[Bro] Fwd: Configure error linking libpcap and pthread

[ben.bt.wood at gmail.com]

I once had an issue with this. My bad workaround was to remove any non PF_RING libpcap. I was noticing some problems with the compiler choosing the wrong one. So using the big hammer, I removed it.

-----Original Message-----
From: "Joe Blow" <blackhole.em at gmail.com>
Sent: ‎8/‎28/‎2014 5:54 PM
To: "bro at bro-ids.org" <bro at bro-ids.org>
Subject: [Bro] Fwd: Configure error linking libpcap and pthread

Hey all,

I'm having a really tough time getting PF_RING working with Bro in a threaded fashion.  I have PF_RING compiled and working fine (tcpdump test works fine with Transparent mode = 2):

PF_RING Version          : 6.0.2 ($Revision: exported$)
Total rings              : 0

Standard (non DNA) Options
Ring slots               : 4096
Slot version             : 16
Capture TX               : No [RX only]
IP Defragment            : No
Socket Mode              : Standard
Transparent mode         : No [mode 2]
Total plugins            : 0
Cluster Fragment Queue   : 0
Cluster Fragment Discard : 0


Bro is version 2.3 (sha1 - 79397be0e351165d44047b044d29b5e6580532cc  bro-2.3.tar.gz)

OS is CentOS 6.4 running 2.6.32-358.11.1.el6.x86_64



When I try and configure against my PF_RING libraries, I get this:

./configure --with-pcap=/opt/pfring
Build Directory : build
Source Directory: /root/src/bro-2.3
-- The C compiler identification is GNU
-- The CXX compiler identification is GNU
-- Check for working C compiler: /usr/bin/gcc
-- Check for working C compiler: /usr/bin/gcc -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working CXX compiler: /usr/bin/c++
-- Check for working CXX compiler: /usr/bin/c++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Found sed: /bin/sed
-- Found Perl: /usr/bin/perl
-- Found FLEX: 2.5.35
-- Found BISON: /usr/bin/bison
-- Found PCAP: /opt/pfring/lib/libpcap.so
-- Performing Test PCAP_LINKS_SOLO
-- Performing Test PCAP_LINKS_SOLO - Failed
-- Looking for include files CMAKE_HAVE_PTHREAD_H
-- Looking for include files CMAKE_HAVE_PTHREAD_H - found
-- Looking for pthread_create in pthreads
-- Looking for pthread_create in pthreads - not found
-- Looking for pthread_create in pthread
-- Looking for pthread_create in pthread - found
-- Found Threads: TRUE
-- Performing Test PCAP_NEEDS_THREADS
-- Performing Test PCAP_NEEDS_THREADS - Failed
CMake Error at cmake/FindPCAP.cmake:61 (message):
  Couldn't determine how to link against libpcap
Call Stack (most recent call first):
  cmake/FindRequiredPackage.cmake:26 (find_package)
  CMakeLists.txt:52 (FindRequiredPackage)


-- Configuring incomplete, errors occurred!


I'm banging my head against this, but I believe this is because bro can't find the threading library to link to.  Could someone point me in the right direction?  Do I need other threading libraries? Static linking?


Cheers,

JB
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140828/b0d9244b/attachment.html