rpcap-users — The RPCAP user mailing list

Re: [Rpcap-users] RPCAP Installation issues.

[Patrick K. <pa...@kl...>]

Mahesh Bhat wrote:
> Hi,
>
> I have been looking around for a potential "Remote Packet Capturing" 
> solution for some time. I wanted to try my hands on RPCAP. I have run 
> into few issues with the installation :-

Are you interested in a commercial solution?  We have a remote packet 
capture appliance that supports the RPCAP standard and can also be used 
stand-alone.  The product is called PacketVault and you can get more 
information from our web site 
(https://www.klos.com/products/packetvault) or email me directly.

Sincerely,

Patrick Klos
Klos Technologies, Inc.

[Rpcap-users] Fwd: RPCAP Installation issues.

[Mahesh B. <mah...@gm...>]

I am resending this message in "Plain Text Format". The earlier one
was in HTML format and seemed difficult to read. Sorry ! for the spam.

---------- Forwarded message ----------
From: Mahesh Bhat <mah...@gm...>
Date: Fri, Aug 24, 2012 at 5:26 PM
Subject: RPCAP Installation issues.
To: rpc...@li...


Hi,

I have been looking around for a potential "Remote Packet Capturing"
solution for some time. I wanted to try my hands on RPCAP. I have run into
few issues with the installation :-

I seem to be able to run "./configure" just fine. But, I do see errors when
I run make for "rpcap-0.73".  I have attached the config.log for your
reference. When I run "make" I see the following errors :-

======================
gcc -DHAVE_CONFIG_H -I. -I. -I.     -g -O2 -c rpcap_client.c
In file included from rpcap_client.c:51:
/usr/include/pcap/pcap.h:51:22: error: pcap/bpf.h: No such file or directory
In file included from pcap-int.h:43,
                 from rpcap_client.c:57:
./pcap.h:42:21: error: net/bpf.h: No such file or directory
In file included from pcap-int.h:43,
                 from rpcap_client.c:57:
./pcap.h:101: error: redefinition of âstruct pcap_file_headerâ
./pcap.h:116: error: redefinition of âstruct pcap_pkthdrâ
./pcap.h:125: error: redefinition of âstruct pcap_statâ
./pcap.h:135: error: conflicting types for âpcap_lookupnetâ
/usr/include/pcap/pcap.h:273: error: previous declaration of
âpcap_lookupnetâ was here
./pcap.h:136: error: conflicting types for âpcap_open_liveâ
/usr/include/pcap/pcap.h:335: error: previous declaration of
âpcap_open_liveâ was here
./pcap.h:145: warning: âstruct bpf_programâ declared inside parameter list
./pcap.h:145: error: conflicting types for âpcap_setfilterâ
/usr/include/pcap/pcap.h:358: error: previous declaration of
âpcap_setfilterâ was here
./pcap.h:147: error: conflicting types for âpcap_strerrorâ
/usr/include/pcap/pcap.h:365: error: previous declaration of âpcap_strerrorâ
was here
./pcap.h:150: warning: âstruct bpf_programâ declared inside parameter list
./pcap.h:150: error: conflicting types for âpcap_compileâ
/usr/include/pcap/pcap.h:369: error: previous declaration of âpcap_compileâ
was here
./pcap.h:152: warning: âstruct bpf_programâ declared inside parameter list
./pcap.h:152: error: conflicting types for âpcap_compile_nopcapâ
/usr/include/pcap/pcap.h:371: error: previous declaration of
âpcap_compile_nopcapâ was here
./pcap.h:153: warning: âstruct bpf_programâ declared inside parameter list
./pcap.h:153: error: conflicting types for âpcap_freecodeâ
/usr/include/pcap/pcap.h:372: error: previous declaration of âpcap_freecodeâ
was here
./pcap.h:169: warning: âstruct bpf_insnâ declared inside parameter list
./pcap.h:169: error: conflicting types for âbpf_filterâ
/usr/include/pcap/pcap.h:413: error: previous declaration of âbpf_filterâ
was here
./pcap.h:170: warning: âstruct bpf_insnâ declared inside parameter list
./pcap.h:170: error: conflicting types for âbpf_validateâ
/usr/include/pcap/pcap.h:415: error: previous declaration of âbpf_validateâ
was here
./pcap.h:171: warning: âstruct bpf_insnâ declared inside parameter list
./pcap.h:171: error: conflicting types for âbpf_imageâ
/usr/include/pcap/pcap.h:416: error: previous declaration of âbpf_imageâ was
here
./pcap.h:172: warning: âstruct bpf_programâ declared inside parameter list
./pcap.h:172: error: conflicting types for âbpf_dumpâ
/usr/include/pcap/pcap.h:417: error: previous declaration of âbpf_dumpâ was
here
In file included from rpcap_client.c:57:
pcap-int.h:107: error: field âfcodeâ has incomplete type
rpcap_client.c:137: error: conflicting types for âpcap_open_liveâ
/usr/include/pcap/pcap.h:335: error: previous declaration of
âpcap_open_liveâ was here
rpcap_client.c:183: error: conflicting types for âpcap_lookupnetâ
/usr/include/pcap/pcap.h:273: error: previous declaration of
âpcap_lookupnetâ was here
rpcap_client.c: In function âpcap_captureâ:
rpcap_client.c:266: error: invalid lvalue in assignment
rpcap_client.c: At top level:
rpcap_client.c:311: error: conflicting types for âpcap_compileâ
/usr/include/pcap/pcap.h:369: error: previous declaration of âpcap_compileâ
was here
rpcap_client.c: In function âpcap_compileâ:
rpcap_client.c:320: error: invalid lvalue in assignment
rpcap_client.c:338: error: invalid application of âsizeofâ to incomplete
type âstruct bpf_programâ
rpcap_client.c: At top level:
rpcap_client.c:346: error: conflicting types for âpcap_setfilterâ
/usr/include/pcap/pcap.h:358: error: previous declaration of
âpcap_setfilterâ was here
rpcap_client.c: In function âpcap_setfilterâ:
rpcap_client.c:353: error: invalid lvalue in assignment
rpcap_client.c:354: error: invalid application of âsizeofâ to incomplete
type âstruct bpf_programâ
rpcap_client.c:355: error: invalid lvalue in assignment
rpcap_client.c: In function âpcap_closeâ:
rpcap_client.c:373: error: invalid lvalue in assignment
rpcap_client.c:378: error: pointers are not permitted as case values
rpcap_client.c:396: error: label at end of compound statement
rpcap_client.c: In function âpcap_statsâ:
rpcap_client.c:404: error: invalid lvalue in assignment
rpcap_client.c: In function âpcap_datalinkâ:
rpcap_client.c:424: error: invalid lvalue in assignment
rpcap_client.c: In function âpcap_snapshotâ:
rpcap_client.c:445: error: invalid lvalue in assignment
rpcap_client.c: In function âpcap_geterrâ:
rpcap_client.c:466: error: invalid lvalue in assignment
make: *** [rpcap_client.o] Error 1
======================

