[Bro] Fwd: Configure error linking libpcap and pthread

[James Lay]

On 2014-08-28 16:27, Joe Blow wrote:
> Similar, except I actually use the PF_RING_aware drivers, and
> transparent mode = 2.  So before I perform step 1 I make and make
> install in
> PF_RING_aware/non-ZC-drivers/2.6.x/broadcom/netxtreme2-5.2.50/bnx2. 
> Then load the module with modprobe, then I compile PF_RING without
> issues, and compile tcpdump to work on the new PF_RING.  That works
> fine with tcpdump, but I cant seem to compile Bro.
>
> Other than that nuance (and the fact that im running PF_RING 6.0.2, 
> as
> mentioned above, not 5.6.2 like the guide) it should be the same.
>
> Any ideas?
>
> Cheers,
>
> JB
>
> On Thu, Aug 28, 2014 at 5:59 PM, James Lay <jlay at slave-tothe-box.net
> [4]> wrote:
>
>> On 2014-08-28 15:52, Joe Blow wrote:
>> > Hey all,
>>
>>>
>> > Im having a really tough time getting PF_RING working with Bro in
>> a
>> > threaded fashion.  I have PF_RING compiled and working fine
>> (tcpdump
>> > test works fine with Transparent mode = 2):
>> >
>> > PF_RING Version          : 6.0.2 ($Revision: exported$)
>> > Total rings              : 0
>> >
>> > Standard (non DNA) Options
>> > Ring slots               : 4096
>> > Slot version             : 16
>> > Capture TX               : No [RX only]
>> >  IP Defragment            : No
>> > Socket Mode              : Standard
>> > Transparent mode         : No [mode 2]
>> > Total plugins            : 0
>> > Cluster Fragment Queue   : 0
>> > Cluster Fragment Discard : 0
>> >
>> >  Bro is version 2.3 (sha1 -
>> 79397be0e351165d44047b044d29b5e6580532cc 
>> > bro-2.3.tar.gz)
>> >
>> > OS is CentOS 6.4 running 2.6.32-358.11.1.el6.x86_64
>> >
>> > When I try and configure against my PF_RING libraries, I get
>> this:
>> >
>> > ./configure --with-pcap=/opt/pfring
>> > Build Directory : build
>> >  Source Directory: /root/src/bro-2.3
>> > -- The C compiler identification is GNU
>> > -- The CXX compiler identification is GNU
>> > -- Check for working C compiler: /usr/bin/gcc
>> > -- Check for working C compiler: /usr/bin/gcc -- works
>> >  -- Detecting C compiler ABI info
>> > -- Detecting C compiler ABI info - done
>> > -- Check for working CXX compiler: /usr/bin/c++
>> > -- Check for working CXX compiler: /usr/bin/c++ -- works
>> > -- Detecting CXX compiler ABI info
>> >  -- Detecting CXX compiler ABI info - done
>> > -- Found sed: /bin/sed
>> > -- Found Perl: /usr/bin/perl
>> > -- Found FLEX: 2.5.35
>> > -- Found BISON: /usr/bin/bison
>> > -- Found PCAP: /opt/pfring/lib/libpcap.so
>> > -- Performing Test PCAP_LINKS_SOLO
>> >  -- Performing Test PCAP_LINKS_SOLO - Failed
>> > -- Looking for include files CMAKE_HAVE_PTHREAD_H
>> > -- Looking for include files CMAKE_HAVE_PTHREAD_H - found
>> > -- Looking for pthread_create in pthreads
>> > -- Looking for pthread_create in pthreads - not found
>> >  -- Looking for pthread_create in pthread
>> > -- Looking for pthread_create in pthread - found
>> > -- Found Threads: TRUE
>> > -- Performing Test PCAP_NEEDS_THREADS
>> > -- Performing Test PCAP_NEEDS_THREADS - Failed
>> > CMake Error at cmake/FindPCAP.cmake:61 (message):
>> >    Couldnt determine how to link against libpcap
>>
>>> Call Stack (most recent call first):
>> >   cmake/FindRequiredPackage.cmake:26 (find_package)
>> >   CMakeLists.txt:52 (FindRequiredPackage)
>> >
>> > -- Configuring incomplete, errors occurred!
>> >
>> > Im banging my head against this, but I believe this is because
>> bro
>> > cant find the threading library to link to.  Could someone point
>> me
>>
>>> in the right direction?  Do I need other threading libraries?
>> Static
>> > linking?
>> >
>> > Cheers,
>> >
>> > JB
>>
>> Did you follow this:
>>
>> http://www.bro.org/documentation/load-balancing.html [1]
>>
>> James

Hrmm...I just tested this now with PF_RING 6.0.1:

Build Directory : build
Source Directory: /home/dev/bro-2.3
-- Found sed: /bin/sed
-- Found Perl: /usr/bin/perl (found version "5.18.2")
-- Found FLEX: 2.5.35
-- Found BISON: /usr/bin/bison
-- Found PCAP: /opt/pfring/lib/libpcap.so
-- Performing Test PCAP_LINKS_SOLO
-- Performing Test PCAP_LINKS_SOLO - Success
-- Looking for pcap_get_pfring_id
-- Looking for pcap_get_pfring_id - found
etc...
-- Looking for include file pthread.h
-- Looking for include file pthread.h - found
-- Looking for pthread_create
-- Looking for pthread_create - not found
-- Looking for pthread_create in pthreads
-- Looking for pthread_create in pthreads - not found
-- Looking for pthread_create in pthread
-- Looking for pthread_create in pthread - found
-- Found Threads: TRUE


I didn't see the PCAP_NEEDS_THREADS however.  Machine info:

Linux ubuntu-test 3.13.0-34-generic #60-Ubuntu SMP Wed Aug 13 15:49:09 
UTC 2014 i686 i686 i686 GNU/Linux

Hope that's at least a little more intel.

James