TCUDUMP 交叉编译及使用

最新推荐文章于 2024-07-03 04:15:00 发布

chituhuan

最新推荐文章于 2024-07-03 04:15:00 发布

阅读量2.7k

点赞数

分类专栏： AndroidPlatform LinuxEmbedded

本文链接：https://blog.csdn.net/chituhuan/article/details/52383678

版权

AndroidPlatform LinuxEmbedded 专栏收录该内容

39 篇文章 0 订阅

订阅专栏

一：下载源码：libpcap-1.1.1.tar.gz tcpdump-4.1.1.tar.gz

二：编译libpcap

首先生成makefile，按照标准的交叉编译方法进行。

root@wang:/work/libpcap-1.1.1# ./configure --host=mipsel-linux --prefix=/work/tcpdump

configure: WARNING: If you wanted to set the --build type, don't use --host.

If a cross compiler is detected then cross compile mode will be used.

checking build system type... i686-pc-linux-gnu

checking host system type... mipsel-unknown-linux-gnu

checking if --disable-protochain option is specified... enabled

configure: error: pcap type not determined when cross-compiling; use --with-pcap=...

oot@wang:/work/libpcap-1.1.1# ./configure --host=mipsel-linux --prefix=/work/tcpdump --with-pcap=linux

configure: WARNING: If you wanted to set the --build type, don't use --host.

If a cross compiler is detected then cross compile mode will be used.

checking packet capture type... linux

checking Linux kernel version... unknown

configure: error: cannot determine linux version when cross-compiling

找不到linux的版本号，在网上搜了一下，处理的方法是直接屏蔽掉configure退出的代码。http://blog.csdn.net/qiaoliang328/article/details/4593909 觉得这样不好，仔细的看了一下configure文件：

Configure 7216行：

linux)

{ echo "$as_me:$LINENO: checking Linux kernel version" >&5

echo $ECHO_N "checking Linux kernel version... $ECHO_C" >&6; }

if test "$cross_compiling" = yes; then

if test "${ac_cv_linux_vers+set}" = set; then

echo $ECHO_N "(cached) $ECHO_C" >&6

else

ac_cv_linux_vers=unknown

确定我们使用的linux版本号时在这里出错，交叉编译找不到linux版本号，“ac_cv_linux_vers=unknown”，查看SDK确定我们使用的linux版本号为：2.6.18。修改configure文件“ac_cv_linux_vers=unknown”为：ac_cv_linux_vers=2.6.18；

重新configure

root@wang:/work/libpcap-1.1.1# ./configure --host=mipsel-linux --prefix=/work/tcpdump --with-pcap=linux

configure: WARNING: If you wanted to set the --build type, don't use --host.

If a cross compiler is detected then cross compile mode will be used.

checking build system type... i686-pc-linux-gnu

checking host system type... mipsel-unknown-linux-gnu

checking target system type... mipsel-unknown-linux-gnu

checking for mipsel-linux-gcc... mipsel-linux-gcc

编译运行：make

root@wang:/work/libpcap-1.1.1# ls libpcap.*

libpcap.a libpcap.so.1.1.1

root@wang:/work/libpcap-1.1.1# file libpcap.a

libpcap.a: current ar archive

root@wang:/work/libpcap-1.1.1# file libpcap.so.1.1.1

libpcap.so.1.1.1: ELF 32-bit LSB shared object, MIPS, MIPS32 version 1 (SYSV), dynamically linked, not stripped

三．编译tcpdump

root@wang:/work/tcpdump-4.1.1# ./configure --host=mipsel-linux

configure: WARNING: If you wanted to set the --build type, don't use --host.

If a cross compiler is detected then cross compile mode will be used.

checking build system type... i686-pc-linux-gnu

checking host system type... mipsel-unknown-linux-gnu

checking for mipsel-linux-gcc... mipsel-linux-gcc

checking Linux kernel version... unknown

configure: error: cannot determine linux version when cross-compiling

报同样的错误：按照libpcap的方法修改configure。

root@wang:/work/tcpdump-4.1.1# ./configure --host=mipsel-linux

configure: WARNING: If you wanted to set the --build type, don't use --host.

If a cross compiler is detected then cross compile mode will be used.

checking build system type... i686-pc-linux-gnu

checking host system type... mipsel-unknown-linux-gnu

checking for mipsel-linux-gcc... mipsel-linux-gcc

checking for local pcap library... ./../libpcap-1.1.1/libpcap.a

在check的过程中可以看到会自动找到libpcap.a的位置。

root@wang:/work/tcpdump-4.1.1# ll tcpdump -h

-rwxr-xr-x 1 root root 969K 2011-10-14 15:36 tcpdump*

root@wang:/work/tcpdump-4.1.1# file tcpdump

tcpdump: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), not stripped

四．利用交叉编译出来的tcpdump抓包，这样就不用使用hub了 ,O(∩_∩)O~，(⊙o⊙)哦。

把编译出来的tcpdump复制到nfs 挂载目录，板子mount到主机上。

root@wang:/work/tcpdump-4.1.1# cp tcpdump /nfs/hryl/rootfs/usr/local/bin/

# df

Filesystem 1K-blocks Used Available Use% Mounted on

/dev/romblock5 42268 42268 0 100% /

none 62400 8 62392 0% /tmp

/dev/mtdblock10 10240 1172 9068 11% /var

172.16.7.153:/nfs/hryl/rootfs/usr/

10319168 9209824 585152 94% /usr

# tcpdump -i eth0 tcp -w test.pcap &

# [KERNL][bcmemac_enet_ioctl] NET IOCTL

device eth0 entered promiscuous mode

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

在板子上浏览网页，然后查看抓包：

# ls -lh test.pcap

-rw-r--r-- 1 root root 926.9K Oct 14 08:10 test.pcap

我们抓得包在板子的/usr 目录，就是主机的/nfs/hryl/rootfs/usr/在我们的主机上wireshare打开test.pcap。

阅读(1930) | 评论(1) | 转发(0) |

上一篇：正则表达式及grep

下一篇：wireshark过滤器使用规则介绍