If you have not built libpcap, and your system does not have libpcap installed, install libpcap first. Your system might provide a version of libpcap that can be installed; if so, to compile tcpdump you might need to install a "developer" version of libpcap as well as the "run-time" version. You can also install tcpdump.org's version of libpcap; see this file for the location.
You will need a C99 compiler to build tcpdump. The build system will abort if your compiler is not C99 compliant. If this happens, use the generally available GNU C compiler (GCC) or Clang.
After libpcap has been built (either install it with make install or
make sure both the libpcap and tcpdump source trees are in the same
directory), run ./configure (a shell script). configure will
determine your system attributes and generate an appropriate Makefile
from Makefile.in. Now build tcpdump by running make.
If everything builds ok, su and type make install. This will install
tcpdump and the manual entry. Any user will be able to use tcpdump to
read saved captures. Whether a user will be able to capture traffic
depends on the OS and the configuration of the system; see the
tcpdump man page
for details. DO NOT give untrusted users the ability to
capture traffic. If a user can capture traffic, he or she could use
utilities such as tcpdump to capture any traffic on your net, including
passwords.
Note that most systems ship tcpdump, but usually an older version.
Building tcpdump from source as explained above will usually install the
binary as /usr/local/bin/tcpdump. If your system has other tcpdump
binaries, you might need to deinstall these or to set the PATH environment
variable if you need the tcpdump command to run the new binary
(tcpdump --version can be used to tell different versions apart).
If your system is not one which we have tested tcpdump on, you may have
to modify the configure script and Makefile.in. Please
send us patches
for any modifications you need to make.
Please see this file for notes about tested platforms.
CHANGES - description of differences between releases
CONTRIBUTING.md - guidelines for contributing
CREDITS - people that have helped tcpdump along
INSTALL.md - this file
LICENSE - the license under which tcpdump is distributed
Makefile.in - compilation rules (input to the configure script)
README.md - description of distribution
VERSION - version of this release
aclocal.m4 - autoconf macros
addrtoname.c - address to hostname routines
addrtoname.h - address to hostname definitions
addrtostr.c - address to printable string routines
addrtostr.h - address to printable string definitions
ah.h - IPSEC Authentication Header definitions
appletalk.h - AppleTalk definitions
ascii_strcasecmp.c - locale-independent case-independent string comparison
routines
atime.awk - TCP ack awk script
atm.h - ATM traffic type definitions
bpf_dump.c - BPF program printing routines, in case libpcap doesn't
have them
chdlc.h - Cisco HDLC definitions
cpack.c - functions to extract packed data
cpack.h - declarations of functions to extract packed data
config.guess - autoconf support
config.h.in - autoconf input
config.sub - autoconf support
configure - configure script (run this first)
configure.ac - configure script source
doc/README.* - some building documentation
ethertype.h - Ethernet type value definitions
extract.h - alignment definitions
gmpls.c - GMPLS definitions
gmpls.h - GMPLS declarations
install-sh - BSD style install script
interface.h - globals, prototypes and definitions
ip.h - IP definitions
ip6.h - IPv6 definitions
ipproto.c - IP protocol type value-to-name table
ipproto.h - IP protocol type value definitions
l2vpn.c - L2VPN encapsulation value-to-name table
l2vpn.h - L2VPN encapsulation definitions
lbl/os-*.h - OS-dependent defines and prototypes
llc.h - LLC definitions
machdep.c - machine dependent routines
machdep.h - machine dependent definitions
makemib - mib to header script
mib.h - mib definitions
missing/* - replacements for missing library functions
ntp.c - functions to handle ntp structs
ntp.h - declarations of functions to handle ntp structs
mkdep - construct Makefile dependency list
mpls.h - MPLS definitions
nameser.h - DNS definitions
netdissect.h - definitions and declarations for tcpdump-as-library
(under development)
nfs.h - Network File System V2 definitions
nfsfh.h - Network File System file handle definitions
nlpid.c - OSI NLPID value-to-name table
nlpid.h - OSI NLPID definitions
ospf.h - Open Shortest Path First definitions
packetdat.awk - TCP chunk summary awk script
parsenfsfh.c - Network File System file parser routines
pcap-missing.h - declarations of functions possibly missing from libpcap
ppp.h - Point to Point Protocol definitions
print.c - Top-level routines for protocol printing
print-*.c - The netdissect printers
rpc_auth.h - definitions for ONC RPC authentication
rpc_msg.h - definitions for ONC RPC messages
send-ack.awk - unidirectional tcp send/ack awk script
slcompress.h - SLIP/PPP Van Jacobson compression (RFC1144) definitions
smb.h - SMB/CIFS definitions
smbutil.c - SMB/CIFS utility routines
stime.awk - TCP send awk script
tcp.h - TCP definitions
tcpdump.1 - manual entry
tcpdump.c - main program
timeval-operations.h - timeval operations macros
udp.h - UDP definitions
util-print.c - utility routines for protocol printers