Wireshark开发者指南：构建环境与开发入门

需积分: 7 69 浏览量更新于2024-07-16 收藏 1.92MB PDF 举报

《Wireshark开发者指南》是一份详细的文档，旨在帮助那些想要开发或参与Wireshark项目的人。Wireshark是一个广泛使用的网络协议分析器，用于捕获、分析和解码网络数据包，支持Unix和Unix-like系统（如Linux、macOS）以及Microsoft Windows平台。该文档于2019年10月22日更新至版本3.1.1。文档的前言部分包括了对于读者的建议，例如谁应该阅读这份指南，以及对文档作者的致谢。文档提供了一个概述，解释了Wireshark的基本概念和它在网络安全分析中的作用。章节1详述了Wireshark的构建环境，涵盖了以下关键内容： 1.1 概述：介绍了Wireshark作为一个开源项目，其开发语言和技术栈，如C++、Python等。 1.2 Wireshark简介：强调了Wireshark的功能，如网络数据包捕获、解析和查看，以及它在网络故障排查、安全审计和网络协议研究中的应用。 1.3 支持的平台：分为两大部分： - Unix和Unix-like平台：详细说明了这些系统上Wireshark的安装和配置方法。 - Microsoft Windows：着重介绍了Windows版Wireshark的特性和安装步骤。 1.4 开发与维护：阐述了Wireshark项目的开源特性，以及开发者可以使用的编程语言和工具。同时，提到了如何参与到项目的开发和贡献中。 1.5 发布与分发：区分了二进制分发（预编译的可执行文件）和源代码分发，以及自动化构建工具（Buildbot）的作用和优点，包括如何获取最新版本和报告问题。 1.6 报告问题和获取帮助：提供了多种途径来寻求支持，包括官方网站、wiki、常见问题解答（FAQ）、问答网站和邮件列表。这份指南是Wireshark开发人员和潜在贡献者的宝贵资源，为他们提供了关于项目架构、开发流程、技术支持和社区互动的全面指导。无论是初次接触的开发者还是经验丰富的贡献者，都能从中找到所需的信息来提升他们的项目参与度。

2019/10/22 Wireshark Developer’s Guide

https://www.wireshark.org/docs/wsdg_html/ 16/225

Well, if you want to start Wireshark development, you might already know what Wireshark is doing. If not, please have a look at the

Wireshark User’s Guide (https://www.wireshark.org/docs/wsug_html_chunked/), which will provide a lot of general information about

it.

1.3.Supported Platforms

Wireshark currently runs on most UNIX-like platforms and various Windows platforms. It requires Qt, GLib, libpcap and some other

libraries in order to run.

As Wireshark is developed in a platform independent way and uses libraries (such as the Qt GUI library) which are available for many

different platforms, it’s thus available on a wide variety of platforms.

If a binary package is not available for your platform, you should download the source and try to build it. Please report your

experiences to wireshark-dev[AT]wireshark.org.

Binary packages are available for the following platforms along with many others:

1.3.1.Unix and Unix-like platforms

Apple macOS

FreeBSD

HP-UX

IBM AIX

NetBSD

OpenBSD

Oracle Solaris

1.3.1.1.Linux

Debian GNU/Linux

Ubuntu

Fedora

Gentoo Linux

IBM S/390 Linux (Red Hat)

Mandrake Linux

PLD Linux

Red Hat Linux

Rock Linux

Slackware Linux

Suse Linux

1.3.2.Microsoft Windows

Wireshark supports Windows natively via the Windows API (https://en.wikipedia.org/wiki/Windows_API). Note that in this

documentation and elsewhere we tend to use the terms “Win32”, “Win”, and “Windows” interchangeably to refer to the Windows

API. Wireshark runs on and can be compiled on the following platforms:

Windows 10 / Windows Server 2016

Windows 8.1 / Windows Server 2012 R2

Windows 8 / Windows Server 2012

Windows 7 / Windows Server 2008 R2

Development on Windows Vista, Server 2008, and older versions may be possible but is not supported.

2019/10/22 Wireshark Developer’s Guide

https://www.wireshark.org/docs/wsdg_html/ 17/225

1.4.Development and maintenance of Wireshark

Wireshark was initially developed by Gerald Combs. Ongoing development and maintenance of Wireshark is handled by the

Wireshark core developers, a loose group of individuals who fix bugs and provide new functionality.

There have also been a large number of people who have contributed protocol dissectors and other improvements to Wireshark, and

it is expected that this will continue. You can find a list of the people who have contributed code to Wireshark by checking the About

dialog box of Wireshark, or have a look at the https://www.wireshark.org/about.html#authors

(https://www.wireshark.org/about.html#authors) page on the Wireshark web site.

The communication between the developers is usually done through the developer mailing list, which can be joined by anyone

interested in the development activities. At the time this document was written, more than 500 persons were subscribed to this

mailing list!

It is strongly recommended to join the developer mailing list, if you are going to do any Wireshark development. See Section 1.7.6,

“Mailing Lists” about the different Wireshark mailing lists available.

