How to Compile Wireshark on OpenBSD

Wireshark, formerly known as Ethereal, is a great tool for network troubleshooting or any other task involving network packet capture and analysis. But you have to build it yourself on OpenBSD, and the compilation will fail.

The OpenBSD community hasn't built Wireshark packages for a while, since Wireshark has a bad security track record. It has to run with root privileges to do most of what people find useful, and its packet dissectors (the modules analyzing the large set of supported protocols) are very complicated and prone to bugs. A privileged process running untrusted code leads to big security problems!

On top of this, the Wireshark community hasn't seemed to worry about making Wireshark build cleanly from source on OpenBSD.

Here is the trick for compiling Wireshark on OpenBSD, based on what I found at http://www.linbsd.org/ethereal_on_openbsd38.html The following worked with Ethereal under earlier versions of OpenBSD, and it works with Wireshark.

Step 1:

Install these additional packages on OpenBSD:

autoconf
automake
gcc-4*
glib2
gmake
gtk+2
libtool
m4
metaauto
python 

Step 2:

See what versions of autoconf and automake you have:

% pkg_info autoconf | head -1
% pkg_info automake | head -1
% ls /usr/local/bin/auto* 

Step 3:

You will probably have to do the software build as root because of the memory requirements. Become root with:

% su - 

Step 4:

Set two environment variables, changing the numbers as appropriate. If you see, for example, autoconf-2.59p1, then you should probably specify simply 2.59. Similarly, if you see automake-1.9.6p1, then you should probably specify simply 1.9. The ls command above is probably the most useful test.

• If you're running tcsh or csh, do something like the following:

  # setenv AUTOCONF_VERSION 2.59
  # setenv AUTOMAKE_VERSION 1.9 

• If you're running bash, do something like the following:

  # export AUTOCONF_VERSION=2.59
  # export AUTOMAKE_VERSION=1.9 

Step 5:

At this point we find that the INSTALL, README, and other files don't tell the whole story for OpenBSD. First, we have to generate the Makefiles:

# ./autogen.sh 

If that command fails with a complaint about missing Python, even though you have already installed it, then you need to do something like the following as root:

# cd /usr/local/bin
# ln -s python2.6 python 

If it fails with an error about a missing open directory /usr/share/aclocal then:

# cd /usr/share
# ln -s /usr/local/share/aclocal 

Step 6:

Set the environment variable CC to the binary for GCC 4.* — if you're running tcsh or csh, do this:

# setenv CC egcc 

If you're running bash, do this:

# export CC=egcc 

Step 7:

Do the configuration:

# ./configure 

Step 8:

Now build the software. Note that you may have to run the following as root because of the amount of memory resources required by the library building. Note also that you have to use the GNU version of make:

# gmake 

Step 9:

After quite a while (from forty minutes to an hour!) that should succeed. If so, you're ready to install, again being careful to use the gmake program:

# gmake install 

Step 10:

If it did not succeed, carefully read the output.

• Possible error #1 — Wireshark simply will not compile. You get a bunch of errors of this form:

  In file included from packet-dplay.c:33:
  /usr/include/sys/socket.h:147: error: expected specifier-qualifier-list before 'u_int8_t'
  /usr/include/sys/socket.h:165: error: expected specifier-qualifier-list before 'u_int8_t'
  /usr/include/sys/socket.h:233: error: expected specifier-qualifier-list before 'uid_t'
  /usr/include/sys/socket.h:354: error: expected specifier-qualifier-list before 'socklen_t'
  /usr/include/sys/socket.h:380: error: expected specifier-qualifier-list before 'socklen_t'
  /usr/include/sys/socket.h:436: error: expected specifier-qualifier-list before 'caddr_t' 

  Fix — Use an older version of Wireshark. I have had the above problem trying to compile Wireshark 1.0.4 on OpenBSD 4.4 through 4.7. I rolled back to Wireshark 1.0.0 (I had kept the old tar files) and that version compiles and runs just fine.
• Possible error #2 — Some warning messages due to risky code in the wiretap directory may cause the build to halt because the -Werror flag tells gcc to consider warnings to be errors. This was a problem building Wireshark 1.0.0 on OpenBSD 4.3.
  Fix — Edit the file wiretap/Makefile and comment out this line:
  

  AM_NON_ENERATED_CFLAGS = -Werror 

  By Wireshark 1.0.4, the Makefile came with that already commented out....
• Possible error #3 — If you are building a new version after building an older version on the same machine, the error may have been caused by attempting to build the new version linked against some older version of a shared library.
  Fix — You have two ways to proceed in that case:
  • Rip out the old binaries and shared libraries and other debris under /usr/local/share with:

    # gmake uninstall 

  • If you would prefer to keep what you can, change into the relevant subdirectories and build and install just those shared libraries. For example:
    • If the error seems to be reporting a problem with undefined symbols in libwireshark.so.0.1, first find the relevant directory:

      # find * -name 'libwireshark*' 

    • Next, change to the relevant directory, in this example that would be:

      # cd epan 

    • Now build and install just the shared library software found there:

      # gmake
      # gmake install 

    • Then change back to the root of the build directory and start again:

      # cd ..
      # gmake 

Step 11:

When you try to run Wireshark, as soon as you try to start a capture it may fail with these two symptoms:

• An error box pops up reading:

  Child capture process died:
  Segmentation violation - core dumped 

• The terminal where you started Wireshark shows an error:

  (ethereal-capture:PID): GdkPixbuf-WARNING **:
  Cannot open pixbuf loader module file
  '/var/db/gtk-2.0/gdk-pixbuf.loaders': Too many open files 

This problem is caused by Wireshark using so many shared libraries stored under /usr/local/lib and data files stored under /usr/local/share/wireshark, especially if you built it with RADIUS support. The fix is to run Wireshark in an environment where more open files are allowed. For root, the command ulimit -a shows that the Bash shell can have only 128 simultaneous open file descriptors for that shell and its child processes. So, start Wireshark like this:

% su root -c 'ulimit -n 512 ; wireshark &' 

Or, more extremely:

% su root -c 'ulimit -n unlimited ; wireshark &' 

For more details see man bash and read the ulimit section.

As for useful capture filters, see the page at the Wireshark Wiki. I always forget where the "not" goes — it's:
port not 53
and not:
not port 53.
It's further complicated when combining expressions:

port not 53 and not arp 

Expressions can be carefully combined in multiple ways. These two are equivalent:

host www.example.com and not (port 80 or port 25)
host www.example.com and not port 80 and not port 25 

Here's my favorite complicated filter expression — just capture HTTP GET requests. This looks for the ASCII for "GET " — 0x47, 0x45; 0x54, 0x20, immediately after the TCP header:

port 80 and tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420 

See the tcpdump manual page for comprehensive details.

Other OpenBSD Compilation Projects

• OpenCV
• OpenVAS
• RainbowCrack

Other Unix, Linux and Open Source Topics

Home Unix/Linux Networking Cybersecurity Travel Technical Radio Site Map Contact

Tweet