Compiling Wireshark

One of the good things of most Linux based distributions is the central software catalog and combined update capability so the user doesn't have to update different programs from different resources or be bothered by programs individually to start or complete an update (like in Windows for example). While this is ideal and convenient for most users, the downside is that if the distribution decides that a package is in maintenance and security update mode only, there are no feature updates. One of those programs for me is Wireshark in which, over the last one and a half years, a number of interesting decoding packages for GSM have been added which are not available over my default Ubuntu 10.04 software updater.

Some fast developing programs such as Firefox have Linux binaries for download and can thus be kept up to date by the user if he wishes so in a pretty straight forward way. Wireshark, on the other hand only comes as source code for Linux so you have to compile it yourself if you want to have the latest and greatest version. So far I always shied away from this, too much work, too much hassle, too many unknowns. But these days the "feature pressure" became too big so I used an Ubuntu in a virtual machine for a trial and error compile. Turns out it was not as difficult as I thought but not straight forward either.

After downloading the sources and putting them in a folder in my home directory I checked the web for compile instructions and found them here. I guess things are made easier if you already have a relatively recent Wireshark version installed via the standard software repository so the general procedure only consists of the following three shell commands:

./autogen.sh
./configure
make

I had to run the process a number of times because I didn't have two software components installed for the scripts. One was gtk+ where the script wanted a version 2.4 or higher. Unfortunately, Ubuntu 10.04 only has a lower version number available in the software repository. So I installed that and it worked fine as well. After that all you need is some time depending on the speed of your CPU. Once done, wireshark can be started from the directory with ./wireshark (don't forget the ./, otherwise the old version is started from the default path).

And finally, the directory that contains the Wireshark executable and can be copied to other machines running Ubuntu 10.04 so no compile process is necessary there. Excellent!