分类： 嵌入式
2011-10-14 16:38:40
一：下载源码：libpcap-1.1.1.tar.gz tcpdump-4.1.1.tar.gz
二：编译libpcap
首先生成makefile，按照标准的交叉编译方法进行。
1.
root@wang:/work/libpcap-1.1.1# ./configure --host=mipsel-linux --prefix=/work/tcpdump
configure: WARNING: If you wanted to set the --build type, don't use --host.
If a cross compiler is detected then cross compile mode will be used.
checking build system type... i686-pc-linux-gnu
checking host system type... mipsel-unknown-linux-gnu
checking if --disable-protochain option is specified... enabled
configure: error: pcap type not determined when cross-compiling; use --with-pcap=...
2.
oot@wang:/work/libpcap-1.1.1# ./configure --host=mipsel-linux --prefix=/work/tcpdump --with-pcap=linux
configure: WARNING: If you wanted to set the --build type, don't use --host.
If a cross compiler is detected then cross compile mode will be used.
checking packet capture type... linux
checking Linux kernel version... unknown
configure: error: cannot determine linux version when cross-compiling
找不到linux的版本号，在网上搜了一下，处理的方法是直接屏蔽掉configure退出的代码。http://blog.csdn.net/qiaoliang328/article/details/4593909 觉得这样不好，仔细的看了一下configure文件：
Configure 7216行：
linux)
{ echo "$as_me:$LINENO: checking Linux kernel version" >&5
echo $ECHO_N "checking Linux kernel version... $ECHO_C" >&6; }
if test "$cross_compiling" = yes; then
if test "${ac_cv_linux_vers+set}" = set; then
echo $ECHO_N "(cached) $ECHO_C" >&6
else
ac_cv_linux_vers=unknown
fi
确定我们使用的linux版本号时在这里出错，交叉编译找不到linux版本号，“ac_cv_linux_vers=unknown”， 查看SDK确定我们使用的linux版本号为：2.6.18。修改configure文件“ac_cv_linux_vers=unknown”为：ac_cv_linux_vers=2.6.18；
3.
重新configure
root@wang:/work/libpcap-1.1.1# ./configure --host=mipsel-linux --prefix=/work/tcpdump --with-pcap=linux
configure: WARNING: If you wanted to set the --build type, don't use --host.
If a cross compiler is detected then cross compile mode will be used.
checking build system type... i686-pc-linux-gnu
checking host system type... mipsel-unknown-linux-gnu
checking target system type... mipsel-unknown-linux-gnu
checking for mipsel-linux-gcc... mipsel-linux-gcc
4.
编译运行：make
root@wang:/work/libpcap-1.1.1# ls libpcap.*
libpcap.a libpcap.so.1.1.1
root@wang:/work/libpcap-1.1.1# file libpcap.a
libpcap.a: current ar archive
root@wang:/work/libpcap-1.1.1# file libpcap.so.1.1.1
libpcap.so.1.1.1: ELF 32-bit LSB shared object, MIPS, MIPS32 version 1 (SYSV), dynamically linked, not stripped
三．编译tcpdump
1.
root@wang:/work/tcpdump-4.1.1# ./configure --host=mipsel-linux
configure: WARNING: If you wanted to set the --build type, don't use --host.
If a cross compiler is detected then cross compile mode will be used.
checking build system type... i686-pc-linux-gnu
checking host system type... mipsel-unknown-linux-gnu
checking for mipsel-linux-gcc... mipsel-linux-gcc
checking Linux kernel version... unknown
configure: error: cannot determine linux version when cross-compiling
报同样的错误：按照libpcap的方法修改configure。
2.
root@wang:/work/tcpdump-4.1.1# ./configure --host=mipsel-linux
configure: WARNING: If you wanted to set the --build type, don't use --host.
If a cross compiler is detected then cross compile mode will be used.
checking build system type... i686-pc-linux-gnu
checking host system type... mipsel-unknown-linux-gnu
checking for mipsel-linux-gcc... mipsel-linux-gcc
checking for local pcap library... ./../libpcap-1.1.1/libpcap.a
在check的过程中可以看到会自动找到libpcap.a的位置。
root@wang:/work/tcpdump-4.1.1# ll tcpdump -h
-rwxr-xr-x 1 root root 969K 2011-10-14 15:36 tcpdump*
root@wang:/work/tcpdump-4.1.1# file tcpdump
tcpdump: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), not stripped
四．利用交叉编译出来的tcpdump抓包，这样就不用使用hub了 ,O(∩_∩)O~，(⊙o⊙)哦。
1.
把编译出来的tcpdump复制到nfs 挂载目录，板子mount到主机上。
root@wang:/work/tcpdump-4.1.1# cp tcpdump /nfs/hryl/rootfs/usr/local/bin/
# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/romblock5 42268 42268 0 100% /
none 62400 8 62392 0% /tmp
/dev/mtdblock10 10240 1172 9068 11% /var
172.16.7.153:/nfs/hryl/rootfs/usr/
10319168 9209824 585152 94% /usr
# tcpdump -i eth0 tcp -w test.pcap &
# [KERNL][bcmemac_enet_ioctl] NET IOCTL
device eth0 entered promiscuous mode
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
2.
在板子上浏览网页，然后查看抓包：
# ls -lh test.pcap
-rw-r--r-- 1 root root 926.9K Oct 14 08:10 test.pcap
我们抓得包在板子的/usr 目录， 就是主机的/nfs/hryl/rootfs/usr/在我们的主机上wireshare打开test.pcap。
