Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How to compile Tshark to make GeoIP work

Hi

If I install tshark via package I can use GeoIP without any issue.

When I compile tshark this does not work.

I know that the mmdv files are correct, I have also used the mmdbresolve tool to verify.

The following output shows the configuration of tshark;

graham@graham:~$ tshark -G folders Temp: /tmp Personal configuration: /home/graham/.config/wireshark Global configuration: /usr/local/share/wireshark System: /etc Program: /usr/local/bin Personal Plugins: /home/graham/.local/lib/wireshark/plugins/2.6 Global Plugins: /usr/local/lib/wireshark/plugins/2.6 Extcap path: /usr/local/lib/wireshark/extcap MaxMind database path: /usr/share/GeoIP MaxMind database path: /var/lib/GeoIP graham@graham:~$ tshark -v TShark (Wireshark) 2.6.16 (v2.6.16)

Copyright 1998-2020 Gerald Combs [email protected] and contributors. License GPLv2+: GNU GPL version 2 or later http://www.gnu.org/licenses/old-licenses/gpl-2.0.html This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with GLib 2.56.4, with zlib 1.2.11, without SMI, without c-ares, without Lua, without GnuTLS, with Gcrypt 1.8.1, without Kerberos, with MaxMind DB resolver, without nghttp2, without LZ4, without Snappy, without libxml2.

Running on Linux 4.15.0-96-generic, with Intel(R) Core(TM) i5-7Y54 CPU @ 1.20GHz (with SSE4.2), with 1993 MB of physical memory, with locale en_US.UTF-8, with libpcap version 1.8.1, with Gcrypt 1.8.1, with zlib 1.2.11, binary plugins supported (13 loaded).

Built using gcc 7.5.0. graham@graham:~$

any ideas please?

many thanks

How to compile Tshark to make GeoIP work

Hi

If I install tshark via package I can use GeoIP without any issue.

When I compile tshark this does not work.

I know that the mmdv files are correct, I have also used the mmdbresolve tool to verify.

The following output shows the configuration of tshark;

graham@graham:~$ tshark -G folders Temp: /tmp Personal configuration: /home/graham/.config/wireshark Global configuration: /usr/local/share/wireshark System: /etc Program: /usr/local/bin Personal Plugins: /home/graham/.local/lib/wireshark/plugins/2.6 Global Plugins: /usr/local/lib/wireshark/plugins/2.6 Extcap path: /usr/local/lib/wireshark/extcap MaxMind database path: /usr/share/GeoIP MaxMind database path: /var/lib/GeoIP graham@graham:~$ tshark -v TShark (Wireshark) 2.6.16 (v2.6.16)

Copyright 1998-2020 Gerald Combs [email protected] and contributors. License GPLv2+: GNU GPL version 2 or later http://www.gnu.org/licenses/old-licenses/gpl-2.0.html This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with GLib 2.56.4, with zlib 1.2.11, without SMI, without c-ares, without Lua, without GnuTLS, with Gcrypt 1.8.1, without Kerberos, with MaxMind DB resolver, without nghttp2, without LZ4, without Snappy, without libxml2.

Running on Linux 4.15.0-96-generic, with Intel(R) Core(TM) i5-7Y54 CPU @ 1.20GHz (with SSE4.2), with 1993 MB of physical memory, with locale en_US.UTF-8, with libpcap version 1.8.1, with Gcrypt 1.8.1, with zlib 1.2.11, binary plugins supported (13 loaded).

Built using gcc 7.5.0. graham@graham:~$

I have also used the latest 3.2.2 which also didn't work.

any ideas please?

many thanks

How to compile Tshark to make GeoIP work

Hi

If I install tshark via package I can use GeoIP without any issue.

When I compile tshark this does not work.

I know that the mmdv files are correct, I have also used the mmdbresolve tool to verify.

The following output shows the configuration of tshark;

graham@graham:~$ tshark -G folders
Temp:                   /tmp
Personal configuration: /home/graham/.config/wireshark
Global configuration:   /usr/local/share/wireshark
System:                 /etc
Program:                /usr/local/bin
Personal Plugins:       /home/graham/.local/lib/wireshark/plugins/2.6
Global Plugins:         /usr/local/lib/wireshark/plugins/2.6
Extcap path:            /usr/local/lib/wireshark/extcap
MaxMind database path:  /usr/share/GeoIP
MaxMind database path:  /var/lib/GeoIP
graham@graham:~$ tshark -v
TShark (Wireshark) 2.6.16 (v2.6.16)

(v2.6.16) Copyright 1998-2020 Gerald Combs [email protected] <[email protected]> and contributors. License GPLv2+: GNU GPL version 2 or later http://www.gnu.org/licenses/old-licenses/gpl-2.0.html <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

PURPOSE. Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with GLib 2.56.4, with zlib 1.2.11, without SMI, without c-ares, without Lua, without GnuTLS, with Gcrypt 1.8.1, without Kerberos, with MaxMind DB resolver, without nghttp2, without LZ4, without Snappy, without libxml2.

libxml2. Running on Linux 4.15.0-96-generic, with Intel(R) Core(TM) i5-7Y54 CPU @ 1.20GHz (with SSE4.2), with 1993 MB of physical memory, with locale en_US.UTF-8, with libpcap version 1.8.1, with Gcrypt 1.8.1, with zlib 1.2.11, binary plugins supported (13 loaded).

loaded). Built using gcc 7.5.0. graham@graham:~$

graham@graham:~$

I have also used the latest 3.2.2 which also didn't work.

any ideas please?

many thanks