[Bro] Napatech's Libpcap on Bro 2.3.1

Gamarro, Estuardo EGAMARRO at depaul.edu
Tue Sep 9 15:05:01 PDT 2014


Hello,

	I'm a new Bro user, and for the most part it has been easy to
install/run Bro with Intel cards, but I hit a bump with Napatech libraries.
Compiling Bro {2.3.0, 2.3.1} with  Napatech's libraries [1] completes
without errors, but attempting to run bro or captures packets from command
line results in full packet loss.  No obvious errors, it just runs without
processing packets.  Oddly enough, Bro seemed to know how many packets it
dropped...

	Disabling nonblocking in PktSrc.cc [2] allowed Bro to finally
capture packets, and as far as I can tell seems to work OK.  Has anybody
else experienced this problem or found a better solution?


E.J. Gamarro


[1]
Libpcap version 1.4
NT Drivers 3gd 15.2 (Linux)

[2]
528c528
<       if ( pcap_setnonblock(pd, 1, tmp_errbuf) < 0 )
---
>       if ( pcap_setnonblock(pd, 0, tmp_errbuf) < 0 )




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5969 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140909/1b60aac5/attachment.bin 


More information about the Bro mailing list