af_packet plugin doesnt compile in 2.5

Zeek
1

In the 2.5 release, the af_packet plugin is not compiling on rh6.8. I am getting"

…/RX_Ring.h:27:21: error: ‘tpacket_hdr’ has not been declared
bool GetNextPacket(tpacket3_hdr** hdr);

…/RX_Ring.h:35:22: error: field ‘layout’ has incomplete type
struct tpacket_req3 layout;

Thanks!

Please note this compiles on rh7. Just not rh6.

2

Hi Erik,

In the 2.5 release, the af_packet plugin is not compiling on rh6.8.

"Make sure the kernel headers are installed and your kernel supports
PACKET_FANOUT and TPACKET_V3."

As far as I know, RHEL 6.8 is based on a 2.6 kernel, which does not
support TPACKET_V3. I think something around the 3.10 kernel is a
minimum requirement. Furthermore there have been issues with later
kernel versions that have been fixed for 4.4.16, 4.6.5 and 4.7. I don't
know whether the fix made it into the 3.X kernels.

Best regards,
Jan