So you will need to enhance libpcap (and WinPcap) to be able to capture your traffic.

In Wireshark, libpcap (and WinPcap when using windows) is responsible for getting the data of the wire(less). What type of 'physical' links are involved? You say something about serial, but I also see reference to UDP and WiFi. But sometimes backward compatibility problems do pop-up.Firstly if you want to be able to capture to the live data, you need a way of getting it of the wire (or from the ether). libpcap-1.7.4 should be completely backward compatible with libpcap-1.4.0. In theory nothing should break because sonames in shared libraries shall be backward compatible. You are now depending not on the distro maintainers (who test their packages in the scenario of an up-to-date system) but on the developers of wireshark and of libpcap to be careful in not introducing broken backward compatibility (which often is not tested). Note that you need to ensure that you have a softlink called libpcap.so.1 that points to libpcap.so.1.7.4 (the make should have created it).ĭisclaimer: This may break! It is a very bad idea to use LD_LIBRARY_PATH in a production environment (but wireshark isn't a piece of software that is often used in mission critical environments). Which will load wireshark and while loading into memory the libpcap from the path given instead of the libpcap installed by yum (in /usr/lib). Therefore you can do the following: $ export LD_LIBRARY_PATH=/path/to/your/compiled/libpcap Paths (directories) in that variable are searched first for shared libraries to load.

Hacking itįor testing purposes GNU ld (the linker that includes the shared libraries) understands an environment variable called LD_LIBRARY_PATH. Yet, that does not mean you need to use libpcap-1.4.0 when wireshark is running. You need to install libpcap-1.4.0 if you want to install wireshark through yum. Whatever you compiled by yourself is irrelevant, the responsible packagers have not seen it and therefore yum will not take it in consideration.Īnd there is absolutely nothing that can be done about that. yum knows about it (because the packagers were careful when making the RPMs) and will not allow you to install wireshark without installing that lib. It will search the dynamic library path for libpcap.so.1. The wireshark binary knows what to search for (my wireshark is compiled as wireshark-gtk): $ readelf -d /usr/bin/wireshark-gtk | grep libpcapĠx0000000000000001 (NEEDED) Shared library: The Wireshark in the CentOS repository is dynamically linked to the libpcap from the libpcap package.

Wireshark libpcap