<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi All!<br></div><div><br data-mce-bogus="1"></div><div>I am venturing into the land of XDP and eBPF. <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I am following the instructions from <a href="https://suricata.readthedocs.io/en/suricata-5.0.0-beta1/capture-hardware/ebpf-xdp.html">https://suricata.readthedocs.io/en/suricata-5.0.0-beta1/capture-hardware/ebpf-xdp.html</a>.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I receive errors from the make command for Suricata. <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>util-ebpf.c:359:13: error: implicit declaration of function 'bpf_program__set_ifindex' is invalid in C99 [-Werror,-Wimplicit-function-declaration]<br> bpf_program__set_ifindex(bpfprog, ifindex);<br> ^<br>util-ebpf.c:359:13: warning: this function declaration is not a prototype [-Wstrict-prototypes]<br>util-ebpf.c:362:13: error: implicit declaration of function 'bpf_map__set_ifindex' is invalid in C99 [-Werror,-Wimplicit-function-declaration]<br> bpf_map__set_ifindex(map, ifindex);<br> ^<br>util-ebpf.c:362:13: note: did you mean 'bpf_map__set_priv'?<br>/usr/local/include/bpf/libbpf.h:244:5: note: 'bpf_map__set_priv' declared here<br>int bpf_map__set_priv(struct bpf_map *map, void *priv,<br> ^<br>util-ebpf.c:362:13: warning: this function declaration is not a prototype [-Wstrict-prototypes]<br> bpf_map__set_ifindex(map, ifindex); ^<br></div><div><br data-mce-bogus="1"></div><div>I have found where someone had this error before and it was due to them having more than one libbpf.h. I do not believe this is the case for myself. <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div> I installed libbpf per the above instructions as well and Suricata sees it correctly per ldd.</div><div><br data-mce-bogus="1"></div><div>deb10-image suricata # ldd /usr/bin/suricata | grep libbpf<br> libbpf.so => /usr/local/lib64/libbpf.so (0x00007f8c9b5f9000)<br><br data-mce-bogus="1"></div><div>deb10-image suricata # ls -alh /usr/local/lib64/libbpf.so<br>-rwxr-xr-x 1 root staff 108K Aug 28 16:29 /usr/local/lib64/libbpf.so<br><br data-mce-bogus="1"></div><div>Any ideas as to why I am receiving this error?<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Jeremy Grove, SSCP</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Security Engineer</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Quadrant Information Security</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Learn more= about our managed SIEM <span class="Object" id="OBJ_PREFIX_DWT149_com_zimbra_url" style="color: #005a95; cursor: pointer;"><a href="https://a.quadrantsec.com/3D%22https://quadrantsec.com/SaganMSSP%22" target="_blank" style="color: #005a95; text-decoration: none; cursor: pointer;">people + product</a></span></span><br><br><br></div></div></div></body></html>