How To Install Ethereal Packet Sniffer on OS X with Open Darwin and Ports

If you've been reading Jack's other posts, you will see that Jack has caught a little bit of the OS X bug. (Jack's friends are hoping he gets better soon).

One of my favorite network utilities for Windows and Linux is Ethereal, an Open Source (Freeware) network packet sniffer used for capturing network traffic for analysis. Since OS X is based on a derivation of Darwin, there had to be a version of Ethereal for OS X. I popped over to the Ethereal website and sure enough, there were links to installing Ethereal for OS X using either Fink or Darwin Ports over at the OpenDarwin project.

"Ports" appealed to me over "Fink" because of the closeness to BSD Ports, which is the idea behind the whole Darwin Ports project.

OK - So I need to install Darwin Ports. Jack decides to take his own advice and RTFM (Read the FINE Manual) before installing it.

Hmmmm. What do we need. Jack's Powerbook G4 - 17 is equipped with Panther, but Jack doesn't have the original Panther install disks. That's OK, I'm sure I can find everything online.

First I need to open up a Terminal. Done. (It's in the Applications/Utilities folder)

Now we need to use CVS, which allows you to install a program by downloading the latest code (you 'check it out') and compiling it on your computer.

So I issue the appropriate command and get the "CVS not found" error. Oops. Going to have to install it. Maybe Jack didn't RTFM close enough.

I need to get Xcode, which contains CVS, so I head over to Apple's Developer Website and go through the sign-up process (it's free for the lowest level), head to the download section. Download xCode 1.2 and install it.

Whee!

OK - Now I follow the instructions (RTFM) at opendarwin and do an install of Darwin Ports by issuing the following commands (in order):

% cd ~/
% cvs -d :pserver:anonymous@anoncvs.opendarwin.org:/Volumes/src/cvs/od login
% cvs -d :pserver:anonymous@anoncvs.opendarwin.org:/Volumes/src/cvs/od co -P darwinports

OK - Being the Linux Guru (NOT!) I am, I know we aren't done. We just have the code downloaded. Now it's time to compile. (Besides, the FINE MANUAL tells us this in the next step!)

% ./configure
% make
% sudo make install

The last command will ask you for your USER password (not the ROOT password of OS X, which is normally locked). Things will scroll by for a while after each command, so be patient. After you are done, Voila! - Darwin Ports is installed.

OK - Almost.

You need to add /opt/local/bin to your PATH. This is where "Ports" is installed, and unless you want to cd /opt/local/bin before you issue your ports command, you need to add this path to your BASH profile (The Panther Default Shell).

Be sure you are in your /Users/Username directory, in Jack's case this is /Users/jack and issue the following command:

vi .profile

This will open the VI text editor and allow you to edit your hidden (the "." at the beginning of the filename means its a hidden file) BASH profile. Hopefully yours like Jack's is empty.

Press "I" to enter insert mode and type the following on the first line (with the EXACT case here):

export PATH=$PATH:/opt/local/bin

Then press the following keys: [esc-key]:wq

This writes the file (changes) and quits vi.

Unless you want to quit and restart terminal, you'll have to issue the command to add the path to your current path. Just type "export PATH=$PATH:/opt/local/bin" (without the quotes) on the terminal line.

Type: cat $PATH (remember, it is CASE SENSITIVE) to confirm /opt/local/bin is in your path.

Whew.

OK, now to install Ethereal. YAY!!!!

It's easy, just type: sudo port install ethereal

Now you will have to wait a looooong time, as port will go out to the opendarwin server, and download all the dependent programs as well as Ethereal itself. You can type 'sudo port deps ethereal' (without quotes) before you start to see what other programs have to be installed. Several of those programs have dependencies as well.

After you've had breakfast/lunch/dinner - depending on your internet connection speed and how fast your Mac is, ethereal will be installed. Yeehaw!

Now as long as you have put in the PATH I have indicated, you can type 'ethereal' (without quotes) at the command line, and you will see.....

"Gtk-WARNING **: cannot open display:"

Now this really pisses me off to no end!

SIGH. GRUMBLE. KICK GROUND. BEAT MAC.

WTF? Now what? Time to do some Googling. Jack googles for a while and finds not much information, because Jack is getting to be too impatient to dig 10 pages deep in google's results.

So a few days go by, I try uninstalling and reinstalling ethereal. Still no luck.

I'm surfing around, and find MacOSXHints, a WONDERFUL website for OS X newbies like me!

There's several articles about Ethereal, and all Mention X11. Well, isn't that what OS X already uses???

Of course, Jack finds out the answer is NOOOOOOOOOOOOOOOOOOOOOOOOO!!!!

So, over to Apple's X11 page and download and install X11, which allows for Unix-like (read Darwin) programs to be run. Yay!

After it downloads and I install it, there's a new Icon in my Applications/Utilities Folder. "X11"!!! I add it to the Dock, and click on it, to find that yes, I have a new XTERM window!

Here we go, I carefully check my path (cat $PATH), yup, /opt/local/bin is there. Now type 'ethereal' (without the quotes, of course) and Woo-Hoo! Ethereal is running.

BTW - If you have a Powerbook G4 or other Airport equipped Mac, en0 is the onboard wired ethernet adapter, and en1 is the Airport wireless.

Happy sniffing!

UPDATE: If you want to locate some wireless networks, you can download MacStumbler, but be forewarned, it cannot put the AirPort card into "Monitor" mode on the Mac, so you can't find networks that aren't broadcasting SSID's. This means no AirSnort for OS X either.

UPDATE2: Note that when you start X11's XTerm, to get all the features of Ethereal, you'll have to start it by typing 'sudo ethereal' (without the quotes) and enter your user password. If you want to run it as root by su'ing, you'll have to type 'xhost +' (without the quotes) to allow any user to use X-Windows, then you su, then you can run ethereal if you have the proper pathing.

UPDATE3: Keep your Darwin Ports up to date with the latest available programs. First you must login to CVS as listed above (Just do the first command, not the second.), and issue the following commands:

% cd ~/darwinports/dports

% sudo cvs -q -z3 update -dP