Good afternoon,
I’m curious to see if anyone in the Bro community has been successful at installing Bro from source using the initial libpcap files bundled with CentOS 7. No matter if I specify ./configure --with-pcap=/usr/local/ or ./configure --with-pcap=/usr/lib64/ after installing libpcap-devel, I’m still unable to get Bro to compile:
…
– Looking for sigset
– Looking for sigset - found
– Performing Test DO_SOCK_DECL
– Performing Test DO_SOCK_DECL - Failed
– Performing Test SYSLOG_INT
– Performing Test SYSLOG_INT - Failed
– Looking for include file pcap-int.h
– Looking for include file pcap-int.h - not found
– Looking for pcap_freecode
– Looking for pcap_freecode - not found
– No implementation for pcap_freecode()
– Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_HAS_ERROR_PARAMETER
– Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_HAS_ERROR_PARAMETER - Failed
– Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_NO_ERROR_PARAMETER
– Performing Test LIBPCAP_PCAP_COMPILE_NOPCAP_NO_ERROR_PARAMETER - Failed
CMake Error at cmake/PCAPTests.cmake:58 (message):
Can’t determine if pcap_compile_nopcap takes an error parameter
Call Stack (most recent call first):
CMakeLists.txt:164 (include)– Configuring incomplete, errors occurred!
See also “/root/bro-2.5/build/CMakeFiles/CMakeOutput.log”.
See also “/root/bro-2.5/build/CMakeFiles/CMakeError.log”.
I tried several possible solutions from older articles scattered across the web including the exporting LIBS and LDFLAGS variables prior to compiling without success: http://mailman.icsi.berkeley.edu/pipermail/bro/2014-August/007404.html
Is there a minimum libpcap version that Bro will only support / compile against?
Thank you,