Thanks for the reply, Alfredo. Since my initial post to the list, I've become aware of the pfring rpms that are available, and I'm trying to use them instead of compiling it myself. I'm not sure what was causing my issues with compiling, since obviously it can be compiled on RHEL6 or there wouldn't be rpm's available :) So I must have been doing something wrong or had something misconfigured. If the RPM works for me though, I won't need to compile so that seems like a better solution assuming I can get it working that way for what I need.
I did have a question about the RPM install of pf_ring and how it relates to snort though; If I install pf_ring from the rpm, is there anything that I need to do when compiling snort to make it "pf_ring aware", or do I simply point snort at the pf_ring daq when I start snort? In my current tests, I compiled snort and snort daq using a ./configure line similar to the one listed in the metaflows article, but I wasn't sure if that was necessary or not when using the pf_ring RPM? (maybe I should post a separate question about that...) Thx! On Fri, Mar 1, 2013 at 3:11 AM, Alfredo Cardigliano <[email protected]>wrote: > Hi Kevin > it seems you have something out of sync. Please try updating to latest SVN > and recompiling everything. > > Best Regards > Alfredo > > On Feb 27, 2013, at 5:07 PM, Kevin Hanser <[email protected]> wrote: > > I'm experiencing some issues getting PF_RING compiled for use with snort. > I initially had some issues getting pf_ring itself compiled on RHEL6 > related to the pf_ring aware igb and ixgbe drivers. Commenting these out > of the makefile and not building them allowed me to compile pf_ring. > > So I have pf_ring compiled and the kernel module loaded, and now I'm > trying to get the snort daq compiled. > > I do (from userland/snort/pfring-daq-module): > > autoreconf -ivf > ./configure > make > > And I receive the following errors: > > libtool: compile: gcc -DHAVE_CONFIG_H -I. -I > /home/jofcore/PF_RING/userland/lib -I /home/jofcore/PF_RING/kernel > -DBUILDING_SO -g -O2 -fvisibility=hidden -Wall -Wwrite-strings > -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security > -Wno-unused-parameter -fno-strict-aliasing -fdiagnostics-show-option > -pedantic -std=c99 -D_GNU_SOURCE -MT daq_pfring_la-daq_pfring.lo -MD -MP > -MF .deps/daq_pfring_la-daq_pfring.Tpo -c daq_pfring.c -fPIC -DPIC -o > .libs/daq_pfring_la-daq_pfring.o > In file included from daq_pfring.c:46: > pfring.h:134: error: expected specifier-qualifier-list before ‘socket_mode’ > pfring.h:325: error: expected declaration specifiers or ‘...’ before > ‘socket_mode’ > daq_pfring.c: In function ‘pfring_daq_open’: > daq_pfring.c:150: error: ‘recv_only_mode’ undeclared (first use in this > function) > daq_pfring.c:150: error: (Each undeclared identifier is reported only once > daq_pfring.c:150: error: for each function it appears in.) > daq_pfring.c:150: error: too many arguments to function > ‘pfring_set_socket_mode’ > daq_pfring.c: In function ‘pfring_daq_initialize’: > daq_pfring.c:253: error: ‘cluster_per_flow_2_tuple’ undeclared (first use > in this function) > daq_pfring.c:397: error: ‘cluster_per_flow_4_tuple’ undeclared (first use > in this function) > daq_pfring.c:398: error: ‘cluster_per_flow_5_tuple’ undeclared (first use > in this function) > make[1]: *** [daq_pfring_la-daq_pfring.lo] Error 1 > make[1]: Leaving directory > `/home/jofcore/snort/PF_RING-5.5.2/userland/snort/pfring-daq-module' > make: *** [all] Error 2 > > Anyone know why I can't seem to compile the daq module on rhel6.3? > > Is there any docs / howtos for how to compile/install pf_ring for snort? > I found some documentation, but it seems a bit old (dated 2011), and the > instructions there don't seem to work for me either.. ( > http://www.snort.org/assets/186/PF_RING_Snort_Inline_Instructions_daq_062.pdf > and http://www.metaflows.com/technology/pf-ring/) > > Thanks! > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > >
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
