<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
p.western, li.western, div.western
{mso-style-name:western;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">I would also like to add, this servers is running RHEL 6, and that I installed pf_ring from today’s rpm build. I also installed pf_ring-aware libpcap from source.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">It appears that a similar User had the same problem, but was able to remedy the situation by installing the proper pf_ring-aware libpcap which I have already done:
<a href="https://lists.openinfosecfoundation.org/pipermail/oisf-users/2016-February/005695.html">
https://lists.openinfosecfoundation.org/pipermail/oisf-users/2016-February/005695.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I also double-checked to ensure that both libcap-ng-devel and the relevant nspr packages are installed, and they are.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Adam<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Oisf-users [mailto:oisf-users-bounces@lists.openinfosecfoundation.org]
<b>On Behalf Of </b>Adam Witt<br>
<b>Sent:</b> Tuesday, April 05, 2016 9:28 PM<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> [Oisf-users] pf_ring and libnspr<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Greetings—<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While attempting to ./configure suricata 3.0.1, I’m encountering an issue when applying the --enable-pfring flag. I receive the error below:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">./configure \<o:p></o:p></p>
<p class="MsoNormal">--prefix=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--enable-pfring \<o:p></o:p></p>
<p class="MsoNormal">--enable-geoip \<o:p></o:p></p>
<p class="MsoNormal">--with-libpfring-includes=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--with-libpfring-libraries=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--with-libpcap-includes=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--with-libpcap-libraries=<DIR><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><snip><o:p></o:p></p>
<p class="MsoNormal">checking for libnspr... yes<o:p></o:p></p>
<p class="MsoNormal">checking nspr.h usability... yes<o:p></o:p></p>
<p class="MsoNormal">checking nspr.h presence... yes<o:p></o:p></p>
<p class="MsoNormal">checking for nspr.h... yes<o:p></o:p></p>
<p class="MsoNormal">checking for PR_GetCurrentThread in -lnspr4... no<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> ERROR! libnspr library not found, go get it<o:p></o:p></p>
<p class="MsoNormal"> from Mozilla or your distribution:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Ubuntu: apt-get install libnspr4-dev<o:p></o:p></p>
<p class="MsoNormal"> Fedora: yum install nspr-devel<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">...yet by removing the --enable-pfring flag and leaving everything else as-is, everything works nicely:<o:p></o:p></p>
<p class="MsoNormal">./configure \<o:p></o:p></p>
<p class="MsoNormal">--prefix=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--enable-geoip \<o:p></o:p></p>
<p class="MsoNormal">--with-libpfring-includes=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--with-libpfring-libraries=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--with-libpcap-includes=<DIR> \<o:p></o:p></p>
<p class="MsoNormal">--with-libpcap-libraries=<DIR><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">checking for libnspr... yes<o:p></o:p></p>
<p class="MsoNormal">checking nspr.h usability... yes<o:p></o:p></p>
<p class="MsoNormal">checking nspr.h presence... yes<o:p></o:p></p>
<p class="MsoNormal">checking for nspr.h... yes<o:p></o:p></p>
<p class="MsoNormal">checking for PR_GetCurrentThread in -lnspr4... yes<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thoughts? Any help is greatly appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Adam<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="mso-margin-top-alt:13.7pt;margin-right:0in;margin-bottom:13.7pt;margin-left:0in">
<a name="_GoBack"></a><i>Need to send me a file too big for email? You can upload it at
</i><a href="http://www.westernalliancebancorp.sharefile.com/"><b><i>www.westernalliancebancorp.sharefile.com</i></b></a><i>
</i><o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">
<hr size="2" width="100%" align="center">
</span></div>
<p class="western" style="margin-bottom:0in;margin-bottom:.0001pt"><span style="font-size:7.0pt;font-family:"Arial","sans-serif";color:gray">CONFIDENTIALITY. This email and any attachments are confidential, except where the email states it can be disclosed;
it may also be privileged. If received in error, please do not disclose the contents to anyone, but notify the sender by return email and delete this email (and any attachments) from your system.</span><o:p></o:p></p>
<p class="western" style="margin-bottom:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
</div>
<p style="margin-top: 0.19in; margin-bottom: 0.19in"><a name="_GoBack"></a><font face="Times New Roman, serif"><font size="3"><i>Need to send me a file too big for email? You can upload it at
</i><a href="http://www.westernalliancebancorp.sharefile.com/"><i><b>www.westernalliancebancorp.sharefile.com</b></i></a><i>
</i></font></font></p>
<hr>
<p></p>
<p class="western" align="CENTER" style="margin-bottom: 0in"></p>
<p class="western" style="margin-bottom: 0in"><font color="#808080"><font face="Arial, serif"><font size="1" style="font-size: 7pt">CONFIDENTIALITY. This email and any attachments are confidential, except where the email states it can be disclosed; it may also
be privileged. If received in error, please do not disclose the contents to anyone, but notify the sender by return email and delete this email (and any attachments) from your system.</font></font></font></p>
<p class="western" style="margin-bottom: 0in"><br>
</p>
</body>
</html>