Hi Carlo,<br><br>I just followed the guide here for the pfring installation:<br><a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1204">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1204</a><br>
<br>and i was able to build Suricata with pfring without any trouble on CenOS.<br>-<br><br>[user@localhost oisf]$ LD_LIBRARY_PATH=/usr/local/pfring/lib suricata --build-info<br>[28175] 29/10/2012 -- 18:59:54 - (suricata.c:540) <Info> (SCPrintBuildInfo) -- This is Suricata version 1.4dev (rev bca1b7c)<br>
[28175] 29/10/2012 -- 18:59:54 - (suricata.c:613) <Info> (SCPrintBuildInfo) -- Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 PF_RING AF_PACKET HAVE_PACKET_FANOUT LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK HAVE_HTP_TX_GET_RESPONSE_HEADERS_RAW <br>
[28175] 29/10/2012 -- 18:59:54 - (suricata.c:627) <Info> (SCPrintBuildInfo) -- 64-bits, Little-endian architecture<br>[28175] 29/10/2012 -- 18:59:54 - (suricata.c:629) <Info> (SCPrintBuildInfo) -- GCC version 4.4.6 20120305 (Red Hat 4.4.6-4), C version 199901<br>
[28175] 29/10/2012 -- 18:59:54 - (suricata.c:635) <Info> (SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1<br>[28175] 29/10/2012 -- 18:59:54 - (suricata.c:638) <Info> (SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2<br>
[28175] 29/10/2012 -- 18:59:54 - (suricata.c:641) <Info> (SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4<br>[28175] 29/10/2012 -- 18:59:54 - (suricata.c:644) <Info> (SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8<br>
[28175] 29/10/2012 -- 18:59:54 - (suricata.c:647) <Info> (SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_16<br><br>[user@localhost oisf]$ cat /proc/net/pf_ring/info<br>PF_RING Version : 5.4.6 ($Revision: exported$)<br>
Ring slots : 4096<br>Slot version : 14<br>Capture TX : Yes [RX+TX]<br>IP Defragment : No<br>Socket Mode : Standard<br>Transparent mode : Yes (mode 0)<br>Total rings : 0<br>
Total plugins : 0<br>[user@localhost oisf]$ <br><br>[user@localhost oisf]$ uname -a<br>Linux localhost.localdomain 2.6.32-279.5.2.el6.x86_64 #1 SMP Fri Aug 24 01:07:11 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux<br>[user@localhost oisf]$ <br>
<br>[user@localhost oisf]$ cat /etc/redhat-release<br>CentOS release 6.3 (Final)<br><br><br>My configure/compile line was:<br><br>sudo git clone git://<a href="http://phalanx.openinfosecfoundation.org/oisf.git">phalanx.openinfosecfoundation.org/oisf.git</a><br>
cd oisf/ <br> sudo ./autogen.sh <br> ./configure --enable-pfring --with-libpfring-includes=/usr/local/pfring/include --with-libpfring-libraries=/usr/local/pfring/lib --with-libpcap-includes=/usr/local/pfring/include --with-libpcap-libraries=/usr/local/pfring/lib <br>
make clean <br>make <br>sudo make install<br>sudo ldconfig<br><br>or if you like an all-in-one line, just execute:<br><br>sudo git clone git://<a href="http://phalanx.openinfosecfoundation.org/oisf.git">phalanx.openinfosecfoundation.org/oisf.git</a> && cd oisf/ && sudo ./autogen.sh && ./configure --enable-pfring --with-libpfring-includes=/usr/local/pfring/include --with-libpfring-libraries=/usr/local/pfring/lib --with-libpcap-includes=/usr/local/pfring/include --with-libpcap-libraries=/usr/local/pfring/lib && make clean && make && sudo make install && sudo ldconfig<br>
<br>Thanks<br><br><br><div class="gmail_quote">On Mon, Oct 29, 2012 at 9:21 AM, Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
ooops sorry Carlo,<br><br>I will try to reproduce the issue on a virtual test CentOS here ... see if i hit the same problem....<div class="HOEnZb"><div class="h5"><br><br><div class="gmail_quote">On Mon, Oct 29, 2012 at 2:17 PM, C. L. Martinez <span dir="ltr"><<a href="mailto:carlopmart@gmail.com" target="_blank">carlopmart@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I can't do this Peter ... I haven't suricata binary yet ...<br>
<div><div><br>
<br>
On Mon, Oct 29, 2012 at 12:34 PM, Peter Manev <<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>> wrote:<br>
> Hi,<br>
><br>
> What would be the outcome of the following :<br>
><br>
> sudo LD_LIBRARY_PATH=/usr/local/pfring/lib suricata --pfring-int=eth3<br>
> --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow -c<br>
> /etc/suricata/suricata.yaml -D<br>
><br>
> for example?<br>
><br>
> thank you<br>
><br>
><br>
> On Mon, Oct 29, 2012 at 1:08 PM, C. L. Martinez <<a href="mailto:carlopmart@gmail.com" target="_blank">carlopmart@gmail.com</a>><br>
