# Configure error linking libpcap and pthread **URL:** \ **Category:** Zeek\ **Created:** [August 28, 2014, 9:52pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245 "2014-08-28T21:52:12Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [August 28, 2014, 9:52pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/1 "2014-08-28T21:52:12Z")
Hey all, I’m having a really tough time getting PF\_RING working with Bro in a threaded fashion. I have PF\_RING compiled and working fine (tcpdump test works fine with Transparent mode = 2): PF\_RING Version : 6.0.2 ($Revision: exported$) Total rings : 0 Standard (non DNA) Options Ring slots : 4096 Slot version : 16 Capture TX : No [RX only] IP Defragment : No Socket Mode : Standard Transparent mode : No [mode 2] Total plugins : 0 Cluster Fragment Queue : 0 Cluster Fragment Discard : 0 Bro is version 2.3 (sha1 - 79397be0e351165d44047b044d29b5e6580532cc bro-2.3.tar.gz) OS is CentOS 6.4 running 2.6.32-358.11.1.el6.x86\_64 When I try and configure against my PF\_RING libraries, I get this: ./configure --with-pcap=/opt/pfring Build Directory : build Source Directory: /root/src/bro-2.3 – The C compiler identification is GNU – The CXX compiler identification is GNU – Check for working C compiler: /usr/bin/gcc – Check for working C compiler: /usr/bin/gcc – works – Detecting C compiler ABI info – Detecting C compiler ABI info - done – Check for working CXX compiler: /usr/bin/c++ – Check for working CXX compiler: /usr/bin/c++ – works – Detecting CXX compiler ABI info – Detecting CXX compiler ABI info - done – Found sed: /bin/sed – Found Perl: /usr/bin/perl – Found FLEX: 2.5.35 – Found BISON: /usr/bin/bison – Found PCAP: /opt/pfring/lib/libpcap.so – Performing Test PCAP\_LINKS\_SOLO – Performing Test PCAP\_LINKS\_SOLO - Failed – Looking for include files CMAKE\_HAVE\_PTHREAD\_H – Looking for include files CMAKE\_HAVE\_PTHREAD\_H - found – Looking for pthread\_create in pthreads – Looking for pthread\_create in pthreads - not found – Looking for pthread\_create in pthread – Looking for pthread\_create in pthread - found – Found Threads: TRUE – Performing Test PCAP\_NEEDS\_THREADS – Performing Test PCAP\_NEEDS\_THREADS - Failed CMake Error at cmake/FindPCAP.cmake:61 (message): Couldn’t determine how to link against libpcap Call Stack (most recent call first): cmake/FindRequiredPackage.cmake:26 (find\_package) CMakeLists.txt:52 (FindRequiredPackage) – Configuring incomplete, errors occurred! I’m banging my head against this, but I believe this is because bro can’t find the threading library to link to. Could someone point me in the right direction? Do I need other threading libraries? Static linking? Cheers, JB ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [August 28, 2014, 9:59pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/2 "2014-08-28T21:59:49Z")
Did you follow this: [http://www.bro.org/documentation/load-balancing.html](http://www.bro.org/documentation/load-balancing.html) James ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [August 28, 2014, 10:27pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/3 "2014-08-28T22:27:48Z")
Similar, except I actually use the PF\_RING\_aware drivers, and transparent mode = 2. So before I perform step 1 I make and make install in PF\_RING\_aware/non-ZC-drivers/2.6.x/broadcom/netxtreme2-5.2.50/bnx2. Then load the module with modprobe, then I compile PF\_RING without issues, and compile tcpdump to work on the new PF\_RING. That works fine with tcpdump, but I can’t seem to compile Bro. Other than that nuance (and the fact that i’m running PF\_RING 6.0.2, as mentioned above, not 5.6.2 like the guide) it should be the same. Any ideas? Cheers, JB ---
**Author:** ![Benjamin\_Wood](https://avatars.discourse-cdn.com/v4/letter/b/8491ac/32.png) [@Benjamin\_Wood](https://community.zeek.org/u/Benjamin_Wood)\ **Post date:** [August 28, 2014, 10:40pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/4 "2014-08-28T22:40:41Z")
I once had an issue with this. My bad workaround was to remove any non PF\_RING libpcap. I was noticing some problems with the compiler choosing the wrong one. So using the big hammer, I removed it. ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [August 28, 2014, 10:42pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/5 "2014-08-28T22:42:33Z")
Hrmm...I just tested this now with PF\_RING 6.0.1: Build Directory : build Source Directory: /home/dev/bro-2.3 -- Found sed: /bin/sed -- Found Perl: /usr/bin/perl (found version "5.18.2") -- Found FLEX: 2.5.35 -- Found BISON: /usr/bin/bison -- Found PCAP: /opt/pfring/lib/libpcap.so -- Performing Test PCAP\_LINKS\_SOLO -- Performing Test PCAP\_LINKS\_SOLO - Success -- Looking for pcap\_get\_pfring\_id -- Looking for pcap\_get\_pfring\_id - found etc... -- Looking for include file pthread.h -- Looking for include file pthread.h - found -- Looking for pthread\_create -- Looking for pthread\_create - not found -- Looking for pthread\_create in pthreads -- Looking for pthread\_create in pthreads - not found -- Looking for pthread\_create in pthread -- Looking for pthread\_create in pthread - found -- Found Threads: TRUE I didn't see the PCAP\_NEEDS\_THREADS however. Machine info: Linux ubuntu-test 3.13.0-34-generic #60-Ubuntu SMP Wed Aug 13 15:49:09 UTC 2014 i686 i686 i686 GNU/Linux Hope that's at least a little more intel. James ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [August 28, 2014, 11:06pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/6 "2014-08-28T23:06:16Z")
