Jana, Bear in mind that I could be just as lost in the sauce here as any other pf_ring/nprobe newbie, but this might give you a direction to look in. I believe that installing pf_ring via yum as opposed to compiling from source leads to two different setups. The rpm package will install the kernel module to /usr/local/pfring/kernel/pf_ring.ko, but when running make install to compile from source, I believe the kernel modules will be dumped into /lib/modules/`uname -r`. If it’s looking for the pf_ring kernel modules, it may not be finding them. Of course, it could be some other libraries/headers that are placed somewhere by pf_ring that it can’t find. Basically, I’m wondering if when compiling nProbe from source, you’ll also need to compile some of the other nTop software from source.
I’d be careful about moving things however. The initialization scripts that load pf_ring into the kernel expect that module to be either in /lib/modules or /usr/local. If you end up moving it without moving it back, then pf_ring won’t get loaded and you will cause some other problems down the line. I’d try copying files over like that to make sure the original stays in place. Also, I’m not sure of the results of compiling the source while the RPM is installed, I might remove just the nProbe RPM before trying to compile. Hope you get an answer. Jeff From: Jana Dunn <[email protected]<mailto:[email protected]>> Reply-To: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>> Date: Thursday, March 27, 2014 at 1:17 PM To: Ntop-misc mailing list <[email protected]<mailto:[email protected]>> Subject: [Ntop-misc] trouble compiling nprobe from source: undefined pfring references Hello, I had nProbe running in demo mode on CentOS release 6.5 (Final) , but want to run nProbe in regular, non-demo mode. We are an academic institution, so Luca Deri kindly sent me a source bundle to compile that will not require a license. But I'm having trouble, and I am not good enough with CentOS to figure out how to fix the library issues: the commands I ran as root yum install libpcap libpcap-devel yum install tcp_wrappers-devel yum clean all yum update yum install pfring n2disk nProbe ntopng ntopng-data nbox [the last was an attempt to make sure all libraries are up to date] And then as a normal user I unpacked the nProbe tarball Luca sent, and then ./autogen.sh make The make errors out with references to pfring. I do have pfring installed via the yum command listed above: $ ls -l /usr/local/lib/*pfring* -rw-r--r--. 1 root root 273770 Mar 26 19:08 /usr/local/lib/libpfring.a -rwxr-xr-x. 1 root root 201492 Mar 26 19:08 /usr/local/lib/libpfring.so Selected output from autogen: This is your nprobe 6.16.140327 configuration: Host System Type : x86_64-unknown-linux-gnu (x86_64) Compiler (cflags) : gcc -O2 -I/usr/local/include -I/opt/local/include -DHAVE_CONFIG_H Include path : -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fno-strict-aliasing -fwrapv -fPIC -DUNIV_LINUX -DUNIV_LINUX System Libs : -L/usr/local/lib -L/opt/local/lib -L/lib -lrt -lresolv -lrt -ldl -lpthread -rdynamic -L/usr/lib64/mysql -lmysqlclient -lz -lcrypt -lnsl -lm -lssl -lcrypto -lwrap Core Libs : -lpcap Additional Libs : -lsqlite3 libpcap in : standard installation Install path : /usr/local Now type 'make' or 'gmake' (GNU make) on *BSD and Solaris systems to build . And the end of the make: /bin/sh ./libtool --tag=CC --mode=link gcc -O2 -I/usr/local/include -I/opt/local/include -L/usr/local/lib -L/opt/local/lib -L/lib -pthread -lm -L/usr/local/lib -L/opt/local/lib -L/lib -o nprobe nprobe-nprobe.o libnprobe.la<http://libnprobe.la> -lrt -lresolv -lrt -ldl -lpthread -rdynamic -L/usr/lib64/mysql -lmysqlclient -lz -lcrypt -lnsl -lm -lssl -lcrypto -lwrap -lpcap -lsqlite3 /home/jdunn/Src/Nprobe/nprobe_6.16.140310_svn4044/nDPI/src/lib/.libs/libndpi.a libtool: link: gcc -O2 -I/usr/local/include -I/opt/local/include -pthread -o .libs/nprobe nprobe-nprobe.o -rdynamic -L/usr/local/lib -L/opt/local/lib -L/lib ./.libs/libnprobe.so -L/usr/lib64/mysql -lresolv -lrt -ldl -lpthread -lmysqlclient -lz -lcrypt -lnsl -lm -lssl -lcrypto -lwrap -lpcap -lsqlite3 /home/jdunn/Src/Nprobe/nprobe_6.16.140310_svn4044/nDPI/src/lib/.libs/libndpi.a -pthread ./.libs/libnprobe.so: undefined reference to `pfring_set_application_name' ./.libs/libnprobe.so: undefined reference to `pfring_stats' ./.libs/libnprobe.so: undefined reference to `pfring_get_ring_id' ./.libs/libnprobe.so: undefined reference to `pfring_enable_rss_rehash' ./.libs/libnprobe.so: undefined reference to `pfring_get_selectable_fd' ./.libs/libnprobe.so: undefined reference to `pfring_enable_ring' ./.libs/libnprobe.so: undefined reference to `pfring_set_direction' ./.libs/libnprobe.so: undefined reference to `pfring_close' ./.libs/libnprobe.so: undefined reference to `pfring_set_master' ./.libs/libnprobe.so: undefined reference to `pfring_breakloop' ./.libs/libnprobe.so: undefined reference to `pfring_set_cluster' ./.libs/libnprobe.so: undefined reference to `pfring_set_master_id' ./.libs/libnprobe.so: undefined reference to `pfring_recv' ./.libs/libnprobe.so: undefined reference to `pfring_set_poll_watermark' ./.libs/libnprobe.so: undefined reference to `pfring_send' ./.libs/libnprobe.so: undefined reference to `pfring_open' collect2: ld returned 1 exit status Any suggestions? I found in the mail archive a reference to a similar problem that was solved with moving "The PF_RING folder" to the home directory of the user doing the compile. I tried moving /usr/local/pfring to my home directory, but that didn't make a difference. I put it back. I also emailed Luca directly with the above information. -- Jana Dunn, CISSP Senior Security Analyst Nevada System of Higher Education [email protected]<mailto:[email protected]> _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
