背景：在centos6.9中使用wireshark，執行yum install wireshark 命令後，版本為1.8,相比1.8,wireshark(tshark)版本2.4具備更豐富的輸出格式，在與elk結合使用時將更具有優勢。

1、環境
[[email protected] ~]# cat /etc/centos-release 
CentOS release 6.9 (Final)

2、開發環境
[[email protected] ~]# yum install -y gcc gcc-c++ gdb bison flex byacc
[[email protected]

~]# yum groupinstall "Development Tools"

3、libpcap 提供網路資料的採集功能
[[email protected] ~]# cd /opt
[[email protected] opt]# wget http://www.tcpdump.org/release/libpcap-1.8.1.tar.gz
[[email protected] opt]# tar zxvf libpcap-1.8.1.tar.gz
[[email protected] opt]# cd libpcap-1.8.1/
# Conifgure:
[

[email protected] libpcap-1.8.1]# ./configure --prefix=/usr --libdir=/usr/lib64
# Install:
[[email protected] libpcap-1.8.1]# make && make install

4、GLib 是為用c寫的庫及應用程式提供服務的，在安裝它之前，必須安裝 libffi、PCRE、gettext、python27。
   libffi 是為各種呼叫準備的高階介面
[[email protected] ~]# cd /opt
[[email protected]

opt]# wget https://sourceware.org/ftp/libffi/libffi-3.2.1.tar.gz
[[email protected] opt]# tar zxvf libffi-3.2.1.tar.gz
[[email protected] opt]# cd libffi-3.2.1/
[[email protected] libffi-3.2.1]# ./configure --prefix=/usr --libdir=/usr/lib64 --disable-static
[[email protected] libffi-3.2.1]# make && make install
   PCRE 是一個相容perl的正則表示式庫
[[email protected] ~]# cd /opt
[[email protected] opt]# wget https://ftp.pcre.org/pub/pcre/pcre-8.41.tar.gz
[[email protected] opt]# tar zxvf pcre-8.41.tar.gz
[[email protected] opt]# cd pcre-8.41/
[[email protected] pcre-8.41]# ./configure --prefix=/usr --libdir=/usr/lib64 --docdir=/usr/share/doc/pcre-8.41  --enable-unicode-properties --enable-pcre16 --enable-pcre32 --enable-pcregrep-libz --enable-pcregrep-libbz2 --enable-pcretest-libreadline --disable-static  --enable-utf8  
[[email protected] pcre-8.41]# make && make install
注意一定要加上 --enable-utf8 ，否則在安裝 glib時會報錯，報錯資訊如下
checking for PCRE... yes
checking for Unicode support in PCRE... no
configure: error: *** The system-supplied PCRE does not support Unicode properties or UTF-8.
安裝完成可以用 pcretest -C 檢查
如果出現 **Cannot --enable-pcregrep-libbz2 because bzlib.h was not found**    ，則說明需要安裝bzip2
[[email protected] pcre-8.41]# yum install -y bzip2 bzip2-devel
如果出現 ** Cannot --enable-pcregrep-libz because zlib.h was not found  ，則說明需要安裝zlib
[[email protected] pcre-8.41]# yum install -y zlib zlib-devel
如果出現 ** Cannot --enable-pcretest-readline because readline/readline.h was not found  ，則說明需要安裝 readline
[[email protected] pcre-8.41]# yum install -y readline readline-devel
如果出現
configure: error: 
*** You must have either have gettext support in your C library, or use the
*** GNU gettext library. (http://www.gnu.org/software/gettext/gettext.html)
則說明需要安裝 gettext，安裝結束後可用 gettext -V 來檢查
[[email protected] ~]# cd /opt
[[email protected] opt]# wget http://ftp.gnu.org/pub/gnu/gettext/gettext-latest.tar.gz
[[email protected] opt]# tar zxvf gettext-latest.tar.gz
[[email protected] opt]# cd gettext-0.19.8.1/
[[email protected] gettext-0.19.8.1]# ./configure --prefix=/usr --libdir=/usr/lib64
[[email protected] gettext-0.19.8.1]# make && make install
安裝完python27，必須使用 Software Collections Repository (scl) 進行更新
[[email protected] ~]# yum install centos-release-scl 
[[email protected] ~]# yum install python27  
[[email protected] ~]# scl enable python27 bash     
下面是GLib  的安裝 
[[email protected] ~]# cd /opt
[[email protected] opt]# wget http://ftp.gnome.org/pub/gnome/sources/glib/2.54/glib-2.54.0.tar.xz
[[email protected] opt]# xz -d glib-2.54.0.tar.xz
[[email protected] opt]# tar -xvf glib-2.54.0.tar
[[email protected] opt]# cd glib-2.54.0/
[[email protected] glib-2.54.0]# ./configure --prefix=/usr --libdir=/usr/lib64 --enable-libmount=no
[[email protected] glib-2.54.0]# make && make install