Doug Burks was quick to point out that i didn’t export LIBS or LDFLAGS. I would have NEVER guessed this… thanks a thousand times over for this tidbit. Configure finished just fine. Making now. Will update once i’ve got it up and load balanced. ` export LDFLAGS="-Wl,–no-as-needed -lrt" export LIBS="-lrt -lnuma" ` Cheers, JB ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [August 29, 2014, 2:53pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/7 "2014-08-29T14:53:20Z")
So i’ve gone and recompiled with PF\_RING 6. I have everything working and using PF\_RING correctly, but i’m still seeing packet loss (around 25% on a 400-450mb/s link). I was only ever able to get Bro working with “Transparent mode = 0” and not 2 or 1. I might be doing something completely wrong, but whenever i start BRO, i only ever see one thread peaking at 100%. Here is my node configuration: [worker-0] type=worker host=10.10.10.10 interface=eth3 lb\_method=pf\_ring lb\_procs=12 Any ideas as to why i’m only getting one thread seeing the bro traffic? Excuse my ignorance. Cheers, JB ---
**Author:** ![Doug\_Burks](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@Doug\_Burks](https://community.zeek.org/u/Doug_Burks)\ **Post date:** [August 29, 2014, 2:58pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/8 "2014-08-29T14:58:27Z")
It's possible that Bro is not actually using PF\_RING and is actually falling back to standard libpcap. Have you checked /proc/net/pf\_ring/ to see if there is evidence of Bro using PF\_RING? ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [August 29, 2014, 3:21pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/9 "2014-08-29T15:21:03Z")
ldd your bro bin as well: [09:20:17 ubuntu-test:/usr/local/bro/bin$] ldd bro          linux-gate.so.1 =\> (0xb778b000)          libpcap.so.1 =\> /opt/pfring/lib/libpcap.so.1 (0xb7730000) James ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [August 29, 2014, 3:31pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/10 "2014-08-29T15:31:30Z")
It sure is. Here is what it’s telling me from the proc fs: # cat /proc/net/pf\_ring/53559-eth3.103 Bound Device(s) : eth3 Active : 1 Breed : Non-DNA Sampling Rate : 1 Capture Direction : RX+TX Socket Mode : RX+TX Appl. Name : IP Defragment : No BPF Filtering : Enabled # Sw Filt. Rules : 0 # Hw Filt. Rules : 0 Poll Pkt Watermark : 1 Num Poll Calls : 1 Channel Id Mask : 0xFFFFFFFF Cluster Id : 0 Slot Version : 16 [6.0.2] Min Num Slots : 32768 Bucket Len : 8192 Slot Len : 8232 [bucket+header] Tot Memory : 269758464 Tot Packets : 220334266 Tot Pkt Lost : 74243221 Tot Insert : 146091045 Tot Read : 145749734 Insert Offset : 136479200 Remove Offset : 136550784 TX: Send Ok : 0 TX: Send Errors : 0 Reflect: Fwd Ok : 0 Reflect: Fwd Errors: 0 Num Free Slots : 0 This is where i’m seeing tons of the packet loss. I’ve got snort running with PF\_RING on the same box with 8 threads, 0 packet loss. Any ideas? Cheers, JB ---
**Author:** ![Doug\_Burks](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@Doug\_Burks](https://community.zeek.org/u/Doug_Burks)\ **Post date:** [August 29, 2014, 6:49pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/11 "2014-08-29T18:49:12Z")
Based on the following lines, it looks like Bro is running in standalone mode: Appl. Name : \ Cluster Id : 0 If it were running in cluster mode, I would expect to see something like the following instead: Appl. Name : bro-eth3 Cluster Id : 21 Have you double-checked your node.cfg? Have you tried the following? sudo broctl install && sudo broctl restart ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [August 29, 2014, 7:05pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/12 "2014-08-29T19:05:11Z")
Another thing to check is to search the output of "broctl config" for "pfringclusterid" (it must be set to a non-zero value if you want to use PF\_RING). ---
**Author:** ![Joe\_Blow](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Joe\_Blow](https://community.zeek.org/u/Joe_Blow)\ **Post date:** [August 29, 2014, 7:27pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/13 "2014-08-29T19:27:57Z")
Doug - I fixed my node config up and ran those commands. There were some incorrect configs in the node.cfg file, which i was able to check with the broctl config command. Everything seems to be working stellar now. Thanks tons for all the help everyone! Cheers, JB ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/configure-error-linking-libpcap-and-pthread/3245/14 "2022-05-06T15:42:01Z")