I installed the latest libpcap-1.3.0.tar.gz and created soft links so as to
direct rpcap to use the installed pcap.h and bpf.h header files :-

lrwxrwxrwx 1 root root 32 Aug 24 11:15 /usr/include/pcap/pcap.h ->
/opt/libpcap/include/pcap/pcap.h
lrwxrwxrwx 1 root root 31 Aug 24 11:22 /usr/include/pcap/net/bpf.h ->
/opt/libpcap/include/pcap/bpf.h

But, this does not seem to help. Here are the details of the Linux box on
which I have been trying to configure rpcap :-

[root@iad-ch-acm01 DOWNLOADS]$ uname -a
Linux <hostname> 2.6.18-194.26.1.el5PAE #1 SMP Fri Oct 29 14:28:58 EDT 2010
i686 i686 i386 GNU/Linux
[root@iad-ch-acm01 DOWNLOADS]$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.3 (Tikanga)

I dont know what I am doing wrong here. Any inputs on this will be very
helpful indeed.

Thank You !

- Mahesh.

[Rpcap-users] rpcap usage - help required

[Madhavi U. <mad...@ya...>]

I am trying to use rpcap on Linux. I have built
rpcap_svc, librpcap.a & librpcap.la from
rpcap_dev_0.23.tar.gz on sourceforge.net. Will anyone
tell me how to use this binary file? what changes I
should make in the ethereal source files? I have tried
a lot but failed. I am getting following error.

[root@localhost ethereal-0.10.12]# ./tethereal -i
rpcap://172.20.20.35/eth0

** (process:13090): WARNING **: radius: Could not find
the radius directory
tethereal: The capture session could not be initiated
(ioctl: No such device).
Please check to make sure you have sufficient
permissions, and that
you have the proper interface or pipe specified.

Thanks in advance.

Regards,
Madhavi


		
____________________________________________________
Start your day with Yahoo! - make it your home page 
http://www.yahoo.com/r/hs 
 

Fixed the problem (Was: Re: [Rpcap-users] Re: rtdump won't compile...)

[S. K. <sri...@ya...>]

Found and fixed.

The issue was a broken Makefile.am in rpcap, which was not pulling in
savefile.c in the library build (libtool invocation).  Savefile.c
contains the code for the pcap_dump* functions, which the linker was
not able to locate in librpcap, since the file was not getting bulit at
all!  Fixing this gave rise to several other issues, all caused by
static linking on the test system.  These errors did not show up on my
main build system, because Red Hat had very kindly enabled a shared
(.so) libpcap, which filled in for the missing fucntionality.  All
these issues appear to be fixed now.

I have now made the following changes to the build:
* Ensured that librpcap provides all the functionality required by
rtdump, including nametoaddr, pcap_next_etherent, etc.
* Provided a stub replacement for bpf_error, for the time being
* Added pcap_file and pcap_file_no in rpcap_client.c
* Did a couple of test builds of rpcap and rtdump on the test system,
which worked

TODO: Fixing the pcap header issue in rpcap's configure.in - right now,
please kludge it for the next day or so by setting the appropriate flag
(SYS_LIBPCAP or LOCAL_LIBPCAP) in config.h.  I will work on it and fix
it ASAP.

I intend to test a little further tomorrow on an additional skeleton
install at work, and will update the sources on sourceforge tomorrow
evening.  I will post upload info on rpcap_users immediately.

Matt, if you would like me to directly email you the fixed source
archives, please mail me - I am not doing it by default since they will
be 500 K +.

Regards,

Krishnan

--- Mattt <ma...@ab...> wrote:
> -----Forwarded Message-----
> 
> > From: Mattt <ma...@ab...>
> > To: S. Krishnan <sri...@ya...>
> > Subject: Re: [Fwd: Re: [Rpcap-users] Re: rtdump won't compile...]
> > Date: 04 Nov 2002 03:16:38 +1000
> > 
> > Okay... tried this a couppla ways, and still no go...
> > 


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

[Rpcap-users] Found the reason: Re: rtdump won't compile...

[S. K. <sri...@ya...>]

Matt,

The problem in compilation is only with the pcap_dump* functions.  I
was able to reproduce the problem in the morning, but then had to break
because of domestic concerns...:).  I sat again to look at the problem
again just now, and found the reason.

If you check your error output on the rtdump build, you will notice
that the errors all pertain to pcap_dump, pcap_dump_open,
pcap_dump_close, and related structures. 

Essentially, librpcap as installed in /usr/local/lib is not exporting
the pcap_dump functions at all.  I did not notice this problem when
building on my default system since I have libpcap installed in the 
default (/lib) directory, and the linker simply linked against the
pcap_dump functions in libpcap.so by default when it could not find
them in librpcap.  I found this when I ran nm on librpcap on both my
systems, and could not find these functions.  You can check this by
running nm on librpcap and  looking for pcap_dump, pcap_dump_open, etc.

