Obtaining and Installing TCPDump

TCPDump can be downloaded from http://www.tcpdump.org/ . TCPDump requires the PCap library libpcap, so while you're downloading TCPDump, you should download libpcap as well. Most popular Linux distributions such as SUSE also include TCPDump as an available package. For example, if you're using Debian you can simply type this:

apt-get install tcpdump

The package maintenance system will install TCPDump and any prerequisites too. For everyone else, you can probably search your distribution's repository for a package or just download the source and compile it, which I would recommend. TCPDump requires the PCap library, which is not usually installed on most systems. Whichever method you choose for installing TCPDump, you'll also need to grab the PCap library, sometimes referred to as libpcap. Both TCPDump and the PCap library can be downloaded from http://www.tcpdump.org/.

Should you attempt to compile TCPDump without having libpcap installed, you'll see an error similar to the following while running the configure script for TCPDump:

checking for main in -lpcap... no configure: error: see the INSTALL doc for more info

Installation of both libpcap and TCPDump is fairly straightforward as far as compiling software goes. Unarchive each piece of source code, run the configure script, compile, and install.

In essence:

tar -zxvf libpcap-<version>.tar.gz cd libpcap-<version>

./configure make make install

Do the same for TCPDump:

tar -zxvf tcpdump-<version>.tar.gz cd tcpdump-<version>

./configure make make install

Should you encounter problems while compiling the software, refer to previous chapters where the compile process is detailed further or, as an even better solution, practice your analyst skills by troubleshooting the error on the Internet. Chances are that someone else has encountered and solved the problem that you're working through.

Was this article helpful?

+2 -1


  • bisirat
    How to install tcpdump?
    2 years ago
  • mark
    How to install tcpdump on linux?
    1 year ago

Post a comment