libpcap installation notes
Libpcap can be built either with the configure script and make, or with CMake and any build system supported by CMake.
To build libpcap with the configure script and make:
If you build from a git clone rather than from a release archive, run
./autogen.sh(a shell script). The autogen.sh script will build theconfigureandconfig.h.infiles.
On some system, you may need to set the AUTORECONF variable, like: AUTORECONF=autoreconf-2.69 ./autogen.sh to select the autoreconf version you want to use.
Run
./configure(a shell script). The configure script will determine your system attributes and generate an appropriateMakefilefromMakefile.in. The configure script has a number of options to control the configuration of libpcap;./configure --helpwill show them.Next, run
make. If everything goes well, you cansuto root and runmake install. However, you need not install libpcap if you just want to build tcpdump; just make sure the tcpdump and libpcap directory trees have the same parent directory.
On OpenBSD, you may need to set, before the make, the AUTOCONF_VERSION variable like: AUTOCONF_VERSION=2.69 make
To build libpcap with CMake and the build system of your choice, from the command line:
Create a build directory into which CMake will put the build files it generates; CMake does not work as well with builds done in the source code directory as does the configure script. The build directory may be created as a subdirectory of the source directory or as a directory outside the source directory.
Change to the build directory and run CMake with the path from the build directory to the source directory as an argument. The
-Gflag can be used to select the CMake "generator" appropriate for the build system you're using; various-Dflags can be used to control the configuration of libpcap.Run the build tool. If everything goes well, you can
suto root and run the build tool with theinstalltarget. Building tcpdump from a libpcap in a build directory is not supported.
An uninstall target is supported with both ./configure and CMake.
DO NOT run the build as root; there is no need to do so, running anything as root that doesn't need to be run as root increases the risk of damaging your system, and running the build as root will put files in the build directory that are owned by root and that probably cannot be overwritten, removed, or replaced except by root, which could cause permission errors in subsequent builds.
If configure says:
or CMake says:
then your system either does not support packet capture or your system does support packet capture but libpcap does not support that particular type. (If you have HP-UX, see below.) If your system uses a packet capture not supported by libpcap, please send us patches; don't forget to include an autoconf fragment suitable for use in configure.ac.
It is possible to override the default packet capture type with the --with-pcap option to ./configure or the -DPCAP_TYPE option to CMake, although the circumstances where this works are limited. One possible reason to do that would be to force a supported packet capture type in the case where the configure or CMake scripts fails to detect it.
You will need a C99 compiler to build libpcap. The configure script will abort if your compiler is not C99 compliant. If this happens, use the generally available GNU C compiler (GCC) or Clang.
You will need either Flex 2.5.31 or later, or a version of Lex compatible with it (if any exist), to build libpcap. The configure script will abort if there isn't any such program; CMake fails if Flex or Lex cannot be found, but doesn't ensure that it's compatible with Flex 2.5.31 or later. If you have an older version of Flex, or don't have a compatible version of Lex, the current version of Flex is available here.
You will need either Bison, Berkeley YACC, or a version of YACC compatible with them (if any exist), to build libpcap. The configure script will abort if there isn't any such program; CMake fails if Bison or some form of YACC cannot be found, but doesn't ensure that it's compatible with Bison or Berkeley YACC. If you don't have any such program, the current version of Bison can be found here and the current version of Berkeley YACC can be found here.
Sometimes the stock C compiler does not interact well with Flex and Bison. The list of problems includes undefined references for alloca(3). You can get around this by installing GCC.
Linux specifics
On Linux, libpcap will not work if the kernel does not have the packet socket option enabled; see this file for more information.
Solaris specifics
If you use the SPARCompiler, you must be careful to not use the /usr/ucb/cc interface. If you do, you will get bogus warnings and perhaps errors. Either make sure your path has /opt/SUNWspro/bin before /usr/ucb or else:
before running configure. (You might have to do a make distclean if you already ran configure once).
See this file for more up to date Solaris-related information.
HP-UX specifics
If you use HP-UX, you must have at least version 9 and either the version of cc that supports C99 (cc -AC99) or else use the GNU C compiler. You must also buy the optional streams package. If you don't have:
then you don't have the streams package. In addition, we believe you need to install the "9.X LAN and DLPI drivers cumulative" patch (PHNE_6855) to make the version 9 DLPI work with libpcap.
The DLPI streams package is standard starting with HP-UX 10.
The HP implementation of DLPI is a little bit eccentric. Unlike Solaris, you must attach /dev/dlpi instead of the specific /dev/* network pseudo device entry in order to capture packets. The PPA is based on the ifnet "index" number. Under HP-UX 9, it is necessary to read /dev/kmem and the kernel symbol file (/hp-ux). Under HP-UX 10, DLPI can provide information for determining the PPA. It does not seem to be possible to trace the loopback interface. Unlike other DLPI implementations, PHYS implies MULTI and SAP and you get an error if you try to enable more than one promiscuous mode at a time.
It is impossible to capture outbound packets on HP-UX 9. To do so on HP-UX 10, you will, apparently, need a late "LAN products cumulative patch" (at one point, it was claimed that this would be PHNE_18173 for s700/10.20; at another point, it was claimed that the required patches were PHNE_20892, PHNE_20725 and PHCO_10947, or newer patches), and to do so on HP-UX 11 you will, apparently, need the latest lancommon/DLPI patches and the latest driver patch for the interface(s) in use on HP-UX 11 (at one point, it was claimed that patches PHNE_19766, PHNE_19826, PHNE_20008, and PHNE_20735 did the trick).
Furthermore, on HP-UX 10, you will need to turn on a kernel switch by doing
You would have to arrange that this happens on reboots; the right way to do that would probably be to put it into an executable script file /sbin/init.d/outbound_promisc and making /sbin/rc2.d/S350outbound_promisc a symbolic link to that script.
Finally, testing shows that there can't be more than one simultaneous DLPI user per network interface.
See this file for more information specific to HP-UX.
AIX specifics
See this file for information on installing libpcap and configuring your system to be able to support libpcap.
other specifics
If you are trying to do packet capture with a FORE ATM card, you may or may not be able to. They usually only release their driver in object code so unless their driver supports packet capture, there's not much libpcap can do.
If you get an error like:
when using DLPI, look for the DL_ERROR_ACK error return values, usually in /usr/include/sys/dlpi.h, and find the corresponding value.