Hi Vito,
Good evening. Yes I am using the rpm package. As you are aware
Centos is a package distribution and building via source can cause
stability problem in future when it needs to do updates etc. Ok futher to
all those linking
1. -I../../kernel this on is in /usr/local/pfring/kernel
2. -I../../kernel/plugins this one does not exist in my kernel folder only
available is pf_ring.ko
3. -I../lib this is on /usr/local/lib
4 -I../libpcap-1.1.1-ring this is also not available either.
What does the BPF filters represent here ?
I tried to install
yum install libpcap-dev -y
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
* base: centos.ipserverone.com
* epel: mirrors.ustc.edu.cn
* extras: centos.ipserverone.com
* updates: centos.ipserverone.com
Setting up Install Process
No package libpcap-dev available.
Error: Nothing to do
Just to let you know this is a clean Centos 6.4 machine and just installed
with pf_ring only so there is nothing it except for pf_ring. Thank you once
agan.
On Fri, May 24, 2013 at 2:06 AM, [email protected]
<[email protected]>wrote:
> Good Morning
>
> if you are using the rpm package you have to point the gcc option where
> the pfring header/lib files are (I think /usr/local/lib,
> /usr/local/include)
>
> Then install also the libpcap-dev rpm package:
>
> yum install libpcap-dev -y
>
>
> On 05/24/2013 04:52 AM, frwa onto wrote:
> > Hi Vito,
> > This round I have checked every - and still below is the
> > results. Thank you for your help man.
> > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins
> > -I../lib -I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2 -c
> > pfcount.c -o pfcount1.o
> > pfcount.c:48:23: error: pcap/pcap.h: No such file or directory
> > pfcount.c:49:22: error: pcap/bpf.h: No such file or directory
> > In file included from pfcount.c:53:
> > /usr/local/include/pfring.h:438:25: error: pfring_zero.h: No such file
> > or directory
>
> I have checked this file in the rpm pkg and it is not present (because
> it needs a license).
>
> Two possibilities:
>
> 1) compile without the LIBZERO support:
>
> gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel -I../../kernel/plugins
> -I../lib -I../libpcap-1.1.1-ring -D ENABLE_BPF -O2 -c pfcount.c -o
> pfcount1.o
>
> btw if you don;t need the BPF filters, also remove the "-D ENABLE_BPF"
> clause
>
> 2) compile everything from sources, and read very very carefully the
> various READMEs present in the distribution...
>
>
> br
> vito
>
>
> > pfcount.c: In function ‘parse_bpf_filter’:
> > pfcount.c:370: warning: implicit declaration of function
> > ‘pcap_compile_nopcap’
> > pfcount.c:371: error: ‘DLT_EN10MB’ undeclared (first use in this
> function)
> > pfcount.c:371: error: (Each undeclared identifier is reported only once
> > pfcount.c:371: error: for each function it appears in.)
> > pfcount.c:380: error: invalid use of undefined type ‘struct bpf_program’
> > pfcount.c: In function ‘dummyProcesssPacket’:
> > pfcount.c:398: warning: implicit declaration of function ‘bpf_filter’
> > pfcount.c:398: error: invalid use of undefined type ‘struct bpf_program’
> >
> >
> >
> > On Thu, May 23, 2013 at 3:31 AM, [email protected]
> > <mailto:[email protected]> <[email protected]
> > <mailto:[email protected]>> wrote:
> >
> > On 05/23/2013 03:57 AM, frwa onto wrote:
> > > Hi Vito,
> > > I end up this problem now
> > >
> > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel
> -I../../kernel/plugins
> > > -I../lib I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF -O2 -c
> > > pfcount.c -o pfcount11.o
> > > gcc: I../libpcap-1.1.1-ring: No such file or directory
> >
> > again you missed the minus in front of this option:
> > "I../libpcap-1.1.1-ring" should be "-I../libpcap-1.1.1-ring"
> >
> >
> > regards
> > vito
> >
> > > pfcount.c:48:23: error: pcap/pcap.h: No such file or directory
> > > pfcount.c:49:22: error: pcap/bpf.h: No such file or directory
> > > In file included from pfcount.c:53:
> > > /usr/local/include/pfring.h:438:25: error: pfring_zero.h: No such
> file
> > > or directory
> > > pfcount.c: In function ‘parse_bpf_filter’:
> > > pfcount.c:370: warning: implicit declaration of function
> > > ‘pcap_compile_nopcap’
> > > pfcount.c:371: error: ‘DLT_EN10MB’ undeclared (first use in this
> > function)
> > > pfcount.c:371: error: (Each undeclared identifier is reported only
> > once
> > > pfcount.c:371: error: for each function it appears in.)
> > > pfcount.c:380: error: invalid use of undefined type ‘struct
> > bpf_program’
> > > pfcount.c: In function ‘dummyProcesssPacket’:
> > > pfcount.c:398: warning: implicit declaration of function
> ‘bpf_filter’
> > > pfcount.c:398: error: invalid use of undefined type ‘struct
> > bpf_program’
> > >
> > >
> > > On Wed, May 22, 2013 at 9:34 AM, [email protected]
> > <mailto:[email protected]>
> > > <mailto:[email protected] <mailto:[email protected]>>
> > <[email protected] <mailto:[email protected]>
> > > <mailto:[email protected] <mailto:[email protected]>>>
> wrote:
> > >
> > > Hello
> > > On 05/22/2013 09:50 AM, frwa onto wrote:
> > > > Hi Vito,
> > > > Let me first thank you a lot you have been helping
> > me a lot
> > > > since these few days and appreciate it.
> > >
> > > np, you're welcome
> > >
> > > > 1.
> > > > Ok I was then compiling it the wrong way. Why it need to be
> so
> > > > complicated ? Isnt the libraries should be linked
> automatically.
> > >
> > > yes but you have to setup the write include/lib path because
> > the pfring
> > > aware ones overlap the one that came with the OS...
> > >
> > > >So
> > > > what I did I tried the first command as below and I just
> > chance the
> > > > output to pfcount11. Since this already giving error I could
> not
> > > run the
> > > > second command and still confuse why need these 2 command.
> > Ok let me
> > > > tell you what I plan is to purely use pf_ring to capture
> packets
> > > at wire
> > > > speed as it suppose to do. So for that how should I work
> around
> > > with out
> > > > the legacy pcap ?
> > > >
> > > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel
> > -I../../kernel/plugins
> > > > -I../lib I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF
> > -O2 -c
> > > > pfcount.c -o pfcount11.o
> > >
> > >
> > > missing the minus?
> > >
> > > I../libpcap-1.1.1-ring --> -I../libpcap-1.1.1-ring
> > >
> > > let me know if it helps
> > >
> > > ciao
> > > -v
> > > _______________________________________________
> > > Ntop-misc mailing list
> > > [email protected]
> > <mailto:[email protected]>
> > <mailto:[email protected]
> > <mailto:[email protected]>>
> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > Ntop-misc mailing list
> > > [email protected] <mailto:
> [email protected]>
> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> > >
> >
> > _______________________________________________
> > Ntop-misc mailing list
> > [email protected] <mailto:
> [email protected]>
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> >
> >
> >
> >
> > _______________________________________________
> > Ntop-misc mailing list
> > [email protected]
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> >
>
> _______________________________________________
> Ntop-misc mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