I will now fix this and get back to you ASAP.

Thanks for your input and patience.

Cheers,  

Krishnan



--- Mattt <ma...@ab...> wrote:
> -----Forwarded Message-----
> 
> > From: Mattt <ma...@ab...>
> > To: S. Krishnan <sri...@ya...>
> > Subject: Re: [Fwd: Re: [Rpcap-users] Re: rtdump won't compile...]
> > Date: 04 Nov 2002 03:16:38 +1000
> > 
> > Okay... tried this a couppla ways, and still no go...
> > 
> > So, I figured I'd untar the source afresh one more time, and *only*
> do
> > what you've suggested...
> > 
> > There's no config.h until ./configure is run, so I simply untarred,
> ran
> > ./configure, edited config.h as you suggested (although I used
> > HAVE_LOCAL_LIBPCAP this time - I'm starting to figure that was what
> you
> > meant), and ran make...
> > 
> > Still no go.
> > 
> > I then edited the makefile to include -I/usr/local/include... no
> good...
> > then added -L/usr/local/lib also... still no good... ran 'make
> clean' /
> > 'make'...
> > 
> > Nope.
> > 
> > If nothing else, I might have to shift back over to the desktop
> machine
> > - this waiting for compiling is starting to get me frustrated ;-))
> > 
> > I'd *love* to get this working...
> > 
> > 
> > On Mon, 2002-11-04 at 02:42, S. Krishnan wrote:
> > > 
> > > --- Mattt <ma...@ab...> wrote:
> > > > Hehe - okay, well my wife and son are flying interstate in
> about 5
> > > > hours, so I'll be up for awhile (might as well stay up until
> after
> > > > they
> > > > leave...)   ;-)
> > > > 
> > > 
> > > Great.  I now have some news for you.  I was able to reproduce
> your
> > > problems on my test machine.  First, pcap header detection is
> indeed
> > > broken in rtdump.  A temporary kludge to fix this is (if your
> pcap
> > > header files are in /usr/local/include) to edit config.h and
> manually
> > > set LOCAL_LIBPCAP to 1, and comment (or undef) SYS_LIBPCAP.  I
> will fix
> > > this ASAP - requires some changes to configure.in which I
> stupidly
> > > forgot about.  Using this fix will however cure your local
> installation
> > > for now.
> > > 
> > > I have also reproduced the rtdump link problem, which is
> essentially a
> > > library path setting issue for the linker. I am working on it,
> and will
> > > revert as soon as I get it fixed.
> > > 
> > > Cheers,
> > > 
> > > Krishnan
> > > 
> > > 
> > > __________________________________________________
> > > Do you Yahoo!?
> > > HotJobs - Search new jobs daily now
> > > http://hotjobs.yahoo.com/
> > > 
> > > 
> > > -------------------------------------------------------
> > > This SF.net email is sponsored by: ApacheCon, November 18-21 in
> > > Las Vegas (supported by COMDEX), the only Apache event to be
> > > fully supported by the ASF. http://www.apachecon.com
> > > _______________________________________________
> > > Rpcap-users mailing list
> > > Rpc...@li...
> > > https://lists.sourceforge.net/lists/listinfo/rpcap-users
> > > 
> > -- 
> > Cheers,
> >  Mattt.                               icq : 117539757 
> >  aboveNetworks                        tel : 0438 749 962
> >  ma...@ab... (mail/jabber)   www : www.above.nq4u.net
> >      
> >    There are only 10 kinds of people.
> >         Those who understand binary, and those who don't.
> -- 
> Cheers,
>  Mattt.                               icq : 117539757 
>  aboveNetworks                        tel : 0438 749 962
>  ma...@ab... (mail/jabber)   www : www.above.nq4u.net
>      
>    There are only 10 kinds of people.
>         Those who understand binary, and those who don't.
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: ApacheCon, November 18-21 in
> Las Vegas (supported by COMDEX), the only Apache event to be
> fully supported by the ASF. http://www.apachecon.com
> _______________________________________________
> Rpcap-users mailing list
> Rpc...@li...
> https://lists.sourceforge.net/lists/listinfo/rpcap-users


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

[Rpcap-users] Re: rtdump won't compile...

[Mattt <ma...@ab...>]

