Getting Started
---------------
See the INSTALL file for instructions on how to build and install
and start using tcptrack.
Known Bugs / Gotchas
--------------------
tcptrack does not compile cleanly with libpcap versions earlier than
0.7.2. See below for a hack to your libpcap <0.7.2 to get tcptrack
to compile on it, or upgrade your libpcap.
On some systems at the end of the build process (after doing make),
you may see "g++: unrecognized option -pthread". This is a problem
with the configure script thinking that your c++ compiler actually
accepts this option. This message isn't actually a fatal error.
Unless some other error occurred, you should have a working tcptrack
binary built and can test it or proceed to 'make install'.
I have had one report that tcptrack will fail to compile on Solaris
giving a ton of errors involving stl include files while doing
'make'. I have not been able to reproduce this on any Solaris
machine that I have access to. I'm not sure if there's a problem in
tcptrack or elsewhere. If you encounter this, please let me know.
Notes
-----
Compilation may fail with errors about multiple declarations of
bpf_validate and bpf_filter. There is a bug in libpcap versions
earlier than 0.7.2 which causes this to happen when using libpcap in
C++ programs. To correct it get libpcap 0.7.2 or higher from
www.tcpdump.org or see the notes at the end of this README file on
how to fix your version.
On Redhat 7.x configure or compilation may fail with errors about
net/bpf.h not existing, or configure may tell you that it cannot
find pcap.h when you in fact have it. I think this is a bug with
Redhat's libpcap packages. See below for instructions on how to fix
it, or install libpcap >= 0.7.2 from source.
Fixing Redhat pcap build/configure problems
-------------------------------------------
As mentioned above in the Notes section, this may be needed if
you're on Redhat 7.x and configure tells you you don't have pcap.h
when in fact you do.
Edit your pcap.h file (/usr/include/pcap/pcap.h on RH 7.x).
Line 42 reads:
#include <net/bpf.h>
Change it to read:
#include <pcap/net/bpf.h>
Now try running configure again. If you get 'previous declaration'
errors while running make, see the next section.
Fixing C++ bug in pcap < 0.7.2
------------------------------
This is a hack that is only needed if you're experiening the build
problems about multiple declarations of bpf_validate and bpf_filter
mentioned above in the Notes section. Note that this may cause other
programs to fail to compile, so you should change it back after
you've built tcptrack (or upgrade your libpcap if posssible).
Edit your pcap.h. It may be in /usr/include or /usr/include/pcap.
Around line 169 (as of libpcap 0.6.2, YMMV) you should see the
following lines:
u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
int bpf_validate(struct bpf_insn *f, int len);
Comment them out:
/*
u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
int bpf_validate(struct bpf_insn *f, int len);
*/
Now try building again.
Reporting Bugs / Comments / Requests / Patches
----------------------------------------------
Send me (Steve Benson) an email at
[email protected]_THIS_SPAMTRAP.cx if you have questions or find
bugs or anything.