I'm experiencing some issues getting PF_RING compiled for use with snort. I initially had some issues getting pf_ring itself compiled on RHEL6 related to the pf_ring aware igb and ixgbe drivers. Commenting these out of the makefile and not building them allowed me to compile pf_ring.
So I have pf_ring compiled and the kernel module loaded, and now I'm trying to get the snort daq compiled. I do (from userland/snort/pfring-daq-module): autoreconf -ivf ./configure make And I receive the following errors: libtool: compile: gcc -DHAVE_CONFIG_H -I. -I /home/jofcore/PF_RING/userland/lib -I /home/jofcore/PF_RING/kernel -DBUILDING_SO -g -O2 -fvisibility=hidden -Wall -Wwrite-strings -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security -Wno-unused-parameter -fno-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99 -D_GNU_SOURCE -MT daq_pfring_la-daq_pfring.lo -MD -MP -MF .deps/daq_pfring_la-daq_pfring.Tpo -c daq_pfring.c -fPIC -DPIC -o .libs/daq_pfring_la-daq_pfring.o In file included from daq_pfring.c:46: pfring.h:134: error: expected specifier-qualifier-list before ‘socket_mode’ pfring.h:325: error: expected declaration specifiers or ‘...’ before ‘socket_mode’ daq_pfring.c: In function ‘pfring_daq_open’: daq_pfring.c:150: error: ‘recv_only_mode’ undeclared (first use in this function) daq_pfring.c:150: error: (Each undeclared identifier is reported only once daq_pfring.c:150: error: for each function it appears in.) daq_pfring.c:150: error: too many arguments to function ‘pfring_set_socket_mode’ daq_pfring.c: In function ‘pfring_daq_initialize’: daq_pfring.c:253: error: ‘cluster_per_flow_2_tuple’ undeclared (first use in this function) daq_pfring.c:397: error: ‘cluster_per_flow_4_tuple’ undeclared (first use in this function) daq_pfring.c:398: error: ‘cluster_per_flow_5_tuple’ undeclared (first use in this function) make[1]: *** [daq_pfring_la-daq_pfring.lo] Error 1 make[1]: Leaving directory `/home/jofcore/snort/PF_RING-5.5.2/userland/snort/pfring-daq-module' make: *** [all] Error 2 Anyone know why I can't seem to compile the daq module on rhel6.3? Is there any docs / howtos for how to compile/install pf_ring for snort? I found some documentation, but it seems a bit old (dated 2011), and the instructions there don't seem to work for me either.. ( http://www.snort.org/assets/186/PF_RING_Snort_Inline_Instructions_daq_062.pdf and http://www.metaflows.com/technology/pf-ring/) Thanks!
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