-----Forwarded Message-----

> From: Mattt <ma...@ab...>
> To: S. Krishnan <sri...@ya...>
> Subject: Re: [Fwd: Re: [Rpcap-users] Re: rtdump won't compile...]
> Date: 04 Nov 2002 03:16:38 +1000
> 
> Okay... tried this a couppla ways, and still no go...
> 
> So, I figured I'd untar the source afresh one more time, and *only* do
> what you've suggested...
> 
> There's no config.h until ./configure is run, so I simply untarred, ran
> ./configure, edited config.h as you suggested (although I used
> HAVE_LOCAL_LIBPCAP this time - I'm starting to figure that was what you
> meant), and ran make...
> 
> Still no go.
> 
> I then edited the makefile to include -I/usr/local/include... no good...
> then added -L/usr/local/lib also... still no good... ran 'make clean' /
> 'make'...
> 
> Nope.
> 
> If nothing else, I might have to shift back over to the desktop machine
> - this waiting for compiling is starting to get me frustrated ;-))
> 
> I'd *love* to get this working...
> 
> 
> On Mon, 2002-11-04 at 02:42, S. Krishnan wrote:
> > 
> > --- Mattt <ma...@ab...> wrote:
> > > Hehe - okay, well my wife and son are flying interstate in about 5
> > > hours, so I'll be up for awhile (might as well stay up until after
> > > they
> > > leave...)   ;-)
> > > 
> > 
> > Great.  I now have some news for you.  I was able to reproduce your
> > problems on my test machine.  First, pcap header detection is indeed
> > broken in rtdump.  A temporary kludge to fix this is (if your pcap
> > header files are in /usr/local/include) to edit config.h and manually
> > set LOCAL_LIBPCAP to 1, and comment (or undef) SYS_LIBPCAP.  I will fix
> > this ASAP - requires some changes to configure.in which I stupidly
> > forgot about.  Using this fix will however cure your local installation
> > for now.
> > 
> > I have also reproduced the rtdump link problem, which is essentially a
> > library path setting issue for the linker. I am working on it, and will
> > revert as soon as I get it fixed.
> > 
> > Cheers,
> > 
> > Krishnan
> > 
> > 
> > __________________________________________________
> > Do you Yahoo!?
> > HotJobs - Search new jobs daily now
> > http://hotjobs.yahoo.com/
> > 
> > 
> > -------------------------------------------------------
> > This SF.net email is sponsored by: ApacheCon, November 18-21 in
> > Las Vegas (supported by COMDEX), the only Apache event to be
> > fully supported by the ASF. http://www.apachecon.com
> > _______________________________________________
> > Rpcap-users mailing list
> > Rpc...@li...
> > https://lists.sourceforge.net/lists/listinfo/rpcap-users
> > 
> -- 
> Cheers,
>  Mattt.                               icq : 117539757 
>  aboveNetworks                        tel : 0438 749 962
>  ma...@ab... (mail/jabber)   www : www.above.nq4u.net
>      
>    There are only 10 kinds of people.
>         Those who understand binary, and those who don't.
-- 
Cheers,
 Mattt.                               icq : 117539757 
 aboveNetworks                        tel : 0438 749 962
 ma...@ab... (mail/jabber)   www : www.above.nq4u.net
     
   There are only 10 kinds of people.
        Those who understand binary, and those who don't.

Re: [Fwd: Re: [Rpcap-users] Re: rtdump won't compile...]

[S. K. <sri...@ya...>]

--- Mattt <ma...@ab...> wrote:
> Hehe - okay, well my wife and son are flying interstate in about 5
> hours, so I'll be up for awhile (might as well stay up until after
> they
> leave...)   ;-)
> 

Great.  I now have some news for you.  I was able to reproduce your
problems on my test machine.  First, pcap header detection is indeed
broken in rtdump.  A temporary kludge to fix this is (if your pcap
header files are in /usr/local/include) to edit config.h and manually
set LOCAL_LIBPCAP to 1, and comment (or undef) SYS_LIBPCAP.  I will fix
this ASAP - requires some changes to configure.in which I stupidly
forgot about.  Using this fix will however cure your local installation
for now.

I have also reproduced the rtdump link problem, which is essentially a
library path setting issue for the linker. I am working on it, and will
revert as soon as I get it fixed.

Cheers,

Krishnan


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

Re: [Fwd: Re: [Rpcap-users] Re: rtdump won't compile...]

[Mattt <ma...@ab...>]

Hehe - okay, well my wife and son are flying interstate in about 5
hours, so I'll be up for awhile (might as well stay up until after they
leave...)   ;-)

PeeEss - damn, reply-to on the list nearly grabbed me again just now :-/

On Mon, 2002-11-04 at 00:41, S. Krishnan wrote:
> OK, so I am now going to do a clean install of libpcap, rpcap and
> rtdump on a skeleton machine that had none of this stuff installed.  I
> will use source tgz arvhives, and see how it goes.  Will mail ASAP -
> its Sunday morning, and I guess I can work uninterrupted today.
> 
> Regards,
> 
> Krishnan
> 
> --- Mattt <ma...@ab...> wrote:
> > -----Forwarded Message-----
> > 
> > > Failed again. So I'm starting from scratch, and documenting my
> > steps...
> > > 
> 
> 
> __________________________________________________
> Do you Yahoo!?
> HotJobs - Search new jobs daily now
> http://hotjobs.yahoo.com/
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: ApacheCon, November 18-21 in
> Las Vegas (supported by COMDEX), the only Apache event to be
> fully supported by the ASF. http://www.apachecon.com
> _______________________________________________
> Rpcap-users mailing list
> Rpc...@li...
> https://lists.sourceforge.net/lists/listinfo/rpcap-users
> 
-- 
Cheers,
 Mattt.                               icq : 117539757 
 aboveNetworks                        tel : 0438 749 962
 ma...@ab... (mail/jabber)   www : www.above.nq4u.net
     
   There are only 10 kinds of people.
        Those who understand binary, and those who don't.

Re: [Fwd: Re: [Rpcap-users] Re: rtdump won't compile...]

[S. K. <sri...@ya...>]

OK, so I am now going to do a clean install of libpcap, rpcap and
rtdump on a skeleton machine that had none of this stuff installed.  I
will use source tgz arvhives, and see how it goes.  Will mail ASAP -
its Sunday morning, and I guess I can work uninterrupted today.

Regards,

Krishnan

--- Mattt <ma...@ab...> wrote:
> -----Forwarded Message-----
> 
> > Failed again. So I'm starting from scratch, and documenting my
> steps...
> > 


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

[Fwd: Re: [Rpcap-users] Re: rtdump won't compile...]

