On Tue, Mar 19, 2013 at 01:07:32PM -0500, Ryan wrote:
> No go on that one either, I'm pretty well scratching my head over here. I'm
> going through and recompiling and reinstalling everything to make sure that it
> is all using the proper libpcap.
>
> Anything special I would need to do on exporting that environment variable? I
> just added it to /etc/profile and logged out and back in.
>
> Here's snort:
>
> # ldd `which snort`
> linux-vdso.so.1 => (0x00007fff015ff000)
> libdnet.1 => /usr/local/lib/libdnet.1 (0x00007f4dad6f6000)
> libpcre.so.0 => /lib64/libpcre.so.0 (0x00007f4dad4c4000)
> libnsl.so.1 => /lib64/libnsl.so.1 (0x00007f4dad2ab000)
> libm.so.6 => /lib64/libm.so.6 (0x00007f4dad027000)
> libdl.so.2 => /lib64/libdl.so.2 (0x00007f4dace22000)
> libsfbpf.so.0 => /usr/local/lib/libsfbpf.so.0 (0x00007f4dacbfd000)
> libpcap.so.1 => /usr/local/lib/libpcap.so.1 (0x00007f4dac9a8000)
> libz.so.1 => /lib64/libz.so.1 (0x00007f4dac791000)
> libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f4dac574000)
> libc.so.6 => /lib64/libc.so.6 (0x00007f4dac1e1000)
> /lib64/ld-linux-x86-64.so.2 (0x00007f4dad907000)
>
> The libpcap is the one compiled/installed out of the PF_RING/userland folder.
> I
> can't help but think it is something further down the chain since if I use the
> DNA based drivers I can see the traffic.
>
> RG
That's fine, the daq module is what should be linked against pf_ring:
# ldd /usr/local/lib/daq/daq_pfring.so
Or, if for some reason you aren't using the pf_ring daq:
# ldd /usr/local/lib/daq/daq_pcap.so
--
-- Justin Azoff
-- Network Security & Performance Analyst
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
