1 NOTE: this document applies to the Wireshark source releases and
2 buildbot source tarballs. It does not apply to source code checked out
3 directly from Git, as files such as the configuration script are not
4 checked into Git, but need to be generated from the autoconf and
7 See https://wiki.wireshark.org/Development if you would like to build the
8 source code checked out directly from Git.
13 These are installation instructions for Unix and Unix-like systems
14 that can run the "configure" script in this same directory. These
15 are not the installation instructions for Windows systems; see
16 README.windows for those instructions.
18 0. This is software. Beware.
20 1. If you wish to build Wireshark, make sure you have the Qt and GLib
21 development packages installed. Try running
22 'pkg-config glib-2.0 --modversion' to see if you have GLib 2.x
23 installed. Then try running 'pkg-config Qt5Widgets --modversion'
24 to see if you have Qt installed. Wireshark needs version 4.8 or above
25 of Qt, although 5.2 and above are strongly recommended. It needs
26 version 2.22.0 or above of glib-2.0. If you need to install or
27 re-install GLIB, you can find the packages at:
33 https://www.qt.io/download
35 If you installed Qt or GLib from binary packages, you may have to
36 install corresponding "development" packages; there may be separate
37 "user's" and "developer's" packages, with the former not including
38 header files and the like. For example, Red Hat users will need to
39 install a "glib2-devel" .rpm.
42 2. If you wish to build TShark, the line-mode version of Wireshark,
43 make sure you have GLib installed. See note #1 above for instructions
44 on checking if you have GLib installed.
46 3. If you want to capture packets, make sure you have libpcap
47 installed. The latest "official" version can be found at
49 http://www.tcpdump.org .
51 If you installed libpcap from a binary package, you may have to
52 install a "development" package; for example, there's
53 apparently a "libpcap0" Debian package, but it just includes a
54 shared library, a copyright notice, changelog files, and a
55 README.md file - you also need to install a "libpcap-dev" package
56 to get header files, a non-shared library, and the man page.
57 Similarly, Red Hat users will need to install a "libpcap-devel"
58 .rpm to go along with the "libpcap" .rpm.
60 4. Building Wireshark requires Perl (specifically the pod2man program)
61 so that the documentation can be built.
63 5. Building Wireshark requires Python.
65 6. Create a build directory separate from the source directory. It can
66 be anywhere, but you might run into issues if the path contains
69 7. Run 'cmake <options> <path/to/the/wireshark/sources>' in your build
70 directory. Running 'cmake -LH <path/to/the/wireshark/sources>'
71 displays a complete list of options. The "Tool Reference" section of
72 Developer's Guide contains general instructions for using CMake. Some
73 of the Wireshark-specific options are as follows:
76 CMake supports many different build systems, including UNIX
77 Make, MSBuild, and Ninja. UNIX Make is the default, but Ninja
81 By default CMake tries to find the Qt libraries so Wireshark,
82 the GUI packet analyzer, can be built. You can disable the
83 build of the GUI version of Wireshark with this switch.
86 By default the line-mode packet analyzer, TShark, is built.
87 Use this switch to avoid building it.
90 By default the capture-file editing program is built.
91 Use this switch to avoid building it.
94 By default the capture-file statistics reporting pogram
95 is built. Use this switch to avoid building it.
98 By default the capture-type reporting pogram is built. Use this
99 switch to avoid building it.
102 By default the capture-file merging program is built.
103 Use this switch to avoid building it.
105 -DBUILD_reordercap=OFF
106 By default the capture-file reordering program is built.
107 Use this switch to avoid building it.
109 -DBUILD_text2pcap=OFF
110 By default the hex-dump-to-capture file conversion program
111 is built. Use this switch to avoid building it.
114 By default the display-filter-compiler test program is built.
115 Use this switch to avoid building it.
118 By default the program which creates random packet-capture files
119 is built. Use this switch to avoid building it.
122 By default the network traffic capture program is built.
123 Use this switch to avoid building it.
126 By default the program used to dump and analyze raw libpcap data
127 is built. Use this switch to avoid building it.
129 -DDUMPCAP_INSTALL_OPTION=suid
130 -DDUMPCAP_INSTALL_OPTION=capabilities
131 Wireshark and TShark rely on dumpcap for packet capture. Setting
132 this flag to "suid" installs dumpcap with setuid root
133 permissions, which lets any user on the system capture live
134 traffic. If this is not desired, you can restrict dumpcap's
135 permissions so that only a single user or group can run it and
136 set the "capabilities" flag.
138 Running Wireshark or TShark as root is not recommended.
141 By default, if 'cmake' finds libcap (the POSIX capabilities
142 library) dumpcap will be built so that if it is installed setuid
143 root, it will attempt to retain CAP_NET_RAW and CAP_NET_ADMIN
144 before dropping root privileges. Use this option to disable this
148 If you choose to build a packet analyzer that can analyze
149 capture files but cannot capture packets on its own, but you
150 *do* have libpcap installed, or if you are trying to build
151 Wireshark on a system that doesn't have libpcap installed (in
152 which case you have no choice but to build a version that can
153 analyze capture files but cannot capture packets on its own),
154 use -DENABLE_PCAP=OFF to avoid using libpcap.
157 By default, if 'configure' finds zlib (a.k.a, libz), the
158 wiretap library will be built so that it can read compressed
159 capture files. If you have zlib but do not wish to build
160 it into the wiretap library, used by Wireshark, TShark, and
161 the capture-file utilities that come in this package, use
165 By default, if your system can support run-time loadable modules,
166 the packet analyzers are build with support for plugins.
167 Use this switch to build packet analyzers without plugin support.
169 8. After running 'cmake', you will see a summary of some
170 of the options you chose. Ensure that the summary reflects
171 what you want. If it doesn't, re-run 'cmake' with new options.
173 9. Run 'make', or 'ninja' if you chose to create Ninja build files.
174 Hopefully, you won't run into any problems.
176 10. Run './wireshark' or './tshark' or ./dumpcap, and make sure things are
177 working. You must have root privileges in order to capture live data.
179 11./a. Run 'make install'. If you're running a system that supports
180 the RPM packaging systems you can run
188 to make an installable package for your system. The installation path
189 defaults to /usr/local, so you'll probably want to pass
190 -DCMAKE_INSTALL_PREFIX=/usr to CMake.
192 11/b. If you 're running a system that supports APT (Debian/Ubuntu/etc.)
195 dpkg-buildpackage -us -uc -rfakeroot
197 in the source directory right after extracting of checking out
198 Wireshark's source code. (You don't have to run configure/make/etc.
199 prior to running dpkg-buildpackage)
202 If you have trouble with the build or installation process, you can
203 find assistance on the wireshark-users and wireshark-dev mailing lists (see
204 http://www.wireshark.org/lists/ for details) or the Wireshark Q&A site:
205 https://ask.wireshark.org .