[Bro] problems compiling bro 25 master on centos 6

[Johanna Amann]

Hi,

On Thu, Sep 22, 2016 at 08:45:49AM -0400, erik clark wrote:
> Ok,. so I got this to compile, but it is non-trivial.

how did you get it to run in the end? I saw your last email with the
export of CC/CXX not working (which is a bit odd, as far as I remember
that worked fine for me in the past).

> 
> There is no longer a --with-pfring=X option in 25 configure script. See:
> 
> https://www.bro.org/sphinx-git/components/bro-plugins/pf_ring/README.html

I actually don't think that we ever had that version (at least I do not
remember it being in the last view versions).
https://www.bro.org/documentation/load-balancing.html gives a bit of
information on how to use Bro with the pfring libpcap. The pf_ring plugin
is different, and directly uses pfring without going throug libpcap. I
never used this one myself, however checking the code it seems to look
through the standard include path locations for pfring. If pfring is
installed in a different place, you can probably enable Bro to find it by
exporting CFLAGS/CXXFLAGS/LDFLAGS to point to that directory.

> however, this makes no change in it building. Moreover, in
> ../build/instal_manifest.txt, I see broctl/plugins/lb_pfring.py, but no
> other sign of pfring. ldd bro shows no pfring entry either. Why did bro not
> build with pfring? Thanks!

It might have built against the wrong version of libpcap. The chosen pcap
library is displayed during configure output in a line like:

-- Found PCAP: /usr/lib/libpcap.dylib  

I hope this helps,
 Johanna