[Bro] problems compiling bro 25 master on centos 6

Johanna Amann johanna at icir.org
Fri Sep 23 08:55:09 PDT 2016


The plugin is not being built automatically. By default, Bro uses 
libpcap (in this case, it is building against the pfring libpcap, so you 
are already using libpcap). The plugin uses poring directly without 
going through libpcap. You have to build it manually by going to 
aux/plugins/libpcap after building bro, calling ./configure there (which 
should pick up libpcap), and then doing make/make install.

I hope this helps :)

Johanna

On 23 Sep 2016, at 5:10, erik clark wrote:

> So, I get pfring "found"... but no plugin built.
>
> (from configure)
> -- Found PCAP: /opt/pfring/lib/libpcap.so
> -- Looking for pcap_get_pfring_id
> -- Looking for pcap_get_pfring_id - found
>
> Why is the plugin not being built?
>
> bro -N Bro::PF_RING
> ... line 1: plugin Bro::PF_RING is not available
>
> This is the last hurdle I have to overcome. Not sure why it finds 
> libpcap
> in the /opt/pfring directory, but doesn't build the plugin.
>
> On Thu, Sep 22, 2016 at 2:10 PM, Johanna Amann <johanna at icir.org> 
> wrote:
>
>> Odd. Looking at the cmake file, it should try the argument specified 
>> in
>> --with-pcap first. However, I am not that big of an expert in make 
>> and did
>> not write that specific script, so you might have to bounce this back 
>> to
>> the mailing list :)
>>
>> Johanna
>>
>>
>> On 22 Sep 2016, at 11:01, erik clark wrote:
>>
>> Yep, I just reran configure and grepped it out of the output. It 
>> pulled the
>>> incorrect libpcap.
>>>
>>> On Thu, Sep 22, 2016 at 1:54 PM, Johanna Amann <johanna at icir.org> 
>>> wrote:
>>>
>>>
>>>>
>>>> On 22 Sep 2016, at 10:47, erik clark wrote:
>>>>
>>>> I dug through the cmake files to see what was wrong. To get this to 
>>>> not
>>>> use
>>>>
>>>>> clang (and I have zero clue where that is being stored), you need 
>>>>> to
>>>>>
>>>>> export "CMAKE_CXX_COMPILER=${location}"
>>>>>
>>>>>
>>>> Odd. I currently don't have an alternate compiler here - but I am 
>>>> quite
>>>> sure that that worked in the past when specifying CC/CXX before 
>>>> calling
>>>> configure...
>>>>
>>>> ldd bro states:
>>>>
>>>>>
>>>>> libpcap.so.1 => /usr/local/lib/libpcap.so.1
>>>>>
>>>>> Even though I am specifying
>>>>>
>>>>> --with-pcap=/opt/pfring
>>>>>
>>>>> it is still digging up libpcap from /usr/local/lib, which is 
>>>>> completely
>>>>> unrelated to the deployed pfring kernel module. :)
>>>>>
>>>>>
>>>> Does configure show that it chose that one too? (It is one of the 
>>>> first
>>>> few lines of configure output).
>>>>
>>>> Johanna
>>>>
>>>>


More information about the Bro mailing list