[Bro] Modifying Bro for NetBSD

Sean Peisert speisert at alumni.ucsd.edu
Tue Nov 9 19:16:10 PST 2004


I attached the /usr/include/pcap.h file. 
Offhand, the arguments appear to be the same as 
the ones I changed the Bro files to require.  Are 
you sure they're incongruent?

Unfortunately, I don't have a NetBSD machine to 
give you access to right at the moment, but I 
could probably get one up next week if nobody 
else on the list can help.  It'll even run on 
your toaster, in case you have time to try. :)


At 7:54 PM -0700 11/9/04, José María González wrote:
>Your patch deals mainly with NetBSD addition of an
>(extra) error parameter in libpcap's pcap_compile_nopcap().
>I submitted a patch to detect this some time ago:
>[BTW, and off-topic, would it be possible to anonymize
>email addresses in the mailing list?]
>Unfortunately, I didn't have a NetBSD box to test it,
>and it seems it may not be working properly.
>On the other hand, your patch seems to add even a
>new extra parameter. I checked NetBSD 2.0, and the
>function API is:
>pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
>              struct bpf_program *program,
>	     char *buf, int optimize, bpf_u_int32 mask, char *errbuf)
>I.e., just the error buffer parameter. This seems incoherent
>with your patch.
>Can you please send me your pcap.h file? It should be
>located at /usr/include/pcap.h, or maybe /usr/include/[lib]pcap/pcap.h
>Last, is there any NetBSD machine I can have access to?
>On Tuesday 09 November 2004 13:42, Sean Peisert wrote:
>  > FYI, the changes in the attached diff were necessary to get Bro
>  > 0.9a4a to compile on a NetBSD 2.0_RC4 (x86) installation.
>  >
>  > Sean
>  >
>diff -r bro-pub-0.9a4a/src/BPF_Program.cc 
>< #include "pcap-int.h"
>>  /*#include "pcap-int.h"*/
>>  #include "/usr/src/lib/libpcap/pcap-int.h"
><       int optimize, bpf_u_int32 mask)
>>        int optimize, bpf_u_int32 mask, char* dummy)
><              (char *) filter, optimize, netmask, error);
>>               (char *) filter, optimize, netmask, error, NULL);
><              (char*) filter, optimize, netmask);
>>               (char*) filter, optimize, netmask, NULL);
>diff -r bro-pub-0.9a4a/src/PktSrc.cc bro-pub-0.9a4a-sean/src/PktSrc.cc
>>  #define DLT_LINUX_SLL 113
><       current_dumper = pcap_dump_open(pd, file);
>>        current_dumper = pcap_dump_open(pd, (char*)file);
>Only in bro-pub-0.9a4a-sean/src: libedit
>Bro mailing list
>bro at bro-ids.org

Sean Peisert                                (858) 822-3685 (voice)
peisert at sdsc.edu                            (858) 822-5443 (fax)

	San Diego Supercomputer Center
	University of California, San Diego
	9500 Gilman Drive, MC 0505
	La Jolla, CA  92093-0505
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcap.h
Type: application/octet-stream
Size: 5168 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20041109/e15a6a64/attachment.obj 

More information about the Bro mailing list