1.4.1.Programming languages used

Most of Wireshark is implemented in plain ANSI C. A notable exception is the code in ui/qt, which is written in C++.

The typical task for a new Wireshark developer is to extend an existing, or write a new dissector for a specific network protocol. As

(almost) any dissector is written in plain old ANSI C, a good knowledge about ANSI C will be sufficient for Wireshark development in

almost any case.

So unless you are going to change the build process of Wireshark itself, you won’t come in touch with any other programming

language than ANSI C (such as Perl or Python, which are used only in the Wireshark build process).

Beside the usual tools for developing a program in C (compiler, make, … ), the build process uses some additional helper tools (Perl,

Python, Sed, … ), which are needed for the build process when Wireshark is to be build and installed from the released source

packages. If Wireshark is installed from a binary package, none of these helper tools are needed on the target system.

1.4.2.Open Source Software

Wireshark is an open source software (OSS) project, and is released under the GNU General Public License

(https://www.gnu.org/licenses/gpl-2.0.html) (GPL). You can freely use Wireshark on any number of computers you like, without

worrying about license keys or fees or such. In addition, all source code is freely available under the GPL. Because of that, it is very

easy for people to add new protocols to Wireshark, either as plugins, or built into the source, and they often do!

You are welcome to modify Wireshark to suit your own needs, and it would be appreciated if you contribute your improvements back

to the Wireshark community.

You gain three benefits by contributing your improvements back to the community:

Other people who find your contributions useful will appreciate them, and you will know that you have helped people in the

same way that the developers of Wireshark have helped you and other people.

The developers of Wireshark might improve your changes even more, as there’s always room for improvement. Or they may

implement some advanced things on top of your code, which can be useful for yourself too.

The maintainers and developers of Wireshark will maintain your code as well, fixing it when API changes or other changes are

made, and generally keeping it in tune with what is happening with Wireshark. So if Wireshark is updated (which is done

often), you can get a new Wireshark version from the website and your changes will already be included without any effort for

you.

2019/10/22 Wireshark Developer’s Guide

https://www.wireshark.org/docs/wsdg_html/ 18/225

The Wireshark source code and binary packages for some platforms are all available on the download page of the Wireshark website:

https://www.wireshark.org/download.html (https://www.wireshark.org/download.html).

1.5.Releases and distributions

The officially released files can be found at https://www.wireshark.org/download.html (https://www.wireshark.org/download.html). A

new Wireshark version is released after significant changes compared to the last release are completed or a serious security issue is

encountered. The typical release schedule is about every 4-8 weeks (although this may vary). There are two kinds of distributions:

binary and source; both have their advantages and disadvantages.

1.5.1.Binary distributions

Binary distributions are usually easy to install (as simply starting the appropriate file is usually the only thing to do). They are

available for the following systems:

Windows (.exe file). The typical Windows end user is used to getting a setup.exe file which will install all the required things for

him.

Win32 PAF (.paf.exe file). Another Windows end user method is to get a portable application file which will install all the

required things for him.

Debian (.deb file). A user of a Debian Package Manager (DPKG) based system obtains a .deb file from which the package

manager checks the dependencies and installs the software.

Red Hat (.rpm file). A user of a RPM Package Manager (RPM) based system obtains an .rpm file from which the package

manager checks the dependencies and installs the software.

macOS (.dmg file). The typical macOS end user is used to getting a .dmg file which will install all the required things for him.

Solaris. A Solaris user obtains a file from which the package manager (PKG) checks the dependencies and installs the software.

However, if you want to start developing with Wireshark, the binary distributions won’t be too helpful, as you need the source files, of

course.

For details about how to build these binary distributions yourself, e.g. if you need a distribution for a special audience, see

Section 3.11, “Binary Packaging”.

1.5.2.Source code distributions

It’s still common for developers for UNIX-like platforms to give the end user a source tarball and let the user compile it on their target

machine (configure make make install). However, for different UNIX and UNIX-like systems, such as Linux distributions, it’s

becoming more common to release binary packages (e.g., .deb or .rpm files) these days.

You should use the released sources if you want to build Wireshark from source on your platform for productive use. However, if you

going to develop changes to the Wireshark sources, it might be better to use the latest Git sources. For details about the different ways

to get the Wireshark source code see Section 3.3, “Obtain the Wireshark sources”.

Before building Wireshark from a source distribution, make sure you have all the tools and libraries required to build. The following

chapters will describe the required tools and libraries in detail.

1.6.Automated Builds (Buildbot)

The Wireshark Buildbot automatically rebuilds Wireshark on every change of the source code repository and indicates problematic

changes. This frees the developers from repeating (and annoying) work, so time can be spent on more interesting tasks.

1.6.1.Advantages

Recognizing (cross platform) build problems - early. Compilation problems can be narrowed down to a few commits, making a

fix much easier.

