I tried compiling the Argus network flow tool against the libpcap libraries from pf_ring:
./configure –with-libpcap=/opt/PF_RING/userland/libpcap The configure script finds the files it needs, but when I run make, I get a ton of errors. I can’t tell if these are errors in the pf_ring version of libpcap or if it is something wrong with how Argus does its make. I’m not a developer… make[1]: Entering directory `/home/craig.merchant/argus-3.0.8.2.rc.2/argus' gcc -O -I. -I/opt/PF_RING/userland/libpcap -I./../include -DHAVE_CONFIG_H -o ../bin/argus argus.o ArgusModeler.o ArgusSource.o ArgusUtil.o ArgusOutput.o ArgusUdp.o ArgusTcp.o ArgusIcmp.o ArgusIgmp.o ArgusEsp.o ArgusArp.o ArgusFrag.o ArgusUdt.o ArgusLcp.o ArgusIsis.o ArgusAuth.o Argus802.11.o ArgusApp.o ArgusEvents.o ArgusNetflow.o ArgusSflow.o /opt/PF_RING/userland/libpcap/libpcap.a -lpthread -lm ../lib/argus_common.a -lm /opt/PF_RING/userland/libpcap/libpcap.a(pcap.o): In function `pcap_breakloop': /opt/PF_RING/userland/libpcap/./pcap.c:882: undefined reference to `pfring_breakloop' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_read_packet': /opt/PF_RING/userland/libpcap/./pcap-linux.c:1628: undefined reference to `pfring_recv' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_stats_linux': /opt/PF_RING/userland/libpcap/./pcap-linux.c:2071: undefined reference to `pfring_stats' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_cleanup_linux': /opt/PF_RING/userland/libpcap/./pcap-linux.c:1088: undefined reference to `pfring_close' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_setfilter_linux_common': /opt/PF_RING/userland/libpcap/./pcap-linux.c:2630: undefined reference to `pfring_get_bound_device_ifindex' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_activate_linux': /opt/PF_RING/userland/libpcap/./pcap-linux.c:1484: undefined reference to `pfring_enable_ring' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1485: undefined reference to `pfring_get_selectable_fd' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1316: undefined reference to `pfring_open' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1320: undefined reference to `pfring_set_socket_mode' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1347: undefined reference to `pfring_set_poll_watermark' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1345: undefined reference to `pfring_enable_rss_rehash' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1341: undefined reference to `pfring_set_application_name' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1325: undefined reference to `pfring_set_cluster' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1327: undefined reference to `pfring_set_cluster' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1329: undefined reference to `pfring_set_cluster' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1331: undefined reference to `pfring_set_cluster' /opt/PF_RING/userland/libpcap/./pcap-linux.c:1333: undefined reference to `pfring_set_cluster' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o):/opt/PF_RING/userland/libpcap/./pcap-linux.c:1335: more undefined references to `pfring_set_cluster' follow /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_get_pfring_id': /opt/PF_RING/userland/libpcap/./pcap-linux.c:6377: undefined reference to `pfring_get_ring_id' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_set_watermark': /opt/PF_RING/userland/libpcap/./pcap-linux.c:6404: undefined reference to `pfring_set_poll_watermark' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_setdirection_linux': /opt/PF_RING/userland/libpcap/./pcap-linux.c:2733: undefined reference to `pfring_set_direction' /opt/PF_RING/userland/libpcap/./pcap-linux.c:2733: undefined reference to `pfring_set_direction' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_inject_linux': /opt/PF_RING/userland/libpcap/./pcap-linux.c:2018: undefined reference to `pfring_send' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_set_appl_name_linux': /opt/PF_RING/userland/libpcap/./pcap-linux.c:1502: undefined reference to `pfring_set_application_name' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_set_cluster': /opt/PF_RING/userland/libpcap/./pcap-linux.c:1508: undefined reference to `pfring_set_cluster' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_set_master_id': /opt/PF_RING/userland/libpcap/./pcap-linux.c:6383: undefined reference to `pfring_set_master_id' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_set_master': /opt/PF_RING/userland/libpcap/./pcap-linux.c:6389: undefined reference to `pfring_set_master' /opt/PF_RING/userland/libpcap/libpcap.a(pcap-linux.o): In function `pcap_set_application_name': /opt/PF_RING/userland/libpcap/./pcap-linux.c:6395: undefined reference to `pfring_set_application_name' collect2: error: ld returned 1 exit status make[1]: *** [../bin/argus] Error 1 make[1]: Leaving directory `/home/craig.merchant/argus-3.0.8.2.rc.2/argus' ### Done with /home/craig.merchant/argus-3.0.8.2.rc.2/argus ### Making in /home/craig.merchant/argus-3.0.8.2.rc.2/events make[1]: Entering directory `/home/craig.merchant/argus-3.0.8.2.rc.2/events' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/craig.merchant/argus-3.0.8.2.rc.2/events' ### Done with /home/craig.merchant/argus-3.0.8.2.rc.2/events From: Alfredo Cardigliano [mailto:[email protected]] Sent: Tuesday, October 06, 2015 1:46 PM To: [email protected] Subject: Re: [Ntop-misc] How to make an application "PF_RING aware" Hi Craig in order to run a pcap-based application on top of ZC, you need to link it to our pf_ring-aware libpcap, that’s how the tcpdump included in pf_ring works. Alfredo On 06 Oct 2015, at 21:23, Craig Merchant <HYPERLINK "mailto:[email protected]"[email protected]> wrote: I’ve installed the ZC drivers on an OEL 7 server. I’ve tried getting both Splunk Stream and Argus to read the ZC interfaces, but neither of them see traffic. The tcpdump included with the OS can’t see traffic on those interfaces, but the one included with ZC can. What does an application developer have to do to make an application see traffic on a ZC interface? I’m not a developer, so feel free to use small words. I’m just curious what the process is and how much work is required to add that functionality. Thanks. C _______________________________________________ Ntop-misc mailing list HYPERLINK "mailto:[email protected]"[email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
