Cross-Compiling or Building Android tcpdump?


There are multiple ways of building or compiling Android tcpdump. The one outlined below is the method we use to build the Android tcpdump binary that you will find in our downloads section. You can also try using the NDK from Google. The NDK uses a different set of libraries, tool-chains, and compile tools.

The tcpdump we offer in our downloads section was compiled with a method called Cross-Compiling. Cross-Compiling is a method of compiling one operating system binary on another operating system. In our instance we are cross-compiling the Android binary on an Ubuntu Linux system targeting the ARM architecture. Once the binary or program is created, it can only run on the targeted operating system. So the binary can only run on Android devices running on the ARM architecture.

Aside Note: The Architecture could be ARM, i386 or MIPS. The ARM architecture is used in 95% of the Androids in the market, so the binary you will find in our downloads is for the ARM architecture. Also, we only have access to devices with the ARM architecture, so we cannot confirm whether binaries compiled for other architectures will work. If you would like us to compile a binary for i386 or MIPS please let us know in our contact page so we can make appropriate arrangements.

Ubuntu Compile Tools

To install the compile tools and tool chains we used, execute the following on your Ubuntu Linux Server:

sudo apt-get install gcc-arm-linux-gnueabi
sudo apt-get install byacc
sudo apt-get install flex

Note: You only need to install the above mentioned compile tools once on your system.

Steps to Compile Android tcpdump

  1. Download the latest tcpdump source code from In this case, we will compile the latest version, tcpdump-4.99.0.
  2. wget
  3. Since tcpdump is dependent on the libpcap, we will need to download this as well. Download the latest libpcap source code from
  4. wget
  5. Extract the source code into the respective directories.
  6. tar zxvf tcpdump-4.99.0.tar.gz
    tar zxvf libpcap-1.10.0.tar.gz

  7. Export your compiler to point to the ARM Linux build tool. Note: These libraries may not be available by default on your linux operating system. You may need to "yum" or "apt-get" the appropriate building libraries or toolchains.
  8. export CC=arm-linux-gnueabi-gcc
  9. We need to compile the LIBPCAP first. Change your directory to where you extracted your LIBPCAP
  10. cd libpcap-1.10.0
  11. Execute the configure file which came with LIBPCAP with a few switches. The "--host=arm-linux" tells the compiler that we are cross compiling to ARM. The "--with-pcap=linux" will tell the compiler which packet capture type we are compiling.
  12. ./configure --host=arm-linux --with-pcap=linux
  13. Then execute the "make" command. This should create the libpcap library.
  14. make
  15. Now, change your directory to where you extracted your TCPDUMP file
  16. cd tcpdump-4.99.0
  17. We need to find out what major version our Ubuntu (or Linux) operation system kernel is running. Execute the uname -a command. Note: Your output may be different, but look for something which looks like a version number. Below, mine is 2.6.32-042stab094.8. We grab the first "2".
  18. uname -a

    The above command produced the following output:
    Linux androidtcpdump 2.6.32-042stab094.8 #1 SMP Tue Dec 16 20:36:56 MSK 2014 i686 i686 i686 GNU/Linux

  19. Set the ac_cv_linux_vers variable to the major number of your release Kernel version from the previous command.
  20. export ac_cs_linux_vers=2
  21. Export the following variables required for compiling. Since we want the executable to be self-contain (ie. not reliant on external libraries, we provide the following flags to build it statically.
  22. export CFLAGS=-static
    export CPPFLAGS=-static
    export LDFLAGS=-static

  23. Execute the configure file which came with TCPDUMP with a few switches. The "--host=arm-linux" is telling the compiler we are cross-compiling, and the "--disable-ipv6" to disable IP Version 6.
  24. ./configure --host=arm-linux --disable-ipv6
  25. Execute the "make" command. This will build the tcpdump binary.
  26. make
  27. Strip the symbol information to make the binary even smaller. These symbols are only useful in debugging the application.
  28. arm-linux-gnueabi-strip tcpdump
  29. Done. Your finished binary should be in your tcpdump directory.

All-In-One Script

Below are all the steps listed above in an easy script. You only need to change the versioning information and perhaps your linux Kernel version in the "ac_cv_linux_vers" variable

export TCPDUMP=4.99.0
export LIBPCAP=1.10.0


tar zxvf tcpdump-$TCPDUMP.tar.gz
tar zxvf libpcap-$LIBPCAP.tar.gz
export CC=arm-linux-gnueabi-gcc
cd libpcap-$LIBPCAP
./configure --host=arm-linux --with-pcap=linux
cd ..

cd tcpdump-$TCPDUMP
export ac_cv_linux_vers=2
export CFLAGS=-static
export CPPFLAGS=-static
export LDFLAGS=-static

./configure --host=arm-linux --disable-ipv6

arm-linux-gnueabi-strip tcpdump

You're Done.

Now you have the instructions we use to build android tcpdump. But there are alternatives to compiling/building. If you do not have access to a Linux system, or ran into difficulties compiling, you can always just download the latest version from our Downloads area. It is just that easy.