[Mattt <ma...@ab...>]

-----Forwarded Message-----

> From: Mattt <ma...@ab...>
> To: S. Krishnan <sri...@ya...>
> Subject: Re: [Rpcap-users] Re: rtdump won't compile...
> Date: 03 Nov 2002 19:18:01 +1000
> 
> On Sun, 2002-11-03 at 08:42, S. Krishnan wrote:
> > OK, Matt,
> > 
> > Looks like the problem is with pcap.h.  The problem is with Red Hat's
> > pcap.h install, which is in /usr/include/pcap/pcap.h, and which I kind
> > of accepted by default while building the code.  I guess your Debian
> > install is elsewhere.  The rtdump.c headers look for pcap.h as
> > "#include <pcap.h>", and so look for it in only the standard places.
> > 
> > Unfortunately, I have so far built and tested both rpcap and rtdump on
> > Red Hat systems only.
> > 
> > Could you please open rtdump.c and replace the "#include <pcap.h>" line
> > with something like "#include "/usr/local/include/pcap.h", or whatever
> > is appropriate for your pcap install, and see if that fixes things?
> > 
> > In any case, the entire autoconf pcap header detection thing in both
> > rpcap and rtdump is broken, and I will look into fixing it this week
> > itself.  I will mail as soon as I get a proper fix.
> > 
> > Please let me know if this kludge works.
> 
> 
> Failed again. So I'm starting from scratch, and documenting my steps...
> 
> - run 'apt-get remove libpcap-dev' (to ensure debian's not trying to
>  	make us crazy...) - it wasn't installed...
> - remove all rpcap stuff from /usr/local/*
> - enter pcap source and run 'make uninstall'
> - verify pcap removal, then 'make install'
> - untar fresh copies of rpcap and rtdump trees
> - enter rpcap tree
> - edit rpcap_client.c - uncomment '#include
>  	</usr/local/include/pcap.h>', and comment the if block of pcap
>  	includes below that
> - modify rpcap.c so it reads the same way (by removing the if block)
> - define have_net_bpf_h in config.h after running ./configure (tried to 
> 	find where it does this, but couldn't, so hacked ;-) )
> - run 'make' followed by 'make install'. all looks good.
> - enter rtdump tree
> - modify '#include <pcap.h>' to read 
> 	'#include "/usr/local/include/pcap.h"'
> - run './configure'. apart from not finding 'local' rpcap, all is well.
> 	it seems that's normal anyways...
> - run 'make'. bang. same failure again.
> - edit Makefile - added an '-I/usr/local/include' to INCLS and added 
> 	an '-L/usr/local/lib' to LDFLAGS.
> - run 'make clean', followed by another 'make', and another failure :-/
> 
> Sorry I'm no better with my software building skills ;-)
> 
> -- 
> Cheers,
>  Mattt.                               icq : 117539757 
>  aboveNetworks                        tel : 0438 749 962
>  ma...@ab... (mail/jabber)   www : www.above.nq4u.net
>      
>    There are only 10 kinds of people.
>         Those who understand binary, and those who don't.
-- 
Cheers,
 Mattt.                               icq : 117539757 
 aboveNetworks                        tel : 0438 749 962
 ma...@ab... (mail/jabber)   www : www.above.nq4u.net
     
   There are only 10 kinds of people.
        Those who understand binary, and those who don't.

Re: [Rpcap-users] Re: rtdump won't compile...

[S. K. <sri...@ya...>]

OK, Matt,

Looks like the problem is with pcap.h.  The problem is with Red Hat's
pcap.h install, which is in /usr/include/pcap/pcap.h, and which I kind
of accepted by default while building the code.  I guess your Debian
install is elsewhere.  The rtdump.c headers look for pcap.h as
"#include <pcap.h>", and so look for it in only the standard places.

Unfortunately, I have so far built and tested both rpcap and rtdump on
Red Hat systems only.

Could you please open rtdump.c and replace the "#include <pcap.h>" line
with something like "#include "/usr/local/include/pcap.h", or whatever
is appropriate for your pcap install, and see if that fixes things?

In any case, the entire autoconf pcap header detection thing in both
rpcap and rtdump is broken, and I will look into fixing it this week
itself.  I will mail as soon as I get a proper fix.

Please let me know if this kludge works.

