[Oisf-users] 1.3beta2 and no af-packet support detected?

[Eoin Miller]

On 6/12/2012 21:58, Victor Julien wrote:
> So when you just do "./configure" it doesn't detect it? Can you share
> your config.log?
> 

Yeaup, looks like the configure script differs in what it checks for
between 1.2.1 and 1.3beta2:

suricata-1.2.1/configure:
=====================================================================
---SNIP---
# AF_PACKET support
# Check whether --enable-af-packet was given.
if test "${enable_af_packet+set}" = set; then :
  enableval=$enable_af_packet;
else
  enable_af_packet=no
fi
  if test "x$enable_af_packet" = "xyes"; then :
ac_fn_c_check_decl "$LINENO" "AF_PACKET" "ac_cv_have_decl_AF_PACKET"
---SNIP---

suricata-1.3beta2/configure:
=====================================================================
---SNIP---
# AF_PACKET support
# Check whether --enable-af-packet was given.
if test "${enable_af_packet+set}" = set; then :
  enableval=$enable_af_packet;
else
  enable_af_packet=yes
fi
  if test "x$enable_af_packet" = "xyes"; then :
ac_fn_c_check_decl "$LINENO" "TPACKET_V2" "ac_cv_have_decl_TPACKET_V2"
---SNIP---

Looks like we need a newer kernel. Just between us, CentOS isn't always
on the cutting edge.

-- Eoin