2019/10/22 Wireshark Developer’s Guide

https://www.wireshark.org/docs/wsdg_html/ 19/225

"Health status" overview of the sources. A quick look at: https://buildbot.wireshark.org/wireshark-master/

(https://buildbot.wireshark.org/wireshark-master/) gives a good "feeling" if the sources are currently "well". On the other hand,

if all is "red", an update of a personal source tree might better be done later …

"Up to date" binary packages are available. After a change was committed to the repository, a binary package / installer is

usually available within a few hours at: https://www.wireshark.org/download/automated/

(https://www.wireshark.org/download/automated/). This can be quite helpful, e.g. a bug reporter can easily verify a bugfix by

installing a recent build.

Automated regression tests. In particular, the fuzz tests often indicate "real life" problems that are otherwise hard to find.

1.6.2.What does the Buildbot do?

The Buildbot will do the following (to a different degree on the different platforms):

Check out from the source repository

Build

Create binary packages and installers

Create source packages and run distribution checks

Run regression tests

Each step is represented at the status page by a rectangle, green if it succeeded or red if it failed. Most steps provide a link to the

corresponding console logfile, to get additional information.

The Buildbot runs on a platform collection that represents the different "platform specialties" quite well:

Windows Server 2019 x86 (Win32, little endian, Visual Studio 2017)

Windows Server 2016 x86-64 (Win64, little endian, Visual Studio 2017)

Ubuntu 18.04 x86-64 (Linux, little endian, gcc, Clang)

macOS 10.14 x86-64 (BSD, little endian, Clang)

and two buildslaves that run static code analysis to help spot coding issues:

Visual Studio Code Analysis (Win64, little endian, VS 2017)

Clang Code Analysis (Linux, little endian, Clang)

Each platform is represented at the status page by a single column, the most recent entries are at the top.

1.7.Reporting problems and getting help

If you have problems, or need help with Wireshark, there are several places that may be of interest to you (well, beside this guide of

course).

1.7.1.Website

You will find lots of useful information on the Wireshark homepage at https://www.wireshark.org/ (https://www.wireshark.org/).

1.7.2.Wiki

The Wireshark Wiki at https://wiki.wireshark.org/ (https://wiki.wireshark.org/) provides a wide range of information related to

Wireshark and packet capturing in general. You will find a lot of information not part of this developer’s guide. For example, there is

an explanation how to capture on a switched network, an ongoing effort to build a protocol reference and a lot more.

And best of all, if you would like to contribute your knowledge on a specific topic (maybe a network protocol you know well), you can

edit the Wiki pages by simply using your webbrowser.

1.7.3.FAQ

2019/10/22 Wireshark Developer’s Guide

https://www.wireshark.org/docs/wsdg_html/ 20/225

The "Frequently Asked Questions" will list often asked questions and the corresponding answers.

Before sending any mail to the mailing lists below, be sure to read the FAQ, as it will often answer any questions you might have. This

will save yourself and others a lot of time. Keep in mind that a lot of people are subscribed to the mailing lists.

You will find the FAQ inside Wireshark by clicking the menu item Help/Contents and selecting the FAQ page in the upcoming dialog.

An online version is available at the Wireshark website: https://www.wireshark.org/faq.html (https://www.wireshark.org/faq.html).

You might prefer this online version as it’s typically more up to date and the HTML format is easier to use.

1.7.4.Other sources

If you don’t find the information you need inside this book, there are various other sources of information:

The file doc/README.developer and all the other README.xxx files in the source code. These are various documentation files

on different topics

Read the README

README.developer is packed full with all kinds of details relevant to the developer of

Wireshark source code. Its companion file README.dissector advises you around

common pitfalls, shows you basic layout of dissector code, shows details of the APIs

available to the dissector developer, etc.

The Wireshark source code

Tool documentation of the various tools used (e.g. manpages of sed, gcc, etc.)

The different mailing lists. See Section 1.7.6, “Mailing Lists”

1.7.5.Q&A Site

The Wireshark Q&A site at https://ask.wireshark.org/ (https://ask.wireshark.org/) offers a resource where questions and answers

come together. You have the option to search what questions were asked before and what answers were given by people who knew

about the issue. Answers are graded, so you can pick out the best ones easily. If your issue isn’t discussed before you can post one

yourself.

1.7.6.Mailing Lists

There are several mailing lists available on specific Wireshark topics:

wireshark-announce

This mailing list will inform you about new program releases, which usually appear about every 4-8 weeks.

wireshark-users

This list is for users of Wireshark. People post questions about building and using Wireshark, others (hopefully) provide

answers.

wireshark-dev

This list is for Wireshark developers. People post questions about the development of Wireshark, others (hopefully) provide

answers. If you want to start developing a protocol dissector, join this list.

wireshark-bugs

剩余224页未读，继续阅读

谢艺华

粉丝: 6401
资源: 4

Wireshark开发者指南：构建环境与开发入门

Wireshark Developer's Guide.pdf

Wireshark-developer-guide.chm

developer-guide.pdf

wireshark-developer-guide.pdf

Wireshark User's Guide.pdf

wireshark-developer-guide.rar

wireshark-user-guide.pdf

Wireshark详细图文教程.pdf

Wireshark网络分析实战.pdf

wireshark使用详细教程.pdf

最新资源