Regards,

Krishnan

--- Mattt <ma...@ab...> wrote:
> On Sat, 2002-11-02 at 05:59, S. Krishnan wrote:
> > It looks like rtdump is not able to link to librpcap.
> 
> Yes, that's what I thought. I've played around a bit with it, but
> can't
> make it budge...
> 
> > - Which platform (H/W, OS) and OS version are you using?
> 
> I originally tried (without success) to build rpcap locally, on my
> Debian Sarge (testing) box, K6II/500, 128mb/RAM, debian libpcap-dev
> package.
> 
> I then shifted over to a Sid (unstable) unstable box I'm running as a
> collector and analysis box (loghost, snort, etc, etc). This one has
> an
> IDT Winchip 200mhz CPU (ix86 compat), and 64mb/RAM. After a short
> play
> with the Debian libpcap-dev package, I built pcap from source, and
> installed it.
> 
> rpcap was still complaining about the lack of pcap/pcap.h, and after
> some trial and error, I managed to build rpcap from clean source by
> adjusting some paths (/usr/local/lib and /usr/lib) in rpcap and
> copying
> /usr/local/lib/pcap.h to /usr/local/lib/pcap/pcap.h - I'm guessing
> (having not tested the probe yet) that this is where the problem
> lies.
> 
> > - What problems did you encounter with building and installing
> rpcap,
> > since an improper rpcap install would cause the error messages that
> you
> > encountered?  It would be nice to have a copy of the configure
> logfile
> > that running ./configure would have generated in the build
> directory.
> 
> As described abovely, rpcap is now built and installed on the
> collector
> machine (the probes won't be run from there, but for the purpose of
> the
> build....). I haven't run the executable yet, as I don't have a
> client
> to listen... config.log is attached.
> 
> > - Do you see any librpcap libraries in your install directory (the
> > default is /usr/local/lib, unless you have changed it)?  
> 
> Yes. librcap-dev.so librpcap.a librpcap.la librpcap.so (libpcap.a is
> also there).
> 
> > - Could you also see if you could mail a copy of the configure log
> file
> > for rtdump too?
> 
> Certainly. Done ;-)
>  
> > Also, would it be possible for you to subscribe to the rpcap-users
> > mailing list (you can find it on the sourceforge project page, at
> 
> Of course. I only failed to this time as it was empty. Now subscribed
> ;-)
> 
> > --- Mattt <ma...@ab...> wrote:
> > > Greetings,
> > > 
> > > Finally arm-wrestled rpcap into building (although as yet
> untested) -
> > > now can't get rtdump to compile. It fails with :
> > > 
> > > 
> > >
> >
>
======================================================================
> > > gcc -O2 -DHAVE_CONFIG_H -I.  -I./missing -I/usr/include
> > > -I/usr/include/openssl -L/usr/lib  -o
> > > rtd                                               ump rtdump.o
> > > print-arp.o print-atalk.o print-atm.o print-bootp.o
> print-decnet.o
> > > print-domain.o pr                                              
> > > int-dvmrp.o print-egp.o print-ether.o print-fddi.o print-gre.o
> > > print-icmp.o print-igmp.o
> > > print-ig                                               rp.o
> > > print-ip.o
> > > print-ipx.o print-isoclns.o print-krb.o print-llc.o print-nfs.o
> > > print-ntp.o print                                              
> > > -null.o
> > > print-ospf.o print-pim.o print-ppp.o print-raw.o print-rip.o
> > > print-sl.o
> > > print-snmp.o prin                                              
> > > t-stp.o
> > > print-sunrpc.o print-tcp.o print-tftp.o print-udp.o print-wb.o
> > > addrtoname.o gmt2local.o m                                       
>    
> > >   
> > > achdep.o parsenfsfh.o util.o savestr.o setsignal.o print-esp.o
> > > print-ah.o print-vjc.o
> > > print-isakm                                               p.o
> > > print-chdlc.o print-ipcomp.o print-mobile.o print-l2tp.o
> print-bgp.o
> > > print-rx.o print-lane.o                                          
>    
> > > 
> > > print-cip.o print-pppoe.o print-lcp.o print-smb.o smbutil.o
> > > print-ascii.o print-telnet.o
> > > print-cn                                               fp.o
> > > print-vrrp.o
> > > print-cdp.o print-token.o print-bxxp.o print-timed.o
> print-radius.o
> > > print-sll.o                                               
> > > str_utils.o
> > > version.o  strlcat.o strlcpy.o bpf_dump.o -lcrypto -lrpcap -lnsl 
> > > rtdump.o(.text+0x52c): In function `main':
> > > : undefined reference to `pcap_open_offline'
> > > rtdump.o(.text+0x94e): In function `main':
> > > : undefined reference to `pcap_dump_open'
> > > rtdump.o(.text+0x976): In function `main':
> > > : undefined reference to `pcap_dump'
> > > rtdump.o(.text+0xa65): In function `cleanup':
> > > : undefined reference to `pcap_file'
> > > rtdump.o(.text+0xbe1): In function `usage':
> > > : undefined reference to `pcap_version'
> > > addrtoname.o(.text+0x938): In function `init_eprotoarray':
> > > : undefined reference to `eproto_db'
> > > addrtoname.o(.text+0x93e): In function `init_eprotoarray':
> > > : undefined reference to `eproto_db'
> > > addrtoname.o(.text+0x99e): In function `init_eprotoarray':
> > > : undefined reference to `eproto_db'
> > > addrtoname.o(.text+0x9c8): In function `init_protoidarray':
> > > : undefined reference to `eproto_db'
> > > addrtoname.o(.text+0x9ce): In function `init_protoidarray':
> > > : undefined reference to `eproto_db'
> > > addrtoname.o(.text+0xa79): more undefined references to
> `eproto_db'
> > > follow
> > > util.o(.text+0x566): In function `read_infile':
> > > : undefined reference to `pcap_strerror'
> > > util.o(.text+0x59a): In function `read_infile':
> > > : undefined reference to `pcap_strerror'
> > > util.o(.text+0x5e1): In function `read_infile':
> > > : undefined reference to `pcap_strerror'
> > > bpf_dump.o(.text+0xaf): In function `bpf_dump':
> > > : undefined reference to `bpf_image'
> > > collect2: ld returned 1 exit status
> > > make: *** [rtdump] Error 1
> > > direwolf:/usr/local/src/rtdump# 
> > >
> >
>
========================================================================
> > > 
> > > Any ideas?
> 
> -- 
> Cheers,
>  Mattt.                               icq : 117539757 
>  aboveNetworks                        tel : 0438 749 962
>  ma...@ab... (mail/jabber)   www : www.above.nq4u.net
>      
>    There are only 10 kinds of people.
>         Those who understand binary, and those who don't.
> > This file contains any messages produced by compilers while
> running configure, to aid debugging if configure makes a mistake.
> 
> configure:642: checking host system type
> configure:663: checking target system type
> configure:681: checking build system type
> configure:770: checking for gcc
> configure:883: checking whether the C compiler (gcc  ) works
> configure:899: gcc -o conftest    conftest.c  1>&5
> configure:925: checking whether the C compiler (gcc  ) is a
> cross-compiler
> configure:930: checking whether we are using GNU C
> configure:958: checking whether gcc accepts -g
> configure:995: checking gcc version
> configure:1138: checking for inline
> configure:1179: checking for __attribute__
> configure:1224: checking how to run the C preprocessor
> configure:1307: checking for fcntl.h
> configure:1307: checking for rpc/rpcent.h
> configure:1307: checking for netinet/if_ether.h
> configure:1344: checking whether time.h and sys/time.h may both be
> included
> configure:1383: checking Linux kernel version
> configure:1418: checking for smi.h
> configure:1455: checking for smiInit in -lsmi
> configure:1502: checking whether to enable libsmi
> configure:1530: gcc -o conftest -g -O2   conftest.c  1>&5
> configure:1511: smi.h: No such file or directory
> configure: failed program was:
> #line 1509 "configure"
> #include "confdefs.h"
>  /* libsmi available check */
> #include <smi.h>
> main()
> {
>   int current, revision, age, n;
>   const int required = 2;
>   if (smiInit("")) 
>     exit(1);
>   if (strcmp(SMI_LIBRARY_VERSION, smi_library_version))
>     exit(2);
>   n = sscanf(smi_library_version, "%d:%d:%d", &current, &revision,
> &age);
>   if (n != 3)
>     exit(3);
>   if (required < current - age || required > current)
>     exit(4);
>   exit(0);
> }
> 
> configure:1552: checking whether to enable ipv6
> configure:1591: gcc -o conftest -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len   conftest.c  1>&5
> configure: failed program was:
> #line 1577 "configure"
> #include "confdefs.h"
>  /* AF_INET6 available check */
> #include <sys/types.h>
> #include <sys/socket.h>
> main()
> {
>  if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
>    exit(1);
>  else
>    exit(0);
> }
> 
> configure:2030: checking for inet_ntop
> configure:2043: gcc -c -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  conftest.c 1>&5
> configure:2111: checking for inet_pton
> configure:2124: gcc -c -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  conftest.c 1>&5
> configure:2192: checking for inet_aton
