Good question, and sounds like you've done some work. Have you tried to build without pfring and just use libpcap? I'd be curious to see if it works.
----- Original Message ----- From: [email protected] <[email protected]> To: [email protected] <[email protected]> Sent: Thu Jul 30 19:11:19 2009 Subject: [Ntop] Ntop make fails with undefined reference to pcap_parse Hi ntop! This is my first post, I hope this is on topic! I have a small problem with "make" with ntop on a Debian 5.0.2 with PF_RING. The solution might very well be trivial, but I just can't figure out why it fails. First, for installation advice for PF_RING, I've loosely followed this link (As the howto above is a bit old, I use libpcap1.0 instead of 0.9.4.): http://www.bjou.de/blog/2006/12/advanced-packet-capturing-howto-pf_ring-napi-and-extended-libpcap-on-debian-sarge/ After completing the PF_RING part and booting into the new kernel, PF_RING seems to be installed correct: # ./pfcount –i eth1 # # ========================= # Absolute Stats: [328930 pkts rcvd][0 pkts dropped] # Total Pkts=328930/Dropped=0.0 % # 328930 pkts - 247229098 bytes [25108.2 pkt/sec - 150.97 Mbit/sec] # ========================= # Actual Stats: 23337 pkts [1003.7 ms][23250.0 pkt/sec] # ========================= And as the howto specifies, I find both ring and pcap in ldconfig: # ldconfig -v |grep pfring # libpfring.so.0.9.4 -> libpfring.so.0.9.4 # ldconfig -v |grep pcap # libpcap.so.1.0.0 -> libpcap.so.1.0.0 So far so good! For ntop install, I do the following: # ./autogen.sh --noconfig # ./configure CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib -lpfring -lpcap -lpthread" # make # make install (note that the howto does not include the -lpthread, but without this string, configure fails) ./configure works without any warnings or errors, but when I try "make", it faults after a few seconds with the following, please see pasted output below: ### start paste ### root/ntop-3.3.10/GeoIP-1.4.6/libGeoIP/ -L/root/ntop-3.3.10/GeoIP-1.4.6/libGeoIP/.libs/ -lGeoIP -L/usr/local/lib -lpfring -lpcap -lpthread -L/usr/local/lib -L/opt/local/lib -o ntop ntop-main.o ntop-admin.o libntopreport.la libntop.la -L/root/ntop-3.3.10/lua-5.1.4/src -llua -lpthread -lcrypt -lc -lssl -lcrypto -lrrd_th -levent -lgdbm -lz -L/usr/local/lib -lpcap gcc -g -O2 -I/usr/local/include -I/opt/local/include -Wshadow -Wpointer-arith -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -fPIC -DPIC -I/root/ntop-3.3.10/GeoIP-1.4.6/libGeoIP/ -o .libs/ntop ntop-main.o ntop-admin.o -L/root/ntop-3.3.10/GeoIP-1.4.6/libGeoIP/.libs/ /root/ntop-3.3.10/GeoIP-1.4.6/libGeoIP/.libs//libGeoIP.so -L/usr/local/lib -lpfring -L/opt/local/lib ./.libs/libntopreport.so ./.libs/libntop.so -L/root/ntop-3.3.10/lua-5.1.4/src -llua -lpthread -lcrypt -lc -lssl -lcrypto /usr/lib/librrd_th.so -levent /usr/lib/libgdbm.so -lz -lpcap ./.libs/libntop.so: undefined reference to `pcap_parse' collect2: ld returned 1 exit status make[2]: *** [ntop] Error 1 make[2]: Leaving directory `/root/ntop-3.3.10' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/ntop-3.3.10' make: *** [all] Error 2 ### stop paste ### The file .libs/libntop.so is a binary, but I assume it reads the .libs/libntop.la that has the following text regarding "pcap_parse": ### start paste ### # Directory that this library needs to be installed in: libdir='/usr/local/lib' relink_command="(cd /root/ntop-3.3.10; /bin/sh ./libtool --tag=CC --mode=relink gcc -g -O2 -I/usr/local/include -I/opt/local/include -Wshadow -Wpointer-arith -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -fPIC -DPIC -I/root/ntop-3.3.10/GeoIP-1.4.6/libGeoIP/ -release 3.3.10 -export-dynamic -L/root/ntop-3.3.10/GeoIP-1.4.6/libGeoIP/.libs/ -lGeoIP -L/usr/local/lib -lpfring -lpcap -lpthread -L/usr/local/lib -L/opt/local/lib -o libntop.la -rpath /usr/local/lib address.lo argv.lo dataFormat.lo fcUtils.lo globals-core.lo hash.lo iface.lo initialize.lo l7.lo leaks.lo ntop.lo pbuf.lo database.lo plugin.lo prefs.lo protocols.lo sessions.lo term.lo util.lo utildl.lo traffic.lo vendor.lo version.lo ntop_darwin.lo -L/root/ntop-3.3.10/lua-5.1.4/src -llua -lpthread -lcrypt -lc -lssl -lcrypto -lrrd_th -levent -lgdbm -lz -L/usr/local/lib @inst_prefix_dir@)" ### stop paste ### I can't find any good links on this issue, the only problem I might guess is that libpfring and libpcap is different versions, but I could find no information about this being a problem. Any ideas or advice would be greatly appriciated. Thanks! -- Christian Jacobsen _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
