RHEL 4.0/endace 10GigE/Bro

We are in the process of testing and setting up bro for 10GigE monitoring and are using endace cards (DAG 6.2S) on redhat enterprise 4.0.

Right now we see that bro mis-compiles on RHEL4. This appears to be an issues with the glibc-headers package.

gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I/home/mhoneyfield/libpcap-0.9.4 -I../../linux-include -g -O2 -I/include -I/usr/include -c `test -f ef.c || echo './'`ef.c
In file included from /usr/include/netinet/ether.h:26,
                 from ef.l:13:
../../linux-include/netinet/if_ether.h:41: error: redefinition of `struct ether_addr'
../../linux-include/netinet/if_ether.h:48: error: redefinition of `struct ether_header'
In file included from ef.l:16:
../../linux-include/netinet/if_ether.h:41: error: redefinition of `struct ether_addr'
../../linux-include/netinet/if_ether.h:48: error: redefinition of `struct ether_header'
../../linux-include/netinet/if_ether.h:77: error: redefinition of `struct ether_arp'
make[4]: *** [ef.o] Error 1
make[4]: Leaving directory `/home/mhoneyfield/bro-1.0/aux/hf'
make[3]: *** [all-recursive] Error 1
make[3]: Leaving directory `/home/mhoneyfield/bro-1.0/aux'
make[2]: *** [all] Error 2
make[2]: Leaving directory `/home/mhoneyfield/bro-1.0/aux'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/mhoneyfield/bro-1.0'
make: *** [all] Error 2

Any thoughts on this ? Also, I am wondering if anyone here running bro with endace DAG 6.2 cards ?

Thanks a lot

Aashish Sharma

Right now we see that bro mis-compiles on RHEL4. This appears to be an issues with the glibc-headers package.

Hmm... I've seen this before but right now I can't remember what's
the fix. Does anybody?

(Just a guess: does it help if you remove "-I../../linux-include"
from the command line?)

Any thoughts on this ? Also, I am wondering if anyone here running bro with endace DAG 6.2 cards ?

We have some prototypical code to add native DAG support to Bro
(rather than relying on libpcap). I'd have to check what the current
state is but if you're interested to try it, I'll see.

(We're using a 4.3GE currently but this shouldn't make a difference
in terms of the API.)

Robin

Hi,

> Right now we see that bro mis-compiles on RHEL4. This appears to be
an issues with the glibc-headers package.

Hmm... I've seen this before but right now I can't remember what's
the fix. Does anybody?

mhmmm the archive says that in November Vidar Seeberg had a similar
problem ("Compiling error on Ubuntu Linux - now: make-problem"), but I
cannot seem to find a mail that detailed a fix. Vern pointed out that
the ef tool isn't actually needed, and iirc we have removed it in more
recent releases(?).

  http://thread.gmane.org/gmane.comp.security.detection.bro/1204

Is it just in aux/{cf,hf} that things are failing? If you cd into src
directly once configure has finished and type "make", does it fail
similarly?

(Just a guess: does it help if you remove "-I../../linux-include"
from the command line?)

Yeah, a good thing to try!

Good luck,
Christian.

>
> > Right now we see that bro mis-compiles on RHEL4. This appears to be
> an issues with the glibc-headers package.
>
> Hmm... I've seen this before but right now I can't remember what's
> the fix. Does anybody?

mhmmm the archive says that in November Vidar Seeberg had a similar
problem ("Compiling error on Ubuntu Linux - now: make-problem"), but I
cannot seem to find a mail that detailed a fix. Vern pointed out that
the ef tool isn't actually needed, and iirc we have removed it in more
recent releases(?).

  http://thread.gmane.org/gmane.comp.security.detection.bro/1204

Here is the error. It did go a lot further in compilation then initially. Not sure if this is useful for you or I should send you the binpac coredumps as well.

PktSrc.o(.text+0x74c): In function `PktSrc::SetHdrSize()':
/usr/local/packages/bro/bro-1.0/src/PktSrc.cc:248: undefined reference to `pcap_snprintf'
PktSrc.o(.text+0xd7e): In function `PktInterfaceSrc::PktInterfaceSrc(char const*, char const*, PktSrc_Filter_Type)':
/usr/local/packages/bro/bro-1.0/src/PktSrc.cc:360: undefined reference to `pcap_snprintf'
PktSrc.o(.text+0xdd0):/usr/local/packages/bro/bro-1.0/src/PktSrc.cc:326: undefined reference to `pcap_snprintf'
PktSrc.o(.text+0xef6): In function `PktInterfaceSrc::PktInterfaceSrc(char const*, char const*, PktSrc_Filter_Type)':
/usr/local/packages/bro/bro-1.0/src/PktSrc.cc:360: undefined reference to `pcap_snprintf'
PktSrc.o(.text+0xf48):/usr/local/packages/bro/bro-1.0/src/PktSrc.cc:326: undefined reference to `pcap_snprintf'
collect2: ld returned 1 exit status
make[2]: *** [bro] Error 1
make[2]: Leaving directory `/usr/local/packages/bro/bro-1.0/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/usr/local/packages/bro/bro-1.0/src'
make: *** [all] Error 2

Is it just in aux/{cf,hf} that things are failing? If you cd into src
directly once configure has finished and type "make", does it fail
similarly?

> (Just a guess: does it help if you remove "-I../../linux-include"
> from the command line?)

Yeah, a good thing to try!

I tried removing "-I../../linux-include" by commenting it gets erros. Both of running make after configure as well as running make inside the src directory. If you want to look at the errors I can sent that out as well.

Thanks a lot for the prompt responses and all the help.

aashish

Looks like it cant find some header files for libpcap.

I have a very similar setup to what you are doing, here is the skinny on how I configured my DAG cards with DAG compatible libpcap and bro:

I got the libpcap source from endace.com's website, then compiled with the following:
./configure '--with-dag=/opt/dag' '--prefix=/opt' && make
make install

For bro using bro-1.X:
CFLAGS='-I/opt/include' LDFLAGS='-L/opt/lib' ./configure '--disable-localpcap' '--enable-selectloop' '--prefix=/opt/bro-1.0' && make
make install

You will need to use endace's libpcap until bro supports DAG devices natively. The endace-libpcap allows the dag devices to be seen as dag0 and dag1 (sort of like eth0/eth1).

This usually indicates that the used pcap.h does not match the
version of libpcap which is linked in. Do you have different
versions installed? If not, it may also be the case that Bro's
configure confuses the system libpcap with the included libpcap (I
forgot whether in 1.0 the pcap which ships with Bro is still the
default used by configure; this has changed recently).

Robin