This is our old Q&A Site. Please post any new questions and answers at


This must be a "duh!" question to some, but not me.

I built Wireshark from source (from nightly builds) in Ubuntu 12.04. Now I want to get the latest source and rebuild. Do I need to remove the old version? And if I do, what's the best way to do it? (I saw that if I simply installing from Wireshark binaries from nightly build to nightly build, I don't need to remove the older version)

Here is the steps I took in building from source the first time, which may help answer my question a bit, and please give suggestions if you see any steps not done in the optimal way.

  1. Download source
  2. Unpack and move the unpacked directory into home directory.
  3. Change into that directory
  4. Repeatedly do ./configure to figure out what dependent software is not installed and install them.
  5. finally do ./configure —with-lua (since I need Lua)
  6. make
  7. make install

I totally didn't do the step, which I will do this time before ./configure. (Wireshark still worked without this step though).

When I tried to launch Wireshark for the first time after compiling, I got an error saying cannot open. Apparently "sudo ldconfig" command fixed it, but I'm not sure if this is a hack fix. This error probably won't happen if I compiled the source better, or put them in different directories.


asked 11 Apr '14, 09:01

YXI's gravatar image

accept rate: 0%

Assuming you are downloading an archive of the sources and then expanding it over the top of an existing source tree, then it is best to do the complete re-compile dance.

You may want to look into getting the source via git. This also allows you to track any changes you might make, and pull in any other changes posted elsewhere, e.g. Wireshark Gerrit. Look at the Developers Guide for more info on obtaining the source code.

You might also consider building using CMake, as that does "out-of-tree" builds, i.e. the object files and libraries are compiled in a separate directory from the sources. See README.cmake in the source docs directoyr.

permanent link

answered 11 Apr '14, 09:20

grahamb's gravatar image

grahamb ♦
accept rate: 22%

edited 11 Apr '14, 09:21

OK, you are dragging me toward the developer's side. I want to just stay on the user side, at least for now. : o ) If I do rebuild all the time, obviously it's much easier to use git and get the newest code and compile. But I don't think I will be rebuilding that often (hopefully), and so far I'm happy downloading source from:, which has everything.
I guess my question is (for a lazy bum), can I just redownlaod from this link and recompile? Is it best to remove the earlier version first? If so, before removing the whole folder, do I need to do anything else, like make uninstall? I guess this is more a Linux question than a Wireshark question, but I think I will get a better answer here.

(11 Apr '14, 14:47) YXI

If you've installed then it's best to uninstall, hopefully that will remove all traces of the previous installation so that your brand new compilation won't pick up old shared libraries, e.g. plugins.

You might not run into any such issues, but probably best to be hygienic with the file system.

(12 Apr '14, 03:04) grahamb ♦

Just did a "sudo make uninstall" in the source directory and all Wireshark related libraries are gone.
This should probably be added to the official INSTALL file in the distribution source tarball.

(14 Apr '14, 12:34) YXI
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 11 Apr '14, 09:01

question was seen: 2,892 times

last updated: 14 Apr '14, 12:34

p​o​w​e​r​e​d by O​S​Q​A