> wrote:<br>
>><br>
>> I have modified location for pf_ring and libpcap libs. My commands:<br>
>><br>
>> git clone git://<a href="http://phalanx.openinfosecfoundation.org/oisf.git" target="_blank">phalanx.openinfosecfoundation.org/oisf.git</a> suricata-git<br>
>> cd suricata-git<br>
>> sh autogen.sh<br>
>> ./configure --prefix=/opt/suricata --enable-pfring --enable-af-packet<br>
>> --enable-profiling --with-libpfring-includes=/opt/pf_ring/include<br>
>> --with-libpfring-libraries=/opt/pf_ring/lib<br>
>> --with-libpcap-includes=/opt/libpcap/include<br>
>> --with-libpcap-libraries=/opt/libpcap/lib<br>
>><br>
>> I use same compile options for 1.3.2 version ... And, yes I see the<br>
>> guide in suricata's redmine, but my host is a CentOS 6.3 64bits ..<br>
>><br>
>> On Mon, Oct 29, 2012 at 12:03 PM, Peter Manev <<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>><br>
>> wrote:<br>
>> > Hi ,<br>
>> ><br>
>> > What is our exact start command?<br>
>> > I am not sure if you have seen this guide -<br>
>> ><br>
>> > <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1204" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1204</a><br>
>> ><br>
>> ><br>
>> > thank you<br>
>> ><br>
>> ><br>
>> > On Mon, Oct 29, 2012 at 12:57 PM, C. L. Martinez <<a href="mailto:carlopmart@gmail.com" target="_blank">carlopmart@gmail.com</a>><br>
>> > wrote:<br>
>> >><br>
>> >> Uhmm, strange. I have changed where pfring, libpcap libs and includes<br>
>> >> are located and error is:<br>
>> >><br>
>> >> configure:17890: gcc -o conftest -g -O2 -Wextra -Wall<br>
>> >> -fno-strict-aliasing -fno-tree-pre -Wno-unused-parameter -std=gnu99<br>
>> >> -march=native -DPROFILING -DHAVE_LIBNET11 -D_BSD_SOURCE<br>
>> >> -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H<br>
>> >> -DHAVE_LIBNET_ICMPV6_UNREACH -DHAVE_PFRING -I/opt/pf_ring/include<br>
>> >> -L/opt/pf_ring/lib conftest.c -lpfring -lpcap -lnet -lpthr<br>
>> >> ead -lyaml -lpcre >&5<br>
>> >> /usr/bin/ld: cannot find -lpcap<br>
>> >><br>
>> >> Why?? I have setup LD_LIBRARY_PATH variable in this environment to<br>
>> >> point to libpcap and pfring libs, and my ldconfig output is:<br>
>> >><br>
>> >> /opt/libpcap/lib:<br>
>> >> libpcap.so.1 -> libpcap.so.1.1.1<br>
>> >> /usr/lib64/mysql:<br>
>> >> libmysqlclient.so.16 -> libmysqlclient.so.16.0.0<br>
>> >> libmysqlclient_r.so.16 -> libmysqlclient_r.so.16.0.0<br>
>> >> /opt/pf_ring/lib:<br>
>> >> libpfring.so -> libpfring.so<br>
>> >><br>
>> >> ....<br>
>> >><br>
>> >> At this time, it is the same error for release 1.3.2 and from git<br>
>> >> version<br>
>> >> ...<br>
>> >><br>
>> >><br>
>> >> On Sat, Oct 27, 2012 at 7:27 AM, Victor Julien <<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>><br>
>> >> wrote:<br>
>> >> > On 10/26/2012 10:13 PM, Martin Holste wrote:<br>
>> >> >> --with-libpcre-includes=/usr/local/pcre-8.20-RC1/include<br>
>> >> >> --with-libpcre-libraries=/usr/local/pcre-8.20-RC1/lib<br>
>> >> ><br>
>> >> > pcre is at 8.31 already, time to upgrade :)<br>
>> >> ><br>
>> >> > --<br>
>> >> > ---------------------------------------------<br>
>> >> > Victor Julien<br>
>> >> > <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
>> >> > PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
>> >> > ---------------------------------------------<br>
>> >> ><br>
>> >> > _______________________________________________<br>
>> >> > Oisf-users mailing list<br>
>> >> > <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
>> >> > <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>> >> _______________________________________________<br>
>> >> Oisf-users mailing list<br>
>> >> <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
>> >> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>> ><br>
>> ><br>
>> ><br>
>> ><br>
>> > --<br>
>> > Regards,<br>
>> > Peter Manev<br>
>> ><br>
>> _______________________________________________<br>
>> Oisf-users mailing list<br>
>> <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
>> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
><br>
><br>
><br>
><br>
> --<br>
> Regards,<br>
> Peter Manev<br>
><br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div><br><br clear="all"><br></div></div><span class="HOEnZb"><font color="#888888">-- <br><div>Regards,</div>
<div>Peter Manev</div><br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div>Regards,</div>
<div>Peter Manev</div><br>