[Bro] Modifying Bro for NetBSD
speisert at alumni.ucsd.edu
Tue Nov 9 19:16:10 PST 2004
I attached the /usr/include/pcap.h file.
Offhand, the arguments appear to be the same as
the ones I changed the Bro files to require. Are
you sure they're incongruent?
Unfortunately, I don't have a NetBSD machine to
give you access to right at the moment, but I
could probably get one up next week if nobody
else on the list can help. It'll even run on
your toaster, in case you have time to try. :)
At 7:54 PM -0700 11/9/04, José María González wrote:
>Your patch deals mainly with NetBSD addition of an
>(extra) error parameter in libpcap's pcap_compile_nopcap().
>I submitted a patch to detect this some time ago:
>[BTW, and off-topic, would it be possible to anonymize
>email addresses in the mailing list?]
>Unfortunately, I didn't have a NetBSD box to test it,
>and it seems it may not be working properly.
>On the other hand, your patch seems to add even a
>new extra parameter. I checked NetBSD 2.0, and the
>function API is:
>pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
> struct bpf_program *program,
> char *buf, int optimize, bpf_u_int32 mask, char *errbuf)
>I.e., just the error buffer parameter. This seems incoherent
>with your patch.
>Can you please send me your pcap.h file? It should be
>located at /usr/include/pcap.h, or maybe /usr/include/[lib]pcap/pcap.h
>Last, is there any NetBSD machine I can have access to?
>On Tuesday 09 November 2004 13:42, Sean Peisert wrote:
> > FYI, the changes in the attached diff were necessary to get Bro
> > 0.9a4a to compile on a NetBSD 2.0_RC4 (x86) installation.
> > Sean
>diff -r bro-pub-0.9a4a/src/BPF_Program.cc
>< #include "pcap-int.h"
>> /*#include "pcap-int.h"*/
>> #include "/usr/src/lib/libpcap/pcap-int.h"
>< int optimize, bpf_u_int32 mask)
>> int optimize, bpf_u_int32 mask, char* dummy)
>< (char *) filter, optimize, netmask, error);
>> (char *) filter, optimize, netmask, error, NULL);
>< (char*) filter, optimize, netmask);
>> (char*) filter, optimize, netmask, NULL);
>diff -r bro-pub-0.9a4a/src/PktSrc.cc bro-pub-0.9a4a-sean/src/PktSrc.cc
>> #define DLT_LINUX_SLL 113
>< current_dumper = pcap_dump_open(pd, file);
>> current_dumper = pcap_dump_open(pd, (char*)file);
>Only in bro-pub-0.9a4a-sean/src: libedit
>Bro mailing list
>bro at bro-ids.org
Sean Peisert (858) 822-3685 (voice)
peisert at sdsc.edu (858) 822-5443 (fax)
San Diego Supercomputer Center
University of California, San Diego
9500 Gilman Drive, MC 0505
La Jolla, CA 92093-0505
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 5168 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20041109/e15a6a64/attachment.obj
More information about the Bro