5、libgcrypt 是一個通用的加密庫
[[email protected] ~]# cd /opt
[[email protected] opt]# wget ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.8.1.tar.bz2
[[email protected] opt]# tar -jxvf libgcrypt-1.8.1.tar.bz2
[[email protected] opt]# cd libgcrypt-1.8.1/
[[email protected] libgcrypt-1.8.1]# ./configure --prefix=/usr --libdir=/usr/lib64
[[email protected] libgcrypt-1.8.1]# make && make install
如果出現 
checking for gpg-error-config... no
checking for GPG Error - version >= 1.25... no
configure: error: libgpg-error is needed.
                See ftp://ftp.gnupg.org/gcrypt/libgpg-error/ .
則說明需要安裝 libgpg-error
[[email protected] ~]# cd /opt
[[email protected]ost opt]# wget ftp://ftp.gnupg.org/gcrypt/libgpg-error/libgpg-error-1.27.tar.gz
[[email protected] opt]# tar zxvf libgpg-error-1.27.tar.gz
[[email protected] opt]# cd libgpg-error-1.27/
[[email protected] libgpg-error-1.27]# ./configure --prefix=/usr --libdir=/usr/lib64
[[email protected] libgpg-error-1.27]# make && make install

6、 Wireshark
[[email protected] ~]# cd /opt
[[email protected] opt]# wget https://www.wireshark.org/download/src/all-versions/wireshark-2.4.1.tar.xz
[[email protected] opt]# xz -d wireshark-2.4.1.tar.xz
[[email protected] opt]# tar -xvf wireshark-2.4.1.tar
[[email protected] opt]# cd wireshark-2.4.1/
[[email protected] wireshark-2.4.1]# ./configure --prefix=/usr --libdir=/usr/lib64  --with-gtk=no  --with-qt=no --disable-wireshark --sysconfdir=/etc
[[email protected] wireshark-2.4.1]# make
[[email protected] wireshark-2.4.1]# make install 
[[email protected] wireshark-2.4.1]# unset FILENAME
退出，重新登入 
[[email protected] opt]# tshark --version
Running as user "root" and group "root". This could be dangerous.
TShark (Wireshark) 2.4.1 (v2.4.1)

Copyright 1998-2017 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with
GLib 2.54.0, with zlib 1.2.3, without SMI, without c-ares, without Lua, without
GnuTLS, with Gcrypt 1.8.1, without Kerberos, without GeoIP, without nghttp2,
without LZ4, without Snappy, without libxml2.

Running on Linux 2.6.32-696.el6.x86_64, with Intel(R) Xeon(R) CPU          
E5520  @ 2.27GHz (with SSE4.2), with 3822 MB of physical memory, with locale
en_US.UTF-8, with libpcap version 1.8.1, with Gcrypt 1.8.1, with zlib 1.2.3.

Built using gcc 4.