Hi,
Please see below.
On 03/02/2017 09:54 PM, Espresso Beanies wrote:
Emanuele,
Thanks for the response. I didn't realize there was a pfring service
installed from the ntop repo package as well. I'm running into an
issue with pfring during the compilation of Bro IDS. Bro runs into a
libpcap compile issue even if I specify the path to: /usr/local/lib to
use libpcap.so.1 v1.7.4. If I remove the pf_ring package installed
from the ntop repos, the issue goes away completely. Any ideas there?
Can you past here the compilation error you get with Bro IDS while
linking againts PF_RING libpcap?
I also see that after I install pfring from the repos, I encounter
these errors in the pf_ring.service:
● pf_ring.service - LSB: Start/stop pf_ring
Loaded: loaded (/etc/rc.d/init.d/pf_ring; bad; vendor preset: disabled)
Active: active (exited) since Fri 2017-02-24 17:25:16 EST; 5 days ago
Docs: man:systemd-sysv-generator(8)
Process: 2322 ExecStart=/etc/rc.d/init.d/pf_ring start (code=exited,
status=0/SUCCESS)
Feb 24 17:25:16 <machine_hostname> pf_ring[2320]: Starting PF_RING
module: cat: /etc/pf_ring/pf_ring.conf: No such file or directory
Feb 24 17:25:16 <machine_hostname> pf_ring[2320]: modprobe: FATAL:
Module pf_ring not found.
Feb 24 17:25:16 <machine_hostname> pf_ring[2320]: PF_RING not enabled:
please touch /etc/pf_ring/pf_ring.start
Feb 24 17:25:16 <machine_hostname> pf_ring[2320]: [ OK ]
I couldn't locate any pf_ring.start example file so I'm not sure what
parameters would go there.
You can just create an empty pf_ring.start file since it only matters it
exists.
Thanks for the assist!
Regards,
Emanuele
On Thu, Mar 2, 2017 at 6:00 AM,
<[email protected]
<mailto:[email protected]>> wrote:
Send Ntop-misc mailing list submissions to
[email protected] <mailto:[email protected]>
To subscribe or unsubscribe via the World Wide Web, visit
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
<http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
or, via email, send a message with subject or body 'help' to
[email protected]
<mailto:[email protected]>
You can reach the person managing the list at
[email protected]
<mailto:[email protected]>
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Ntop-misc digest..."
Today's Topics:
1. Question on using pf_ring from ntop CentOS repo (Espresso
Beanies)
2. Second question on pfring libpcap.so.1 file (Espresso Beanies)
3. Re: Question on using pf_ring from ntop CentOS repo
(Emanuele Faranda)
4. Re: Second question on pfring libpcap.so.1 file (Emanuele
Faranda)
----------------------------------------------------------------------
Message: 1
Date: Wed, 1 Mar 2017 14:17:00 -0500
From: Espresso Beanies <[email protected]
<mailto:[email protected]>>
To: [email protected]
<mailto:[email protected]>
Subject: [Ntop-misc] Question on using pf_ring from ntop CentOS repo
Message-ID:
<CAOeD168+fO+9g-LJZnXXSZtyqTfSe9JxuaLPbe9Bk+nvCMS7=w...@mail.gmail.com
<mailto:[email protected]>>
Content-Type: text/plain; charset="utf-8"
Hi,
I added the ntop repo to my CentOS 7 machine and installed the pfring
package. I ran into an issue where I realized that although I
installed the
package, it did not compile and load the pfring module needed by
my system
(pf_ring.ko). Under the /usr/src directory, I was able to compile
and add
it to modprobe. Do I have to do this every time there's an update
to the
pfring package and how would I make this module persistent across
reboots?
