error at the time of configure (bro 2.1)

Zeek
1

Hi
I gone through the Quick start guide (Bro-2.1).i have done these two things according to the quick start guide.

1.sudo apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig zlib1g-dev libmagic-dev

2.sudo apt-get install libgeoip-dev sendmail

but at the configuration time I am getting the error. I attached the file which generate after ./configure.
What is the best way to resolve this problem. please suggest.

bro configure (7.08 KB)

2

Hi
I gone through the Quick start guide (Bro-2.1).i have done these two
things
according to the quick start guide.

1.sudo apt-get install cmake make gcc g++ flex bison libpcap-dev
libssl-dev python-dev swig zlib1g-dev libmagic-dev
2.sudo apt-get install libgeoip-dev sendmail

but at the configuration time I am getting the error. I attached the file
which generate after ./configure.
What is the best way to resolve this problem. please suggest.
--
Best regards
   Diwakar Kumar Dinkar
   Project Fellow
   IIT Patna
   +91-7631740230
_______________________________________________
Bro mailing list
bro@bro-ids.org
mailman.icsi.berkeley.edu Mailing Lists

Hi, I once also encountered some problem in install, but the problem can
be solved if you look deeper at the error message. Most likely, your
operating system lack some packages: for example:
can not find LibMagic---sudo apt-get install libmagic-dev
can not find ZLIB--sudo apt-get install libz-dev
can not find BISON--sudo apt-get install bison
can not find FLEX--sudo apt-get install flex
can not find OpenSSL--sudo apt-get install libssl-dev
can not find SWIG--sudo apt-get install swig
can not find PathonDev--sudo apt-get install python-dev

Good luck

3

but at the configuration time I am getting the error.

Looks like the problem may be your version of libpcap. I notice that it's trying to use a version of libpcap in /usr/local, is that something you had built/installed yourself and is it a fairly recent version?

You could try `./configure --with-pcap=/usr` to see if it picks up a usable version that was installed by your OS's package management system. Failing that, you could try getting a recent version of libpcap source and building/installing that in /usr/local (or somewhere else as long as you use the --with-pcap option to Bro's ./configure script).

    Jon

4

I ran into something recently where the little test program that FindPCAP.cmake uses doesn't link with pthread so if someone is using PF_Ring (which requires pthread at link time) the test program will fail. I hadn't brought it up yet though because it doesn't always seem to fail and I'm not sure what the conditions for failure are yet. Maybe we should have that cmake script link the test program with pthread in case someone is using PF_Ring?

  .Seth

5

I ran into something recently where the little test program that FindPCAP.cmake uses doesn't link with pthread so if someone is using PF_Ring (which requires pthread at link time) the test program will fail.

The test programs in FindPCAP.cmake are meant to determine whether linking libpcap also requires linking a thread library. It first tests without a thread library, and failing that, then tries with a thread library. If both ways fail, it gives up. One reason both ways could fail would be if CMake didn't correctly determine a thread library to link against and libpcap needs it.

But in this case, the ./configure output shows that libpcap links without a thread library and that pcap_get_pfring_id() isn't provided by libpcap, so it's probably not one from PF_Ring. And the test that is failing is one from PCAPTests.cmake (which links tests the same way that FindPCAP.cmake determines).

I hadn't brought it up yet though because it doesn't always seem to fail and I'm not sure what the conditions for failure are yet.

If you can give me a CMake version, PF_Ring version, Bro version, and OS on which it's reproducible, I can look at it.

    Jon