Hi Vito,
Let me first thank you a lot you have been helping me a lot since
these few days and appreciate it.
1.
Ok I was then compiling it the wrong way. Why it need to be so complicated
? Isnt the libraries should be linked automatically. So what I did I tried
the first command as below and I just chance the output to pfcount11. Since
this already giving error I could not run the second command and still
confuse why need these 2 command. Ok let me tell you what I plan is to
purely use pf_ring to capture packets at wire speed as it suppose to do. So
for that how should I work around with out the legacy pcap ?
gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins
-I../lib I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2 -c
pfcount.c -o pfcount11.o
gcc: I../libpcap-1.1.1-ring: No such file or directory
pfcount.c:48:23: error: pcap/pcap.h: No such file or directory
pfcount.c:49:22: error: pcap/bpf.h: No such file or directory
In file included from pfcount.c:53:
/usr/local/include/pfring.h:438:25: error: pfring_zero.h: No such file or
directory
pfcount.c: In function ‘parse_bpf_filter’:
pfcount.c:370: warning: implicit declaration of function
‘pcap_compile_nopcap’
pfcount.c:371: error: ‘DLT_EN10MB’ undeclared (first use in this function)
pfcount.c:371: error: (Each undeclared identifier is reported only once
pfcount.c:371: error: for each function it appears in.)
pfcount.c:380: error: invalid use of undefined type ‘struct bpf_program’
pfcount.c: In function ‘dummyProcesssPacket’:
pfcount.c:398: warning: implicit declaration of function ‘bpf_filter’
pfcount.c:398: error: invalid use of undefined type ‘struct bpf_program’
2. Below is the results of the command
ldconfig --verbose 2>&1 | grep pcap
libpcap.so.1 -> libpcap.so.1.0.0
actually I did the ld command by myself and what is it actually to
globally reference the library folder rite?
So in mycase what should I be doing ya ? Anything I dont think so I need
anything rite? How to check if its reference to kernel pcap library?
3. Mine rpm show this and miised 5.5.3-6269
rpm -p -ql pfring-5.5.3-6269.x86_64.rpm
/etc/init.d/pf_ring
/etc/init/pf_ring.conf
/usr/local/bin/pfcount
/usr/local/bin/pfdnabounce
/usr/local/bin/pfdnacluster_master
/usr/local/bin/pfsend
/usr/local/include/linux/pf_ring.h
/usr/local/include/pfring.h
/usr/local/lib/daq/daq_pfring.so
/usr/local/lib/libpcap.a
/usr/local/lib/libpfring.a
/usr/local/lib/libpfring.so
/usr/local/lib/libsfbpf.so.0
/usr/local/lib/libsfbpf.so.0.0.1
/usr/local/pfring/README-DAQ.1st
/usr/local/pfring/README.FIRST
/usr/local/pfring/drivers/DNA/README.DNA
/usr/local/pfring/drivers/DNA/e1000e.ko
/usr/local/pfring/drivers/DNA/igb.ko
/usr/local/pfring/drivers/DNA/ixgbe.ko
/usr/local/pfring/kernel/pf_ring.ko
4. Regarding the funny thing is that I change the name of this library from
libpfring.so to say libpfring_ori.so then I recompile using my old method
it start work.
Thank you and hope to hear from you.
On Wed, May 22, 2013 at 2:43 AM, [email protected]
<[email protected]>wrote:
> Hello
> On 05/22/2013 06:53 AM, frwa onto wrote:
> > Hi All,
> > I have recently installed PF_RING using the yum method. Then I
> > just try out some edits on the original pfcount.c and tried to compile
> > it. What I find here is that there is a must for -lpcap to be included
> > when I need to compile whereas I just need the pf_ring to. Next thing
> > after I include it then I tried to I got this error.
>
>
> pfcount needs pcap, infact:
>
> # grep pcap pfcount.c
> #include <pcap/pcap.h>
> #include <pcap/bpf.h>
> if(pcap_compile_nopcap(caplen, /* snaplen_arg */
>
>
> The correct gcc lines to compile pfcount are:
>
> # gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins
> -I../lib -I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2 -c
> pfcount.c -o pfcount.o
>
> # gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins
> -I../lib -I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2
> pfcount.o ../lib/libpfring.a -lpthread -lnl -L../libpcap -lpcap -lrt
> -o pfcount
>
>
> The PF_RING distribution has a pcap compatibility layer to allow fast
> porting of old code based on the standard pcap lib (for example in the
> source there is the porting of the well known tcpdump).
>
> OT: You can found the PF_RING aware pcap code here:
> /path/to/PFRING_source/userspace/libpcap-1.1
>
> >
> >
> > gcc -o pf1 pfcount.c -lpfring -lrt -lpcap
>
> I suspect you're linking the pf1 executable with the CentOS standard pcap.
>
> PLs try to launch the ldconfig command, like this:
>
> #ldconfig --verbose 2>&1 | grep pcap
> libpcap.so.1 -> libpcap.so.1.1.1
> libpcap.so.1 -> libpcap.so.1.2.1
>
> If you get more then once line so there are more then one library on
> your linked path and you have to solve this first, for example
> to take precedence above the ld.so.conf [1] you can point the
> LD_LIBRARY_PATH where "rpm" extracted the libraries e.g.
>
> export LD_LIBRARY_PATH=/usr/local/lib
>
> and then try to recompile your code again
>
>
> > [root@localhost bin]# ./pf1
> > ./pf1: error while loading shared libraries: libpfring.so: cannot open
> > shared object file: No such file or directory
> >
> > The funny thing here I got into /usr/local/lib and just rename to the
> > original libpfring.so to any other name it start to work.
>
> sry I don;t understand what you're trying to do
>
> The mentioned rpm install under /usr/local/lib
>
> rpm -p -ql pfring-5.5.3-6280.x86_64.rpm
> /etc/init.d/pf_ring
> /etc/init/pf_ring.conf
> /usr/local/bin/pfcount
> /usr/local/bin/pfdnabounce
> /usr/local/bin/pfdnacluster_master
> /usr/local/bin/pfsend
> /usr/local/include/linux/pf_ring.h
> /usr/local/include/pfring.h
> /usr/local/lib/daq/daq_pfring.so
> /usr/local/lib/libpcap.a
> /usr/local/lib/libpfring.a
> /usr/local/lib/libpfring.so
> /usr/local/lib/libsfbpf.so.0
> /usr/local/lib/libsfbpf.so.0.0.1
> /usr/local/pfring/README-DAQ.1st
> /usr/local/pfring/README.FIRST
> /usr/local/pfring/drivers/DNA/README.DNA
> /usr/local/pfring/drivers/DNA/e1000e.ko
> /usr/local/pfring/drivers/DNA/igb.ko
> /usr/local/pfring/drivers/DNA/ixgbe.ko
> /usr/local/pfring/kernel/pf_ring.ko
>
> I do not know
> > what bug is that and I have also done the setting for ld.so.conf to pick
> > from /usr/local/lib . Why by renaming it works and also need to include
> > lpcap when I dont need it.
> >
> >
>
> I hope I've give you some tips but as always these are only my 2 cents
> ;) ...
>
> -vito
>
>
> [1]
>
> http://stackoverflow.com/questions/1904990/what-is-the-difference-between-ld-library-path-and-l-at-link-time
> >
> >
> > _______________________________________________
> > Ntop-misc mailing list
> > [email protected]
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> >
>
> _______________________________________________
> Ntop-misc mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
