Schubert dlpisubs.c - DLPI-related functions for pcap-dlpi.c and pcap-libdlpi.c 21457e22627SCy Schubert dlpisubs.h - DLPI-related function declarations 21557e22627SCy Schubert etherent.c - /etc/ethers support routines 21657e22627SCy Schubert ethertype.h - Ethernet protocol types and names definitions 21757e22627SCy Schubert fad-getad.c - pcap_findalldevs() for systems with getifaddrs() 21857e22627SCy Schubert fad-gifc.c - pcap_findalldevs() for systems with only SIOCGIFLIST 21957e22627SCy Schubert fad-glifc.c - pcap_findalldevs() for systems with SIOCGLIFCONF 220*6f9cba8fSJoseph Mingrone testprogs/filtertest.c - test program for BPF compiler 221*6f9cba8fSJoseph Mingrone testprogs/findalldevstest.c - test program for pcap_findalldevs() 22257e22627SCy Schubert gencode.c - BPF code generation routines 22357e22627SCy Schubert gencode.h - BPF code generation definitions 22457e22627SCy Schubert grammar.y - filter string grammar 22557e22627SCy Schubert ieee80211.h - 802.11 definitions 22657e22627SCy Schubert install-sh - BSD style install script 22757e22627SCy Schubert lbl/os-*.h - OS-dependent defines and prototypes 22857e22627SCy Schubert llc.h - 802.2 LLC SAP definitions 22957e22627SCy Schubert missing/* - replacements for missing library functions 23057e22627SCy Schubert mkdep - construct Makefile dependency list 23157e22627SCy Schubert msdos/* - drivers for MS-DOS capture support 23257e22627SCy Schubert nametoaddr.c - hostname to address routines 23357e22627SCy Schubert nlpid.h - OSI network layer protocol identifier definitions 23457e22627SCy Schubert optimize.c - BPF optimization routines 23557e22627SCy Schubert pcap/bluetooth.h - public definition of DLT_BLUETOOTH_HCI_H4_WITH_PHDR header 23657e22627SCy Schubert pcap/bpf.h - BPF definitions 23757e22627SCy Schubert pcap/namedb.h - public libpcap name database definitions 23857e22627SCy Schubert pcap/pcap.h - public libpcap definitions 239*6f9cba8fSJoseph Mingrone pcap/sll.h - public definitions of DLT_LINUX_SLL and DLT_LINUX_SLL2 headers 24057e22627SCy Schubert pcap/usb.h - public definition of DLT_USB header 24157e22627SCy Schubert pcap-bpf.c - BSD Packet Filter support 24257e22627SCy Schubert pcap-bpf.h - header for backwards compatibility 24357e22627SCy Schubert pcap-bt-linux.c - Bluetooth capture support for Linux 24457e22627SCy Schubert pcap-bt-linux.h - Bluetooth capture support for Linux 24557e22627SCy Schubert pcap-dag.c - Endace DAG device capture support 24657e22627SCy Schubert pcap-dag.h - Endace DAG device capture support 24757e22627SCy Schubert pcap-dlpi.c - Data Link Provider Interface support 24857e22627SCy Schubert pcap-dos.c - MS-DOS capture support 24957e22627SCy Schubert pcap-dos.h - headers for MS-DOS capture support 25057e22627SCy Schubert pcap-enet.c - enet support 25157e22627SCy Schubert pcap-int.h - internal libpcap definitions 25257e22627SCy Schubert pcap-libdlpi.c - Data Link Provider Interface support for systems with libdlpi 25357e22627SCy Schubert pcap-linux.c - Linux packet socket support 25457e22627SCy Schubert pcap-namedb.h - header for backwards compatibility 25557e22627SCy Schubert pcap-nit.c - SunOS Network Interface Tap support 256*6f9cba8fSJoseph Mingrone pcap-npf.c - Npcap capture support 25757e22627SCy Schubert pcap-null.c - dummy monitor support (allows offline use of libpcap) 25857e22627SCy Schubert pcap-pf.c - Ultrix and Digital/Tru64 UNIX Packet Filter support 25957e22627SCy Schubert pcap-septel.c - Intel/Septel device capture support 26057e22627SCy Schubert pcap-septel.h - Intel/Septel device capture support 26157e22627SCy Schubert pcap-sita.c - SITA device capture support 26257e22627SCy Schubert pcap-sita.h - SITA device capture support 26357e22627SCy Schubert pcap-sita.html - SITA device capture documentation 26457e22627SCy Schubert pcap-snit.c - SunOS 4.x STREAMS-based Network Interface Tap support 26557e22627SCy Schubert pcap-snoop.c - IRIX Snoop network monitoring support 26657e22627SCy Schubert pcap-usb-linux.c - USB capture support for Linux 26757e22627SCy Schubert pcap-usb-linux.h - USB capture support for Linux 26857e22627SCy Schubert pcap.3pcap - manual entry for the library 26957e22627SCy Schubert pcap.c - pcap utility routines 27057e22627SCy Schubert pcap.h - header for backwards compatibility 27157e22627SCy Schubert pcap_*.3pcap - manual entries for library functions 272*6f9cba8fSJoseph Mingrone pcap-filter.manmisc.in - manual entry for filter syntax 273*6f9cba8fSJoseph Mingrone pcap-linktype.manmisc.in - manual entry for link-layer header types 27457e22627SCy Schubert ppp.h - Point to Point Protocol definitions 27557e22627SCy Schubert savefile.c - offline support 27657e22627SCy Schubert scanner.l - filter string scanner 27757e22627SCy Schubert sunatmpos.h - definitions for SunATM capturing 278