[Oisf-users] Suricata compilation issues with pf_ring

[Spransy, Derek]

Hi Jason,

Can you share which pf_ring packages you've used? I've also installed pf_ring via packages rather than compiling. Here's what I currently have installed:

pfring-6.1.1-58.x86_64
pfring-drivers-zc-dkms-1.2-0.noarch
pfring-dkms-6.1.1-156.noarch
e1000e-zc-3.0.4.1.162-1dkms.noarch.rpm
i40e-zc-1.1.23.162-1dkms.noarch.rpm
pfring-drivers-zc-dkms-1.2-0.noarch.rpm
igb-zc-5.2.5.162-1dkms.noarch.rpm
ixgbe-zc-3.22.3.156-1dkms.noarch.rpm

Thanks

________________________________________
From: lists at ish.cx <lists at ish.cx> on behalf of Jason Ish <lists at unx.ca>
Sent: Monday, September 21, 2015 5:15 PM
To: Spransy, Derek
Cc: oisf-users at lists.openinfosecfoundation.org
Subject: Re: [Oisf-users] Suricata compilation issues with pf_ring

On Mon, Sep 21, 2015 at 12:53 PM, Spransy, Derek <dsprans at emory.edu> wrote:
> Hello all,
>
> My apologies if this has been asked and answered previously, but I'm new to the list. I'm attempting to compile Suricata 2.0.8 on RHEL 7 with pf_ring (zero-copy) support. I encountered some problems while running configure during the linking of the pf_ring libraries. I found another listserv post that suggested setting LIBS="-lrt -lnuma" prior to running configure. This does indeed get me past the problems linking pf_ring, but later on I believe it causes issues with linking libpcap and file. The necessary packages are installed, and if I compile Suricata without pf_ring support, everything configures and compiles as expected.
>
> Here's a link to the output that I get when I compile with the LIBS variable defined, and without:
> https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fpastebin.com%2f8TfCAJQ3&data=01%7c01%7cdsprans%40emory.edu%7cac5588eb7ee8415de6bf08d2c2c9bdc1%7ce004fb9cb0a4424fbcd0322606d5df38%7c1&sdata=6bpl2CgNcGTShjQont1TDbus3VZ0YzXwzCjMnww8utk%3d
>
> And here's a snipped of the errors in config.log when run configure with and without the LIBS variable defined:
> https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fpastebin.com%2fSFz0GR26&data=01%7c01%7cdsprans%40emory.edu%7cac5588eb7ee8415de6bf08d2c2c9bdc1%7ce004fb9cb0a4424fbcd0322606d5df38%7c1&sdata=hB4fdb%2fWMZNI0%2fCHkYoYbUx7mA29v%2flI8LmdABlJNn0%3d
>
> If anyone has seen this previously, can you suggest a workaround? Any help would be appreciated!

I wonder if this has more to do with how PF_RING was built?  I just
used the PF_RING packages for CentOS 7 and build Suricata just fine,
then I built it PF_RING with the latest git checkout and it built just
fine again - I also checked to make sure it was linking against the
pfring enabled libpcap.

Sorry I don't have a better answer for you at this time.

________________________________

This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).