Good Morning if you are using the rpm package you have to point the gcc option where the pfring header/lib files are (I think /usr/local/lib, /usr/local/include)
Then install also the libpcap-dev rpm package: yum install libpcap-dev -y On 05/24/2013 04:52 AM, frwa onto wrote: > Hi Vito, > This round I have checked every - and still below is the > results. Thank you for your help man. > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins > -I../lib -I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2 -c > pfcount.c -o pfcount1.o > pfcount.c:48:23: error: pcap/pcap.h: No such file or directory > pfcount.c:49:22: error: pcap/bpf.h: No such file or directory > In file included from pfcount.c:53: > /usr/local/include/pfring.h:438:25: error: pfring_zero.h: No such file > or directory I have checked this file in the rpm pkg and it is not present (because it needs a license). Two possibilities: 1) compile without the LIBZERO support: gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins -I../lib -I../libpcap-1.1.1-ring -D ENABLE_BPF -O2 -c pfcount.c -o pfcount1.o btw if you don;t need the BPF filters, also remove the "-D ENABLE_BPF" clause 2) compile everything from sources, and read very very carefully the various READMEs present in the distribution... br vito > pfcount.c: In function ‘parse_bpf_filter’: > pfcount.c:370: warning: implicit declaration of function > ‘pcap_compile_nopcap’ > pfcount.c:371: error: ‘DLT_EN10MB’ undeclared (first use in this function) > pfcount.c:371: error: (Each undeclared identifier is reported only once > pfcount.c:371: error: for each function it appears in.) > pfcount.c:380: error: invalid use of undefined type ‘struct bpf_program’ > pfcount.c: In function ‘dummyProcesssPacket’: > pfcount.c:398: warning: implicit declaration of function ‘bpf_filter’ > pfcount.c:398: error: invalid use of undefined type ‘struct bpf_program’ > > > > On Thu, May 23, 2013 at 3:31 AM, [email protected] > <mailto:[email protected]> <[email protected] > <mailto:[email protected]>> wrote: > > On 05/23/2013 03:57 AM, frwa onto wrote: > > Hi Vito, > > I end up this problem now > > > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins > > -I../lib I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2 -c > > pfcount.c -o pfcount11.o > > gcc: I../libpcap-1.1.1-ring: No such file or directory > > again you missed the minus in front of this option: > "I../libpcap-1.1.1-ring" should be "-I../libpcap-1.1.1-ring" > > > regards > vito > > > pfcount.c:48:23: error: pcap/pcap.h: No such file or directory > > pfcount.c:49:22: error: pcap/bpf.h: No such file or directory > > In file included from pfcount.c:53: > > /usr/local/include/pfring.h:438:25: error: pfring_zero.h: No such file > > or directory > > pfcount.c: In function ‘parse_bpf_filter’: > > pfcount.c:370: warning: implicit declaration of function > > ‘pcap_compile_nopcap’ > > pfcount.c:371: error: ‘DLT_EN10MB’ undeclared (first use in this > function) > > pfcount.c:371: error: (Each undeclared identifier is reported only > once > > pfcount.c:371: error: for each function it appears in.) > > pfcount.c:380: error: invalid use of undefined type ‘struct > bpf_program’ > > pfcount.c: In function ‘dummyProcesssPacket’: > > pfcount.c:398: warning: implicit declaration of function ‘bpf_filter’ > > pfcount.c:398: error: invalid use of undefined type ‘struct > bpf_program’ > > > > > > On Wed, May 22, 2013 at 9:34 AM, [email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>> > <[email protected] <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> wrote: > > > > Hello > > On 05/22/2013 09:50 AM, frwa onto wrote: > > > Hi Vito, > > > Let me first thank you a lot you have been helping > me a lot > > > since these few days and appreciate it. > > > > np, you're welcome > > > > > 1. > > > Ok I was then compiling it the wrong way. Why it need to be so > > > complicated ? Isnt the libraries should be linked automatically. > > > > yes but you have to setup the write include/lib path because > the pfring > > aware ones overlap the one that came with the OS... > > > > >So > > > what I did I tried the first command as below and I just > chance the > > > output to pfcount11. Since this already giving error I could not > > run the > > > second command and still confuse why need these 2 command. > Ok let me > > > tell you what I plan is to purely use pf_ring to capture packets > > at wire > > > speed as it suppose to do. So for that how should I work around > > with out > > > the legacy pcap ? > > > > > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel > -I../../kernel/plugins > > > -I../lib I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF > -O2 -c > > > pfcount.c -o pfcount11.o > > > > > > missing the minus? > > > > I../libpcap-1.1.1-ring --> -I../libpcap-1.1.1-ring > > > > let me know if it helps > > > > ciao > > -v > > _______________________________________________ > > Ntop-misc mailing list > > [email protected] > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > > > > > > _______________________________________________ > > Ntop-misc mailing list > > [email protected] <mailto:[email protected]> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
