Ok, so I made a bit of cleaning and began from semi-scratch (did not uninstall the first packages needed for suricata itself), going very carefuly.<br><br>Righ now the problem is still here. I'll try different things and keep you posted.<br>
<br><br><br>However, through this install process, I've noticed glitches in the INSTALL.PF_RING that you might want to know of and correct.<br><br>At the part where we have to go to PF_RING/userland/tcpdump-4.0.0/<br>
Instructions says to do :<br><br><i>sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/' Makefile<br>
sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/' Makefile.in<br>sed -i -e 's/-I \.\.\/libpcap-1\.0\.0-ring/-I \/opt\/PF_RING\/include/' Makefile<br>sed -i -e 's/-I \.\.\/libpcap-1\.0\.0-ring/-I \/opt\/PF_RING\/include/' Makefile.in<br>
sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring\/-L /\/opt\/PF_RING\/lib\//' Makefile<br>sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring\/-L /\/opt\/PF_RING\/lib\//' Makefile.in</i><br><br>First thing, I noticed that there is no Makefile, just Makefile.in. Don't know if it's important, though.<br>
Second thing I noticed, in these sed commands, there seems to be some "\" and "/" that should not be there in the lasts ones. The result is that the parameter is not changed in the file. Correcting <i>sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring<b style="color: rgb(255, 0, 0);">\</b>/-L <b style="color: rgb(255, 0, 0);">/</b>\/opt\/PF_RING\/lib<span style="color: rgb(255, 0, 0);">\/</span>/' Makefile.in </i>to<i> </i><i>sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring/-L \/opt\/PF_RING\/lib/' Makefile.in</i> made the trick for me.<br>
<br><br><br>If there is anything I can provide to help find where this error comes from, let me know.<br><br>Regards,<br><br>Sylvain<br><br>
<br><div class="gmail_quote">2010/11/16 Will Metcalf <span dir="ltr"><<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hmm, Yes I did indeed try. There was a bug in PF_RING that I reported<br>
to Luca and was fixed and now it works properly. Are you still<br>
getting the same error message? Perhaps you should use dkms to remove<br>
any versions of PF_RING modules you have installed. Once you have<br>
done this nuke the /opt/PF_RING/ dir and restart the install procedure<br>
from scratch.<br>
<br>
Regards,<br>
<font color="#888888"><br>
Will<br>
</font><div><div></div><div><br>
On Tue, Nov 16, 2010 at 3:20 AM, Sylvain Chillaud<br>
<<a href="mailto:sylvain.chillaud@gmail.com" target="_blank">sylvain.chillaud@gmail.com</a>> wrote:<br>
> bump<br>
><br>
> I've been trying with the latest rev of PF_RING but I still get the same<br>
> error.<br>
><br>
> Did you give it a try, Will ?<br>
><br>
> 2010/10/5 Will Metcalf <<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>><br>
>><br>
>> Thats what it sounds like to me as well. Whenever I get 20 minutes or<br>
>> so I can try to build on my end from the latest PF_RING version.<br>
>><br>
>> Regards,<br>
>><br>
>> Will<br>
>><br>
>> On Tue, Oct 5, 2010 at 8:04 AM, Victor Julien <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>> wrote:<br>
>> > Sylvain Chillaud wrote:<br>
>> >> Hello,<br>
>> >><br>
>> >> I've been trying to install suricata with pf_ring, following the<br>
>> >> instructions in INSTALL.PF_RING in the doc directory of the<br>
>> >> suricata-1.0.2 tarball (and the giude on the oisf website).<br>
>> >> I've managed to configure and compile it, but when running it I get the<br>
>> >> following errors :<br>
>> >><br>
>> >><br>
>> >> /[16815] 5/10/2010 -- 12:11:46 - (source-pfring.c:248) <Info><br>
>> >> (ReceivePfringThreadInit) -- Going to use cluster-id 99<br>
>> >> [16815] 5/10/2010 -- 12:11:46 - (source-pfring.c:255) <Info><br>
