[Oisf-users] Suricata from GIT with PF_RING on Ubuntu 12 LTS query

[Chris Wakelin]

I don't build or install it as root :)

Looks like you're missing telling it where pfring libraries are?

I use:

./configure --enable-pfring
--with-libpfring-libraries=/opt/RDGpfring/lib
--with-libpfring-includes=/opt/RDGpfring/include
--with-libpcap-libraries=/opt/RDGpfring/lib
--with-libpcap-includes=/opt/RDGpfring/include
LD_RUN_PATH=/opt/RDGpfring/lib --prefix=/opt/RDGsuricata
--enable-pcre-jit --with-libpcre-libraries=/opt/RDGpcre-sljit/lib/
--with-libpcre-includes=/opt/RDGpcre-sljit/include/
--with-libnss-includes=/usr/include/nss/
--with-libnspr-includes=/usr/include/nspr/

on Ubuntu 10.04, where PF_RING is installed in /opt/RDGpfring etc. (I
also have symlinks to the PF_RING libpcap in /usr/local/lib, though I
could have added things to ld.conf I guess).

One gotcha with PF_RING is you may need to "cp -R <PF_RING
distribution>/kernel/linux <PF_RING install>/include" to get pf_ring.h
in the right place.

Best Wishes,
Chris

On 12/06/2012 13:48, Peter Bates wrote:
> 
> Hello all
> 
> Time for all to tell me to RTFM but I've mostly been following 
> https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104
>
> 
- on a test system running Ubuntu 12 LTS, 64-bit.
> 
> Building PF_RING, fine.
> 
> When I get to building Suricata, the instructions do state:
> 
> git clone git://phalanx.openinfosecfoundation.org/oisf.git cd oisf 
> sudo ./autogen.sh sudo ./configure --enable-pfring && make && make
> install
> 
> Being a shy retiring type I omitted sudo for autogen.sh and
> configure, and am then greeted with:
> 
> checking for pfring_open in -lpfring... no
> 
> ERROR! --enable-pfring was passed but the library was not found or 
> version is >4, go get it from http://www.ntop.org/PF_RING.html
> 
> Can anyone explain why the configure (and subsequently the make) 
> requires sudo/elevating to root?
> 
> Thanks.
> 
> 
> _______________________________________________ Oisf-users mailing
> list Oisf-users at openinfosecfoundation.org 
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> 

-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 2908
Whiteknights, Reading, RG6 2AF, UK              Fax: +44 (0)118 975 3094