Wireshark-users: Re: [Wireshark-users] Crosscompiling TSHARK to run on embedded linux on ppc440!

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 8 Feb 2009 17:16:16 -0800

On Feb 8, 2009, at 4:58 PM, H Aslam wrote:

I have to crosscompile tshark to run on embedded linux on a PPC440.

Where do I start?

I downloaded the wireshark source code from the official home page. But which files etc. are crucial to run only tshark. I found the tshark.c file in the source code but which other files do I have to crosscompile in order to run tshark on a embedded linux?

If you only want TShark - and *none* of the other utilities, including but not limited to Wireshark - the files you have to cross-compile are ones that are compiled if you run the configure script with

	--disable-wireshark
	--disable-editcap
	--disable-capinfos
	--disable-mergecap
	--disable-text2pcap
	--disable-idl2wrs
	--disable-dftest
	--disable-randpkt
	--disable-rawshark

This will give you TShark, which is capable of analyzing network traffic on the command line.

If what you *really* want is just to be able to *capture* network traffic on your embedded PPC440 box, and will be copying the files to other machines to analyze, and you don't care about using a "read filter" when capturing traffic, all you really need is dumpcap, so you'd add

	--disable-tshark

to the list.