>> >> (ReceivePfringThreadInit) -- going to use interface eth2<br>
>> >> Wrong RING version: kernel is 12, libpfring was compiled with 9<br>
>> >> [16815] 5/10/2010 -- 12:11:46 - (source-pfring.c:260) <Error><br>
>> >> (ReceivePfringThreadInit) -- [ERRCODE: SC_ERR_PF_RING_OPEN(34)] -<br>
>> >> pfring_open error<br>
>> >> [16781] 5/10/2010 -- 12:11:46 - (stream-tcp.c:370) <Info><br>
>> >> (StreamTcpInitConfig) -- stream "max_sessions": 262144<br>
>> >> [16781] 5/10/2010 -- 12:11:46 - (stream-tcp.c:382) <Info><br>
>> >> (StreamTcpInitConfig) -- stream "prealloc_sessions": 32768<br>
>> >> [16781] 5/10/2010 -- 12:11:46 - (stream-tcp.c:392) <Info><br>
>> >> (StreamTcpInitConfig) -- stream "memcap": 33554432<br>
>> >> [16781] 5/10/2010 -- 12:11:46 - (stream-tcp.c:399) <Info><br>
>> >> (StreamTcpInitConfig) -- stream "midstream" session pickups: disabled<br>
>> >> [16781] 5/10/2010 -- 12:11:46 - (stream-tcp.c:407) <Info><br>
>> >> (StreamTcpInitConfig) -- stream "async_oneside": disabled<br>
>> >> [16781] 5/10/2010 -- 12:11:46 - (stream-tcp.c:416) <Info><br>
>> >> (StreamTcpInitConfig) -- stream.reassembly "memcap": 67108864<br>
>> >> [16781] 5/10/2010 -- 12:11:46 - (stream-tcp.c:436) <Info><br>
>> >> (StreamTcpInitConfig) -- stream.reassembly "depth": 1048576<br>
>> >> [16781] 5/10/2010 -- 12:11:47 - (tm-threads.c:1416) <Error><br>
>> >> (TmThreadWaitOnThreadInit) -- [ERRCODE: SC_ERR_THREAD_INIT(49)] -<br>
>> >> thread<br>
>> >> "ReceivePfring" closed on initialization.<br>
>> >> [16781] 5/10/2010 -- 12:11:47 - (suricata.c:1128) <Error> (main) --<br>
>> >> [ERRCODE: SC_ERR_INITIALIZATION(45)] - Engine initialization failed,<br>
>> >> aborting.../<br>
>> >><br>
>> >><br>
>> >><br>
>> >> The server is not a clean server (as in : just installed), there are<br>
>> >> other applications on it, including a snort.<br>
>> >> It is a debian 5 lenny, kernel 2.6.26-2-amd64.<br>
>> >><br>
>> >> I used aptitude to upgrade/install the packages needed, got some errors<br>
>> >> with libpcap-dev and libpcap0.8-dev (as if the files were corrupted, it<br>
>> >> couldn't open them), but these are said to be required for the install<br>
>> >> without pf_ring as well, and suricata without pf_ring options started<br>
>> >> all right anyway, so I guessed it was ok.<br>
>> >><br>
>> >> But when installing and using pfring options (/suricata --pfring-int<br>
>> >> eth1 --pfring-cluster-id=99 --pfring-cluster-type cluster_flow -c<br>
>> >> /etc/suricata/suricata.yaml/), I get these error messages.<br>
>> >> PF_RING is the last version I could get at<br>
>> >> /<a href="https://svn.ntop.org/svn/ntop/trunk/PF_RING//" target="_blank">https://svn.ntop.org/svn/ntop/trunk/PF_RING//</a> though I got it via a<br>
>> >> windows svn and not via the server(I don't think it changes anything,<br>
>> >> though).<br>
>> >><br>
>> >> I've searched but have not found any reference to the errcode or any of<br>
>> >> the other error messages, thus I'd like to ask if someone have an idea<br>
>> >> of the problem.<br>
>> ><br>
>> > This error "Wrong RING version: kernel is 12, libpfring was compiled<br>
>> > with 9" sounds pretty serious to me. Mismatch between kernel pfring<br>
>> > version and the userland lib?<br>
>> ><br>
>> > Cheers,<br>
>> > Victor<br>
>> > --<br>
>> > ---------------------------------------------<br>
>> > Victor Julien<br>
>> > <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
>> > PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
>> > ---------------------------------------------<br>
>> ><br>
>> > _______________________________________________<br>
>> > Oisf-users mailing list<br>
>> > <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
>> > <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>> ><br>
><br>
><br>
</div></div></blockquote></div><br>