Cross-compile Wireshark for Android18 Jul 2016
Wireshark (originally named Ethereal) is a free and open source packet analyzer.
It is used for network troubleshooting, analysis, software and communications protocol development, and education. 
It functions similar to
pcap in terms of packet capturing, yet its major feature is the network protocol analysis which
pcap cannot offer.
According to the official site, “Wireshark is the world’s foremost network protocol analyzer.”  Though Wireshark has distribution on all major platforms: GNU/Linux, OS X, BSD, Solaris, some other Unix-like operating systems, and Microsoft Windows, there is no official distribution for Android or common embedded Linux platform.
Some reader may know that for Android, there is an app called ``Shark for Root’’ on Google Play Store , but it is only an encapsulation of the
tcpdump binary for Android.
I will discuss the major steps to cross-compile Wireshark libraries for the Android platform. This post is based on my experience compiling the Wireshark 2.0.x libraries for Android on Ubuntu 14.04/16.04.
To my best knowledge, this post is the first comprehensive guide on how to cross-compile the latest Wireshark for Android. But still, this is NOT an easy task, at all. You should anticipate to encounter new errors in your attempts, but be able to fix them with reasonable knowlege of compiling and programming. Only for tech-savvy people. (Don’t be intimidated, I am joking! :P)
DISCLAIMER: Though I believe that this post should work on most of the Linux distributions and subsequent Wireshark 2.0.x releases, and should be easily extended to other embedded Linux platforms, I cannot guarantee that it will work.
Install required packages
In this post, I assume the building system is Ubuntu 16.04 64-bit. The following packages needs to be installed.
Compile and install dependency libraries
If you directly starting to compile Wireshark using the cross compiler, most probably you will be stopped here:
You can see, like many other open-source softwares, Wireshark depends on GLib.
So you need to have GLib (>= 2.16.0) cross-compiled and installed in order to cross-compile Wireshark.
The GLib cross-compilation process was discussed in detail in my previous blog (Cross-compile GLib for Android).
Also make sure that GLib’s install location is included in the
ld will complain that it cannot find
-lglib-2.0.so and so on.
Download Wireshark sources
Download Wireshark sources from its official website.
The latest stable version is
For example, the download link from North America CDN is:
Patch the Wireshark source codes
Because Android does not fully support some of the standard Unix functions, (such as
endgrent()), we need to make several patches.
You will then be prompted that some function signatures do not match.
The first one is that some function signatures do not match their implementations.
We need to change the function signature of
void *DtdParseAlloc() at line 64 in
Change the input type from
void *(*)(gsize) to
Same patch is needed for another occurance of it in file
epan/dtd_parse.h, line 25.
The second patch we need to apply is in
tools/lemon/Makefile.in at line 775.
lemon is one of Wireshark’s essential internal building tool.
We need to change
$(CC_FOR_BUILD) to its absolute path
/usr/bin/cc assuming we are using the standard GCC install location.
This is actually a bug in
lemon’s environment configuration.
$(CC_FOR_BUILD) is supposed to be interpreted as the build system’s CC which is
/usr/bin/cc, but in fact it will be wrongly taken as the host system’s CC which is the
arm-eabi version when we cross-compile.
That would be an error because
lemon has to be built as the executable for the build system (
x86_64 binary) to do the real work.
Our patch will fix this issue.
The last one we need to patch is in
wsutil/privileges.c at line 324.
wsutil library called
endgrent() in privilege management.
However, as of Android NDK r10e API level 19, there is no declaration of
Thus we have to comment out this function call to fix it.
It seems safe to do so, but I have not investigate this issue throughly.
Interestingly, the Android NDK r12b API level 23 have better support of privileges in
grp.h and implemented this function.
Unfortunately, however, as my previous post has pointed out, the attempt of cross-compiling GLib is not successful using Android NDK r12b.
One possible way to keep
endgrent() is that you get the GLib cross-compiled using NDK r10e, and then cross-compile wireshark using NDK r12b.
This way, this patch can be probably skipped, but any complication raise from the inconsistent NDK versions is unknown.
Finally, if you are using NDK r10e, you can apply the following patch file without patch the source codes manually.
Save it as
wireshark-android.patch, and do
With all the prerequisite ready, we can begin cross-compiling wireshark.
First we need to set the environment variables to use Android cross-compilers, as the below script shows. The majority of the script is the same as the script we used for cross-compiling GLib. The only difference is the compiler flags part.
autogen.sh, if it succeeds you should expect to see the similar output.
Fix any error according to its output.
Next, configure the parameters using the following.
We just want the basic Wireshark libraries (
libws) working for Android, so I disabled most of its plugins, including
You may want to keep
pcap by using
with-pcap to capture packets if you do not have packet capture program for Android.
You can tailor the configure parameters to your own need, but probably you need to handle more dependencies.
For example, if you want to use
pcap, you need to cross-compile
libpcap as well and add
-lpcap in the
That will not be too hard because there’s lots of tutorials and ready scripts to cross-compile
libpcap for Android.
Finally, cross-compile Wireshark and install it to
To make the process easier, you can also run the script that I made.
When I write this post, it has been seven months since my first successful attempt in cross-compiling the Wireshark libraries for Android. Back then I cross-compiled the Wireshark libraries for Android using Wireshark 2.0.1 version on Ubuntu 14.04. But honestly, I spent nearly three days compiling, haunted by various strange errors here and there. So I know how it would be useful to help save someone efforts worthing at least 10+ hours. I should have posted the detailed steps then, but I was so busy to do so. If I do not write it down now, many of the obstacles that I met and solutions I found online would have be forgotten. To ensure the documented steps are still working, I took the newest stable version of Wireshark which is 2.0.4, and re-built it on a clean installed Ubuntu 16.04 virtual machine. Now, I finally have found some time to document the detailed steps in this post. Hope it will be useful. Sincerely thanks to many of the helpful discussion threads in Wirshark-dev mailing lists, as well as other blog post on cross-compiling for Android.
-  https://en.wikipedia.org/wiki/Wireshark
-  https://www.wireshark.org
-  https://play.google.com/store/apps/details?id=lv.n3o.shark&hl=en
-  https://gist.github.com/nddrylliog/4688209
-  http://linux.die.net/man/3/endgrent
-  http://lists.mindrot.org/pipermail/openssh-bugs/2013-April/012015.html
-  https://bugzilla.mindrot.org/attachment.cgi?id=2233&action=edit
-  https://www.google.com/search?q=cross+compile+wireshark