Thanks in advance,
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170301/cc3acbe4/attachment-0001.htm
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170301/cc3acbe4/attachment-0001.htm>>
------------------------------
Message: 2
Date: Wed, 1 Mar 2017 14:20:33 -0500
From: Espresso Beanies <[email protected]
<mailto:[email protected]>>
To: [email protected]
<mailto:[email protected]>
Subject: [Ntop-misc] Second question on pfring libpcap.so.1 file
Message-ID:
<caoed16-yt5mfyiduqngv+exvlahp7goyt3tqb5kkpoboqjf...@mail.gmail.com
<mailto:caoed16-yt5mfyiduqngv%[email protected]>>
Content-Type: text/plain; charset="utf-8"
Hi,
I sent that other message prematurely. Just one other question.
Even after
I installed the pf_ring package from the ntop.org
<http://ntop.org> CentOS repo, I'm not
seeing a separate libpcap.so.1 file exclusive to pfring. Does one get
created automatically? I'm trying to set up pfring with Bro IDS.
Thanks in advance!
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170301/0bc4cfdc/attachment-0001.htm
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170301/0bc4cfdc/attachment-0001.htm>>
------------------------------
Message: 3
Date: Thu, 2 Mar 2017 10:49:16 +0100
From: Emanuele Faranda <[email protected] <mailto:[email protected]>>
To: [email protected]
<mailto:[email protected]>
Subject: Re: [Ntop-misc] Question on using pf_ring from ntop CentOS
repo
Message-ID: <[email protected]
<mailto:[email protected]>>
Content-Type: text/plain; charset="windows-1252"; Format="flowed"
Hi,
You don't need to manually compile the module. It will be
automatically
rebuilt from /usr/src by DKMS when needed. Starting ntopng with
"service
ntopng start" command will start PF_RING too.
Regards,
Emanuele
On 03/01/2017 08:17 PM, Espresso Beanies wrote:
> Hi,
>
> I added the ntop repo to my CentOS 7 machine and installed the
pfring
> package. I ran into an issue where I realized that although I
> installed the package, it did not compile and load the pfring module
> needed by my system (pf_ring.ko). Under the /usr/src directory,
I was
> able to compile and add it to modprobe. Do I have to do this every
> time there's an update to the pfring package and how would I
make this
> module persistent across reboots?
>
> Thanks in advance,
>
>
> _______________________________________________
> Ntop-misc mailing list
> [email protected]
<mailto:[email protected]>
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
<http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170302/b2ee45c3/attachment-0001.htm
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170302/b2ee45c3/attachment-0001.htm>>
------------------------------
Message: 4
Date: Thu, 2 Mar 2017 10:58:48 +0100
From: Emanuele Faranda <[email protected] <mailto:[email protected]>>
To: [email protected]
<mailto:[email protected]>
Subject: Re: [Ntop-misc] Second question on pfring libpcap.so.1 file
Message-ID: <[email protected]
<mailto:[email protected]>>
Content-Type: text/plain; charset="windows-1252"; Format="flowed"
Hi,
In the Centos 7 release of PF_RING the libpcap library is located at
these paths:
/usr/local/lib/libpcap.so.1
/usr/local/lib/libpcap.a
Regards,
Emanuele
On 03/01/2017 08:20 PM, Espresso Beanies wrote:
> Hi,
>
> I sent that other message prematurely. Just one other question. Even
> after I installed the pf_ring package from the ntop.org
<http://ntop.org>
> <http://ntop.org> CentOS repo, I'm not seeing a separate
libpcap.so.1
> file exclusive to pfring. Does one get created automatically? I'm
> trying to set up pfring with Bro IDS.
>
> Thanks in advance!
>
>
> _______________________________________________
> Ntop-misc mailing list
> [email protected]
<mailto:[email protected]>
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
<http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170302/64077bcc/attachment-0001.htm
<http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20170302/64077bcc/attachment-0001.htm>>
------------------------------
_______________________________________________
Ntop-misc mailing list
[email protected] <mailto:[email protected]>
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
<http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
End of Ntop-misc Digest, Vol 153, Issue 1
*****************************************
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