> configure:2205: gcc -c -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  conftest.c 1>&5
> configure:2275: checking if sockaddr struct has sa_len member
> configure:2314: checking size of char
> configure:2353: checking size of short
> configure:2392: checking size of int
> configure:2431: checking size of long
> configure:2473: checking for addrinfo
> configure:2517: checking for NI_MAXSERV
> configure:2555: checking for NI_NAMEREQD
> configure:2593: checking for sockaddr_storage
> configure:2634: checking for INADDRSZ
> configure:2669: checking for IN6ADDRSZ
> configure:2710: checking for RES_USE_INET6
> configure:2751: checking for res_state_ext
> configure:2793: checking for nsort in res_state
> configure:2839: checking for vfprintf
> configure:2839: checking for strcasecmp
> configure:2839: checking for strlcat
> configure:2839: checking for strlcpy
> configure:2896: checking for ether_ntohost
> configure:2896: checking for setlinebuf
> configure:2953: checking for getipnodebyname
> configure:2953: checking for getipnodebyaddr
> configure:2953: checking for freeaddrinfo
> configure:3017: checking for vsnprintf
> configure:3017: checking for snprintf
> configure:3075: checking whether byte ordering is bigendian
> configure:3166: checking for main in -ldnet
> configure:3209: checking for main in -lrpc
> configure:3252: checking for getrpcbynumber in -lnsl
> configure:3301: checking return type of signal handlers
> configure:3365: checking for sigset
> configure:3481: checking for gethostbyname
> configure:3715: checking for socket
> configure:3851: checking for putmsg in -lstr
> configure:3963: checking for local rpcap library
> configure:3982: checking for pcap_open_live in -lrpcap
> configure:4052: checking for bpf_dump
> configure:4137: checking for u_int8_t using gcc
> configure:4175: checking for int16_t using gcc
> configure:4213: checking for u_int16_t using gcc
> configure:4251: checking for int32_t using gcc
> configure:4289: checking for u_int32_t using gcc
> configure:4367: checking if sockaddr struct has sa_len member
> configure:4402: checking if unaligned accesses fail
> configure:4467: checking for h_errno
> configure:4509: checking for SSLeay
> configure:4541: checking for des_cbc_encrypt in -lcrypto
> configure:4594: checking for cast.h
> configure:4633: checking for buggy CAST128
> configure:4657: gcc -o conftest -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  -I$(srcdir)/missing  -I$(srcdir)/missing
> -I/usr/include -I/usr/include/openssl -L/usr/lib  conftest.c -lcrypto
> -lrpcap -lnsl  1>&5
> configure: failed program was:
> #line 4638 "configure"
> #include "confdefs.h"
> 
> #include <cast.h>
> main()
> {
> 	unsigned char key[] = {0x01,0x23,0x45,0x67,0x12};
> 	unsigned char in[] = {0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};
> 	unsigned char out[sizeof(in)];
> 	unsigned char ok[] = {0x7A,0xC8,0x16,0xD1,0x6E,0x9B,0x30,0x2E};
> 	CAST_KEY ks;
> 	CAST_set_key(&ks, sizeof(key), key);
> 	CAST_ecb_encrypt(in, out, &ks, CAST_ENCRYPT);
> 	if (memcmp(out, ok, sizeof(ok)) != 0)
> 		return 0;
> 	else
> 		return 1;
> }
> configure:4689: checking for rc5.h
> configure:4744: checking for a BSD compatible install
> > This file contains any messages produced by compilers while
> running configure, to aid debugging if configure makes a mistake.
> 
> configure:642: checking host system type
> configure:663: checking target system type
> configure:681: checking build system type
> configure:770: checking for gcc
> configure:883: checking whether the C compiler (gcc  ) works
> configure:899: gcc -o conftest    conftest.c  1>&5
> configure:925: checking whether the C compiler (gcc  ) is a
> cross-compiler
> configure:930: checking whether we are using GNU C
> configure:958: checking whether gcc accepts -g
> configure:995: checking gcc version
> configure:1138: checking for inline
> configure:1179: checking for __attribute__
> configure:1224: checking how to run the C preprocessor
> configure:1307: checking for fcntl.h
> configure:1307: checking for rpc/rpcent.h
> configure:1307: checking for netinet/if_ether.h
> configure:1344: checking whether time.h and sys/time.h may both be
> included
> configure:1383: checking Linux kernel version
> configure:1418: checking for smi.h
> configure:1455: checking for smiInit in -lsmi
> configure:1502: checking whether to enable libsmi
> configure:1530: gcc -o conftest -g -O2   conftest.c  1>&5
> configure:1511: smi.h: No such file or directory
> configure: failed program was:
> #line 1509 "configure"
> #include "confdefs.h"
>  /* libsmi available check */
> #include <smi.h>
> main()
> {
>   int current, revision, age, n;
>   const int required = 2;
>   if (smiInit("")) 
>     exit(1);
>   if (strcmp(SMI_LIBRARY_VERSION, smi_library_version))
>     exit(2);
>   n = sscanf(smi_library_version, "%d:%d:%d", &current, &revision,
> &age);
>   if (n != 3)
>     exit(3);
>   if (required < current - age || required > current)
>     exit(4);
>   exit(0);
> }
> 
> configure:1552: checking whether to enable ipv6
> configure:1591: gcc -o conftest -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len   conftest.c  1>&5
> configure: failed program was:
> #line 1577 "configure"
> #include "confdefs.h"
>  /* AF_INET6 available check */
> #include <sys/types.h>
> #include <sys/socket.h>
> main()
> {
>  if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
>    exit(1);
>  else
>    exit(0);
> }
> 
> configure:2030: checking for inet_ntop
> configure:2043: gcc -c -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  conftest.c 1>&5
> configure:2111: checking for inet_pton
> configure:2124: gcc -c -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  conftest.c 1>&5
> configure:2192: checking for inet_aton
> configure:2205: gcc -c -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  conftest.c 1>&5
> configure:2275: checking if sockaddr struct has sa_len member
> configure:2314: checking size of char
> configure:2353: checking size of short
> configure:2392: checking size of int
> configure:2431: checking size of long
> configure:2473: checking for addrinfo
> configure:2517: checking for NI_MAXSERV
> configure:2555: checking for NI_NAMEREQD
> configure:2593: checking for sockaddr_storage
> configure:2634: checking for INADDRSZ
> configure:2669: checking for IN6ADDRSZ
> configure:2710: checking for RES_USE_INET6
> configure:2751: checking for res_state_ext
> configure:2793: checking for nsort in res_state
> configure:2839: checking for vfprintf
> configure:2839: checking for strcasecmp
> configure:2839: checking for strlcat
> configure:2839: checking for strlcpy
> configure:2896: checking for ether_ntohost
> configure:2896: checking for setlinebuf
> configure:2953: checking for getipnodebyname
> configure:2953: checking for getipnodebyaddr
> configure:2953: checking for freeaddrinfo
> configure:3017: checking for vsnprintf
> configure:3017: checking for snprintf
> configure:3075: checking whether byte ordering is bigendian
> configure:3166: checking for main in -ldnet
> configure:3209: checking for main in -lrpc
> configure:3252: checking for getrpcbynumber in -lnsl
> configure:3301: checking return type of signal handlers
> configure:3365: checking for sigset
> configure:3481: checking for gethostbyname
> configure:3715: checking for socket
> configure:3851: checking for putmsg in -lstr
> configure:3963: checking for local rpcap library
> configure:3982: checking for pcap_open_live in -lrpcap
> configure:4052: checking for bpf_dump
> configure:4137: checking for u_int8_t using gcc
> configure:4175: checking for int16_t using gcc
> configure:4213: checking for u_int16_t using gcc
> configure:4251: checking for int32_t using gcc
> configure:4289: checking for u_int32_t using gcc
> configure:4367: checking if sockaddr struct has sa_len member
> configure:4402: checking if unaligned accesses fail
> configure:4467: checking for h_errno
> configure:4509: checking for SSLeay
> configure:4541: checking for des_cbc_encrypt in -lcrypto
> configure:4594: checking for cast.h
> configure:4633: checking for buggy CAST128
> configure:4657: gcc -o conftest -g -O2 -Dss_family=__ss_family
> -Dss_len=__ss_len  -I$(srcdir)/missing  -I$(srcdir)/missing
> -I/usr/include -I/usr/include/openssl -L/usr/lib  conftest.c -lcrypto
> -lrpcap -lnsl  1>&5
> configure: failed program was:
> #line 4638 "configure"
> #include "confdefs.h"
> 
> #include <cast.h>
> main()
> {
> 	unsigned char key[] = {0x01,0x23,0x45,0x67,0x12};
> 	unsigned char in[] = {0x01,0x23,0x45,0x67,0x89,0xAB,0xCD,0xEF};
> 	unsigned char out[sizeof(in)];
> 	unsigned char ok[] = {0x7A,0xC8,0x16,0xD1,0x6E,0x9B,0x30,0x2E};
> 	CAST_KEY ks;
> 	CAST_set_key(&ks, sizeof(key), key);
> 	CAST_ecb_encrypt(in, out, &ks, CAST_ENCRYPT);
> 	if (memcmp(out, ok, sizeof(ok)) != 0)
> 		return 0;
> 	else
> 		return 1;
> }
> configure:4689: checking for rc5.h
> configure:4744: checking for a BSD compatible install
> 


