# libpcap compatibility problem (Re: new bro "CURRENT" release - 0.8a57)
**URL:** https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438
**Category:** Zeek
**Created:** [December 9, 2003, 6:39pm UTC](https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438 "2003-12-09T18:39:47Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [December 9, 2003, 6:39pm UTC](https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438/1 "2003-12-09T18:39:47Z")
Argh - the 0.8a57 release uses some new libpcap functionality
(pcap\_compile\_nocap(), and calling pcap\_freecode() with a bpf\_program\*)
that isn't supported in older libpcap releases. If someone could please
contribute autoconf tweaks to deal with this incompatibility, I'd much
appreciate it.
Vern
---
### Author:  [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)
#### Post date: [December 10, 2003, 3:35pm UTC](https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438/2 "2003-12-10T15:35:28Z")
Hi all,
> Argh - the 0.8a57 release uses some new libpcap functionality
> (pcap\_compile\_nocap(), and calling pcap\_freecode() with a bpf\_program\*)
> that isn't supported in older libpcap releases. If someone could please
> contribute autoconf tweaks to deal with this incompatibility, I'd much
> appreciate it.
mhmm ... it seems that pcap\_compile\_nopcap() was added in 0.5, and
pcap\_freecode() without the pcap\_t in 0.6.1, so I guess there should be
a check for versions \>= 0.6.1.
I'm attaching a patch that seems to work -- it checks whether the
pcap\_compile\_nocap symbol exists, and whether a program passing only one
argument to pcap\_freecode() can build.
I haven't checked if the autoconf macros are available in older versions
as well (at that point I'm usually losing my patience 🙂 Apply with -p0
in the toplevel directory of the source tree.
Hth,
Christian.
[bro-0.8.a57-pcapfix.diff](https://community.zeek.org/uploads/short-url/ljqKvyu1ciS1BqEaei8BBoKHT0o.diff) (811 Bytes)
---
### Author:  [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)
#### Post date: [December 10, 2003, 3:37pm UTC](https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438/3 "2003-12-10T15:37:39Z")
^^^^^
Heh. I duplicated the typo 🙂 The patch \*does\* check for
pcap\_compile\_nopcap() though ...
Cheers,
Christian.
---
### Author:  [@Anton\_Chuvakin\_Ph.D](https://community.zeek.org/u/Anton_Chuvakin_Ph.D)
#### Post date: [December 12, 2003, 3:52pm UTC](https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438/4 "2003-12-12T15:52:06Z")
All,
I just build and deployed bro-0.8a57 and the thing segfaults after about
5-100 minutes of running. I tried '-t file', but then it segfaults
immediately.
Platform is RedHat 9; default build of bro with ssl. Deployed on a fairly
loaded 10MB/s link.
Anybody else seeing this?
Best,
---
### Author:  [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)
#### Post date: [December 15, 2003, 2:20pm UTC](https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438/5 "2003-12-15T14:20:06Z")
Hi,
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/libpcap-compatibility-problem-re-new-bro-current-release-0-8a57/438/6 "2022-05-06T15:36:53Z")