Linux primer for networkers: Using the sniffer

01.05.2006

When loading packages on a network analyzer, it's sometimes preferable to burn all of the packages to a CD first. For example, for a basic network analyzer, download iptraf, libpcap and tcpdump to a directory on a machine that has a CD writer (it can be on a Windows machine) and copy the files (compressed and zipped) to the CD. The unzipping and unpacking of the packages occurs on the Linux machine. While it may seem like a waste of a CD to burn only three packages, it provides two benefits I have discovered from experience. First, you can take the CD from machine to machine without having to download packages for every machine. Second, for a more complex analyzer with many packages, having them all on one CD eliminates the chance that one will be forgotten.

Take the CD with the three packages and mount it on the Linux machine. It isn't quite as simple as cd d:. The CD must be mounted first. Usually the command mount -t iso9660 /dev/cdrom /cdrom is enough, provided that a directory named /cdrom exists. If not, simply create it with the command mkdir /cdrom. Create a directory to hold the packages (such as /download) and copy the packages there (cp /cdrom/* /download).

One possible problem is that packages often have dependencies. That is, to function properly (or even install in some cases), the dependent package must be present. Such is the case for TCPdump; it depends on libpcap. It may be a good exercise of proof to try to install TCPdump without installing libpcap to see what type of error message will occur without a dependent package.

Sometimes packages come as self-extracting and installable executables that require simply running the downloaded file. In other cases, packages can be installed via a package manager (such as rpm). But usually you have to unzip and unpack a package and then run three commands on it: configure, make and make install.

Unzip and unpack