# binpac++ plugin error

**URL:** <https://community.zeek.org/t/binpac-plugin-error/3562>\
**Category:** Zeek\
**Created:** [April 19, 2015, 2:45am UTC](https://community.zeek.org/t/binpac-plugin-error/3562 "2015-04-19T02:45:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Troy\_Jordan](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@Troy\_Jordan](https://community.zeek.org/u/Troy_Jordan)\
**Post date:** [April 19, 2015, 2:45am UTC](https://community.zeek.org/t/binpac-plugin-error/3562/1 "2015-04-19T02:45:33Z")

</div>

I am working through section 3 of the binpac++ documentation to  
understand binpac++ analyzers are integrated into Bro.

(I'm running the HILTI/Binpac++ docker image, under Centos7.)

I am getting an error when confirming the binpac++ plugin is present:

root@df5e8fd99740:~# export BRO\_PLUGIN\_PATH=/opt/hilti/build/bro

root@df5e8fd99740:~# bro -NN ssh.evt

fatal error in /usr/local/bro/share/bro/base/init-bare.bro, line 1:  
cannot load plugin library  
/opt/hilti/build/bro//lib/Bro-Hilti.linux-x86\_64.so:  
/opt/hilti/build/bro//lib/Bro-Hilti.linux-x86\_64.so: undefined symbol:  
\_ZN6plugin6Plugin11MetaHookPreENS\_8HookTypeERKNSt3\_\_14listINS\_12HookArgumentENS2\_9allocatorIS4\_EEEE

Perhaps I have set the BRO\_PLUGIN\_PATH incorrectly?

- Troy

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [April 20, 2015, 5:06am UTC](https://community.zeek.org/t/binpac-plugin-error/3562/2 "2015-04-20T05:06:51Z")

</div>

Oh, there's actually a problem in the Docker file I believe. I'll see  
that I get that fixed.

Robin

---

<div class="post-metadata">

**Author:** ![A\_Bruno](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@A\_Bruno](https://community.zeek.org/u/A_Bruno)\
**Post date:** [June 18, 2015, 2:27pm UTC](https://community.zeek.org/t/binpac-plugin-error/3562/3 "2015-06-18T14:27:49Z")

</div>

Hello,

I encounter the same problem when I try to reproduce the “BinPAC++ Demo”.

I use bro 2.4-beta6 compiled from last revision sources.

Also I compiled Hilti from sources using the

Robin, Troy, have you found a solution on this problem that I could apply on a non docker context?

Thanks,

Bruno.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [June 18, 2015, 3:41pm UTC](https://community.zeek.org/t/binpac-plugin-error/3562/4 "2015-06-18T15:41:41Z")

</div>

I was hoping it's fixed now, both inside and outside of Docker. Are you  
using the most recent HILTI/BinPAC++ version?

The Docker image now seems to be working for folks.

Robin

---

<div class="post-metadata">

**Author:** ![A\_Bruno](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@A\_Bruno](https://community.zeek.org/u/A_Bruno)\
**Post date:** [June 18, 2015, 5:39pm UTC](https://community.zeek.org/t/binpac-plugin-error/3562/5 "2015-06-18T17:39:11Z")

</div>

Hello Robin,

Thanks for your answer.

In fact I have used the [http://github.org/rsmmr/install-clang](http://github.org/rsmmr/install-clang) script, so I’m afraid it is not the last HILTI sources.

I will try with the last HILTI sources if you say it is fixed on them.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/binpac-plugin-error/3562/6 "2022-05-06T15:42:36Z")

</div>