I have successfully installed wireshark on centos 6.4 I can run the command tshark it works perfectly fine. I want to run gdb so that I want to learn how it decodes tcp and udp packet as I am writing an application where I need to dissect these two types of packets. When I run libtool --mode=execute gdb tshark it run and stop at here (gdb) it not capturing anything.
Gdb doesn't automatically run the executable for you, it just loads it. This way you can set things up (e.g. breakpoints) as you wish first.
The "run" command at the
(gdb) prompt will start execution. This also allows you to specify command-line arguments to tshark, eg:
(gdb) run -i lo
Will run tshark the same way
tshark -i lo would.
Keep in mind that Wireshark and its suite of related tools (mergecap, TShark, etc.) are all open-source. Perhaps you'll find it easier to read the source, as opposed to stepping through disassembly?
The TShark application in particular is a single C source file (
tshark.c) in the Wireshark source code distribution, which can be downloaded here: