Installation

NetOtter is built from source with GCC and GNU make. There is one source tree for both systems.

Linux

Requirements

• GCC and GNU make
• OpenSSL's libcrypto and its headers (package openssl on Arch, libssl-dev on Debian and Ubuntu, openssl-devel on Fedora). It decrypts the QUIC Initial packets, see Hostname learning.

Build and install

make release   # optimised and hardened build
make install   # copies it to /usr/bin/netotter and gives it cap_net_raw

make install uses sudo, so it asks for your password. make uninstall removes the binary.

The capture permission

Capturing raw frames needs the cap_net_raw capability. make install sets it on /usr/bin/netotter, so you run netotter as your normal user.

To run a binary you built without installing it, give it the capability yourself:

sudo setcap cap_net_raw+ep ./netotter

Every rebuild removes the capability, so set it again after each build.

Don't run NetOtter with sudo. It parses data from the network, and it should do that with as few rights as possible. As root, it would also write its cache files into root's home folder instead of yours.

Without the capability, everything except the capture still works: you can open and filter .nto files.

Windows

Npcap

Live capture on Windows goes through Npcap. Install it before running NetOtter. NetOtter loads it when it starts, so without it NetOtter still runs: it shows no interface but opens .nto files.

In the Npcap installer, the option "Restrict Npcap driver's access to Administrators only" makes every capture fail with permission denied unless NetOtter runs as administrator. Leave it unchecked, or reinstall Npcap without it.

NetOtter doesn't include Npcap, because Npcap's license doesn't allow redistributing it.

Build

You need a 64-bit MinGW-w64 toolchain, ideally a UCRT one: WinLibs or MSYS2's UCRT64 environment. From cmd or PowerShell:

mingw32-make release

This gives NetOtter.exe, with the two DLLs it needs next to it (libcrypto-3-x64.dll and libssp-0.dll, both shipped in libs/windows/).

The old 32-bit MinGW.org toolchain (GCC 6.3) can't link them: it fails with "file not recognized".

You can also build the Windows version from Linux, with mingw-w64-gcc installed:

make windows-release

Install

Command	For	Where	Admin rights	PATH
mingw32-make install	you only	%LOCALAPPDATA%\Programs\NetOtter	no	unchanged: add the folder yourself
mingw32-make install-admin	every user	C:\Program Files\NetOtter	yes	the folder is added to the system PATH

Both copy NetOtter.exe, the two DLLs and the OpenSSL license. Run install-admin from an administrator prompt; from a normal prompt, it stops with a message. After install-admin, open a new terminal so it sees the new PATH.

To remove them, run mingw32-make uninstall or mingw32-make uninstall-admin. uninstall-admin also removes the folder from the system PATH.

Check the installation

netotter -v

NetOtter r1.03.00 (save format v17)

Next: Getting started.