Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NTop: Misc

latest snort daq linking issues

 

 

NTop misc RSS feed   Index | Next | Previous | View Threaded


JAzoff at albany

Mar 15, 2012, 12:44 PM

Post #1 of 4 (333 views)
Permalink
latest snort daq linking issues

Between r5218 and r5219 the configure.ac changed for the snort daq
module and it no longer properly links against libpfring..

adding back in the

LDFLAGS="${LDFLAGS} -lpcap"

to configure.ac fixes things..

Aside from that the updated version works great.


--
-- Justin Azoff
-- Network Security & Performance Analyst
_______________________________________________
Ntop-misc mailing list
Ntop-misc [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop-misc


deri at ntop

Mar 15, 2012, 1:03 PM

Post #2 of 4 (326 views)
Permalink
Re: latest snort daq linking issues [In reply to]

Justin
I have put back the line you asked. Please check if everything is compliant with what your expected.

Shall you have other requests/patches/suggestions please let us know.

Thanks for your support Luca

On Mar 15, 2012, at 8:44 PM, Justin Azoff wrote:

> Between r5218 and r5219 the configure.ac changed for the snort daq
> module and it no longer properly links against libpfring..
>
> adding back in the
>
> LDFLAGS="${LDFLAGS} -lpcap"
>
> to configure.ac fixes things..
>
> Aside from that the updated version works great.
>
>
> --
> -- Justin Azoff
> -- Network Security & Performance Analyst
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

_______________________________________________
Ntop-misc mailing list
Ntop-misc [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop-misc


JAzoff at albany

Mar 15, 2012, 1:29 PM

Post #3 of 4 (350 views)
Permalink
Re: latest snort daq linking issues [In reply to]

On Thu, Mar 15, 2012 at 09:03:54PM +0100, Luca Deri wrote:
> Justin
> I have put back the line you asked. Please check if everything is compliant with what your expected.
>
> Shall you have other requests/patches/suggestions please let us know.
>
> Thanks for your support Luca

Well, it does seem to work, but I did notice something odd.

On my old box with the older version before the change I see

#ldd /usr/local/lib/daq/daq_pfring.so
linux-vdso.so.1 => (0x00007fffeefff000)
libpthread.so.0 => /lib/libpthread.so.0 (0x00007f8280801000)
libpcap.so.1 => /opt/pfring/lib/libpcap.so.1 (0x00007f82805b1000)
libpfring.so => /opt/pfring/lib/libpfring.so (0x00007f8280397000)
libc.so.6 => /lib/libc.so.6 (0x00007f8280036000)
/lib64/ld-linux-x86-64.so.2 (0x00007f8280c2f000)

on the new box with the just fixed version I see

ldd /usr/local/lib/daq/daq_pfring.so
linux-vdso.so.1 => (0x00007fff4097d000)
libpthread.so.0 => /lib/libpthread.so.0 (0x00007f91b573b000)
libpcap.so.1 => /opt/pfring/lib/libpcap.so.1 (0x00007f91b54eb000)
libc.so.6 => /lib/libc.so.6 (0x00007f91b5188000)
/lib64/ld-linux-x86-64.so.2 (0x00007f91b5b61000)

So on the new box the daq module is not directly linked to libpfring anymore.
I'm not sure if that is by design or not though.

The other change in that revision was to swap out

AC_CHECK_LIB([pfring], [pfring_open], [], [AC_MSG_ERROR([Could not link against the PFRING library!])])

for a file based check(which also requires you to have pf_ring source in ~/PF_RING...)

--
-- Justin Azoff
-- Network Security & Performance Analyst
_______________________________________________
Ntop-misc mailing list
Ntop-misc [at] listgateway
http://listgateway.unipi.it/mailman/listinfo/ntop-misc


40312 at studenti

Mar 15, 2012, 1:35 PM

Post #4 of 4 (330 views)
Permalink
Re: latest snort daq linking issues [In reply to]

In my build I fixed the same problem adding

daq_pfring_la_LIBADD = -lpfring

directly to the Makefile.

It should (not tested though) also work if you put that line Makefile.am
and the run autoreconf

NTop misc RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.