Hello
On 05/22/2013 06:53 AM, frwa onto wrote:
> Hi All,
> I have recently installed PF_RING using the yum method. Then I
> just try out some edits on the original pfcount.c and tried to compile
> it. What I find here is that there is a must for -lpcap to be included
> when I need to compile whereas I just need the pf_ring to. Next thing
> after I include it then I tried to I got this error.
pfcount needs pcap, infact:
# grep pcap pfcount.c
#include <pcap/pcap.h>
#include <pcap/bpf.h>
if(pcap_compile_nopcap(caplen, /* snaplen_arg */
The correct gcc lines to compile pfcount are:
# gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins
-I../lib -I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2 -c
pfcount.c -o pfcount.o
# gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins
-I../lib -I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2
pfcount.o ../lib/libpfring.a -lpthread -lnl -L../libpcap -lpcap -lrt
-o pfcount
The PF_RING distribution has a pcap compatibility layer to allow fast
porting of old code based on the standard pcap lib (for example in the
source there is the porting of the well known tcpdump).
OT: You can found the PF_RING aware pcap code here:
/path/to/PFRING_source/userspace/libpcap-1.1
>
>
> gcc -o pf1 pfcount.c -lpfring -lrt -lpcap
I suspect you're linking the pf1 executable with the CentOS standard pcap.
PLs try to launch the ldconfig command, like this:
#ldconfig --verbose 2>&1 | grep pcap
libpcap.so.1 -> libpcap.so.1.1.1
libpcap.so.1 -> libpcap.so.1.2.1
If you get more then once line so there are more then one library on
your linked path and you have to solve this first, for example
to take precedence above the ld.so.conf [1] you can point the
LD_LIBRARY_PATH where "rpm" extracted the libraries e.g.
export LD_LIBRARY_PATH=/usr/local/lib
and then try to recompile your code again
> [root@localhost bin]# ./pf1
> ./pf1: error while loading shared libraries: libpfring.so: cannot open
> shared object file: No such file or directory
>
> The funny thing here I got into /usr/local/lib and just rename to the
> original libpfring.so to any other name it start to work.
sry I don;t understand what you're trying to do
The mentioned rpm install under /usr/local/lib
rpm -p -ql pfring-5.5.3-6280.x86_64.rpm
/etc/init.d/pf_ring
/etc/init/pf_ring.conf
/usr/local/bin/pfcount
/usr/local/bin/pfdnabounce
/usr/local/bin/pfdnacluster_master
/usr/local/bin/pfsend
/usr/local/include/linux/pf_ring.h
/usr/local/include/pfring.h
/usr/local/lib/daq/daq_pfring.so
/usr/local/lib/libpcap.a
/usr/local/lib/libpfring.a
/usr/local/lib/libpfring.so
/usr/local/lib/libsfbpf.so.0
/usr/local/lib/libsfbpf.so.0.0.1
/usr/local/pfring/README-DAQ.1st
/usr/local/pfring/README.FIRST
/usr/local/pfring/drivers/DNA/README.DNA
/usr/local/pfring/drivers/DNA/e1000e.ko
/usr/local/pfring/drivers/DNA/igb.ko
/usr/local/pfring/drivers/DNA/ixgbe.ko
/usr/local/pfring/kernel/pf_ring.ko
I do not know
> what bug is that and I have also done the setting for ld.so.conf to pick
> from /usr/local/lib . Why by renaming it works and also need to include
> lpcap when I dont need it.
>
>
I hope I've give you some tips but as always these are only my 2 cents
;) ...
-vito
[1]
http://stackoverflow.com/questions/1904990/what-is-the-difference-between-ld-library-path-and-l-at-link-time
>
>
> _______________________________________________
> Ntop-misc mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
