bro 2.5.2 not compatible with PF_RING 7.0.0

Zeek
1

Hi all,
Recently, I use bro-2.5.2 with PF_RING-7.0.0, but there is a problem when I do bro source code configure, it seems that bro cannot detect new version of PF_RING, here is the log:

Looking for pcap_get_pfring_id - not found.

I wonder if it is caused by the FindPCAP.cmake in cmake? What should I do to solve this problem?

Any insight would be helpful.

Bowen Li

2

I just checked their source code and it appears that that function still exists in their libpcap wrapper. I'm not sure that the correct libpcap is being checked for pf_ring support. What was your full configure command and where is pf_ring 7.0 installed?

   .Seth