On 05/24/2013 05:06 PM, frwa onto wrote: > Hi Vito, > Sorry I did google for the libpcap and that is where I found > the previous link which I sent you. Ok I changed according to your last > advice > > gcc -O2 -DHAVE_PF_RING -Wall -I /usr/local/pfring/kernel -I > /usr/local/lib -D HAVE_ZERO -O2 -c pfcount.c -o pfcount1.o > In file included from pfcount.c:53: > /usr/local/include/pfring.h:438:25: error: pfring_zero.h: No such file > or directory > Already in a previous mail I've suggested you to remove this option: -D HAVE_ZERO since it comes only with the sources. as it needs a licence
let me know if this worked at last vito > So I look into now pfring.h and it has an include for #include > <linux/pf_ring.h> > and I checked this folder /usr/local/include/linux and it have this file > pf_ring.h. Just to confirm must I still yum install libpcap-dev ? What > is the functionality of this ENABLE_BPF is it linked to libpcap? Thank you. > > > > > On Fri, May 24, 2013 at 9:48 AM, [email protected] > <mailto:[email protected]> <[email protected] > <mailto:[email protected]>> wrote: > > On 05/24/2013 02:50 PM, frwa onto wrote: > > Hi Vito, > > Good evening. Yes I am using the rpm package. As you are > aware > > Centos is a package distribution and building via source can cause > > stability problem in future when it needs to do updates etc. Ok futher > > to all those linking > > > > 1. -I../../kernel this on is in /usr/local/pfring/kernel > ok > > 2. -I../../kernel/plugins this one does not exist in my kernel folder > > only available is pf_ring.ko > you don't need this > > 3. -I../lib this is on /usr/local/lib > ok > > 4 -I../libpcap-1.1.1-ring this is also not available either. > this came with the sources! if you don't need it just remove the > > -D ENABLE_BPF in the gcc line > > > > > What does the BPF filters represent here ? > > > > I tried to install > > yum install libpcap-dev -y > > Loaded plugins: fastestmirror, refresh-packagekit, security > > Loading mirror speeds from cached hostfile > > * base: centos.ipserverone.com <http://centos.ipserverone.com> > <http://centos.ipserverone.com> > > * epel: mirrors.ustc.edu.cn <http://mirrors.ustc.edu.cn> > <http://mirrors.ustc.edu.cn> > > * extras: centos.ipserverone.com <http://centos.ipserverone.com> > <http://centos.ipserverone.com> > > * updates: centos.ipserverone.com <http://centos.ipserverone.com> > <http://centos.ipserverone.com> > > Setting up Install Process > > No package libpcap-dev available. > > Error: Nothing to do > > yes I was wrong, it's the name in debian pkt. in the RPM word the > development pkgs are always ended with -devel > > Next time I would suggest you to > > 1) google a bit... > > 2( search the correct pkg via the Centos standard tool , that is YUM: > > yum search libpcap-dev > Loaded plugins: auto-update-debuginfo, changelog, downloadonly, > fastestmirror, refresh-packagekit, security > Loading mirror speeds from cached hostfile > > .... > .... > > > ======================================================================================================================== > N/S Matched: libpcap-dev > > ========================================================================================================================= > *libpcap-devel.i686* : Libraries and header files for the libpcap > library > *libpcap-devel.x86_64* : Libraries and header files for the libpcap > library > > so the name is libpcap-devel -> yum install libpcap-devel > > regards > vito > > ... > > > > > > > Just to let you know this is a clean Centos 6.4 machine and just > > installed with pf_ring only so there is nothing it except for pf_ring. > > Thank you once agan. > > > > > > On Fri, May 24, 2013 at 2:06 AM, [email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>> > <[email protected] <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>>> wrote: > > > > Good Morning > > > > if you are using the rpm package you have to point the gcc > option where > > the pfring header/lib files are (I think /usr/local/lib, > > /usr/local/include) > > > > Then install also the libpcap-dev rpm package: > > > > yum install libpcap-dev -y > > > > > > On 05/24/2013 04:52 AM, frwa onto wrote: > > > Hi Vito, > > > This round I have checked every - and still below > is the > > > results. Thank you for your help man. > > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel > -I../../kernel/plugins > > > -I../lib -I../libpcap-1.1.1-ring -D HAVE_ZERO -D ENABLE_BPF > -O2 -c > > > pfcount.c -o pfcount1.o > > > pfcount.c:48:23: error: pcap/pcap.h: No such file or directory > > > pfcount.c:49:22: error: pcap/bpf.h: No such file or directory > > > In file included from pfcount.c:53: > > > /usr/local/include/pfring.h:438:25: error: pfring_zero.h: No > such file > > > or directory > > > > I have checked this file in the rpm pkg and it is not present > (because > > it needs a license). > > > > Two possibilities: > > > > 1) compile without the LIBZERO support: > > > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel > -I../../kernel/plugins > > -I../lib -I../libpcap-1.1.1-ring -D ENABLE_BPF -O2 -c > pfcount.c -o > > pfcount1.o > > > > btw if you don;t need the BPF filters, also remove the "-D > ENABLE_BPF" > > clause > > > > 2) compile everything from sources, and read very very > carefully the > > various READMEs present in the distribution... > > > > > > br > > vito > > > > > > > pfcount.c: In function ‘parse_bpf_filter’: > > > pfcount.c:370: warning: implicit declaration of function > > > ‘pcap_compile_nopcap’ > > > pfcount.c:371: error: ‘DLT_EN10MB’ undeclared (first use in this > > function) > > > pfcount.c:371: error: (Each undeclared identifier is > reported only > > once > > > pfcount.c:371: error: for each function it appears in.) > > > pfcount.c:380: error: invalid use of undefined type ‘struct > > bpf_program’ > > > pfcount.c: In function ‘dummyProcesssPacket’: > > > pfcount.c:398: warning: implicit declaration of function > ‘bpf_filter’ > > > pfcount.c:398: error: invalid use of undefined type ‘struct > > bpf_program’ > > > > > > > > > > > > On Thu, May 23, 2013 at 3:31 AM, [email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>> > > > <mailto:[email protected] <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>>> > > <[email protected] <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>> > > > <mailto:[email protected] <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>>>> wrote: > > > > > > On 05/23/2013 03:57 AM, frwa onto wrote: > > > > Hi Vito, > > > > I end up this problem now > > > > > > > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel > > -I../../kernel/plugins > > > > -I../lib I../libpcap-1.1.1-ring -D HAVE_ZERO -D > ENABLE_BPF > > -O2 -c > > > > pfcount.c -o pfcount11.o > > > > gcc: I../libpcap-1.1.1-ring: No such file or directory > > > > > > again you missed the minus in front of this option: > > > "I../libpcap-1.1.1-ring" should be "-I../libpcap-1.1.1-ring" > > > > > > > > > regards > > > vito > > > > > > > pfcount.c:48:23: error: pcap/pcap.h: No such file or > directory > > > > pfcount.c:49:22: error: pcap/bpf.h: No such file or > directory > > > > In file included from pfcount.c:53: > > > > /usr/local/include/pfring.h:438:25: error: > pfring_zero.h: No > > such file > > > > or directory > > > > pfcount.c: In function ‘parse_bpf_filter’: > > > > pfcount.c:370: warning: implicit declaration of function > > > > ‘pcap_compile_nopcap’ > > > > pfcount.c:371: error: ‘DLT_EN10MB’ undeclared (first > use in this > > > function) > > > > pfcount.c:371: error: (Each undeclared identifier is > > reported only > > > once > > > > pfcount.c:371: error: for each function it appears in.) > > > > pfcount.c:380: error: invalid use of undefined type > ‘struct > > > bpf_program’ > > > > pfcount.c: In function ‘dummyProcesssPacket’: > > > > pfcount.c:398: warning: implicit declaration of function > > ‘bpf_filter’ > > > > pfcount.c:398: error: invalid use of undefined type > ‘struct > > > bpf_program’ > > > > > > > > > > > > On Wed, May 22, 2013 at 9:34 AM, [email protected] > <mailto:[email protected]> > > <mailto:[email protected] <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> <mailto:[email protected] > <mailto:[email protected]>>> > > > > <mailto:[email protected] > <mailto:[email protected]> <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>>>> > > > <[email protected] <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>> > > <mailto:[email protected] <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>>> > > > > <mailto:[email protected] > <mailto:[email protected]> <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>>>>> wrote: > > > > > > > > Hello > > > > On 05/22/2013 09:50 AM, frwa onto wrote: > > > > > Hi Vito, > > > > > Let me first thank you a lot you have been > > helping > > > me a lot > > > > > since these few days and appreciate it. > > > > > > > > np, you're welcome > > > > > > > > > 1. > > > > > Ok I was then compiling it the wrong way. Why > it need > > to be so > > > > > complicated ? Isnt the libraries should be linked > > automatically. > > > > > > > > yes but you have to setup the write include/lib > path because > > > the pfring > > > > aware ones overlap the one that came with the OS... > > > > > > > > >So > > > > > what I did I tried the first command as below > and I just > > > chance the > > > > > output to pfcount11. Since this already giving > error I > > could not > > > > run the > > > > > second command and still confuse why need these > 2 command. > > > Ok let me > > > > > tell you what I plan is to purely use pf_ring to > > capture packets > > > > at wire > > > > > speed as it suppose to do. So for that how should I > > work around > > > > with out > > > > > the legacy pcap ? > > > > > > > > > > gcc -O2 -DHAVE_PF_RING -Wall -I../../kernel > > > -I../../kernel/plugins > > > > > -I../lib I../libpcap-1.1.1-ring -D HAVE_ZERO -D > > ENABLE_BPF > > > -O2 -c > > > > > pfcount.c -o pfcount11.o > > > > > > > > > > > > missing the minus? > > > > > > > > I../libpcap-1.1.1-ring --> -I../libpcap-1.1.1-ring > > > > > > > > let me know if it helps > > > > > > > > ciao > > > > -v > > > > _______________________________________________ > > > > Ntop-misc mailing list > > > > [email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>>> > > > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > Ntop-misc mailing list > > > > [email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > > > > > > _______________________________________________ > > > Ntop-misc mailing list > > > [email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>> > > <mailto:[email protected] > <mailto:[email protected]> > > <mailto:[email protected] > <mailto:[email protected]>>> > > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > > > > > > > > > > > _______________________________________________ > > > Ntop-misc mailing list > > > [email protected] > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>> > > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > > > _______________________________________________ > > Ntop-misc mailing list > > [email protected] > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > > > > > > _______________________________________________ > > Ntop-misc mailing list > > [email protected] <mailto:[email protected]> > > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