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

[Rpcap-users] Re: rtdump won't compile...

[Mattt <ma...@ab...>]

On Sat, 2002-11-02 at 05:59, S. Krishnan wrote:
> It looks like rtdump is not able to link to librpcap.

Yes, that's what I thought. I've played around a bit with it, but can't
make it budge...

> - Which platform (H/W, OS) and OS version are you using?

I originally tried (without success) to build rpcap locally, on my
Debian Sarge (testing) box, K6II/500, 128mb/RAM, debian libpcap-dev
package.

I then shifted over to a Sid (unstable) unstable box I'm running as a
collector and analysis box (loghost, snort, etc, etc). This one has an
IDT Winchip 200mhz CPU (ix86 compat), and 64mb/RAM. After a short play
with the Debian libpcap-dev package, I built pcap from source, and
installed it.

rpcap was still complaining about the lack of pcap/pcap.h, and after
some trial and error, I managed to build rpcap from clean source by
adjusting some paths (/usr/local/lib and /usr/lib) in rpcap and copying
/usr/local/lib/pcap.h to /usr/local/lib/pcap/pcap.h - I'm guessing
(having not tested the probe yet) that this is where the problem lies.

> - What problems did you encounter with building and installing rpcap,
> since an improper rpcap install would cause the error messages that you
> encountered?  It would be nice to have a copy of the configure logfile
> that running ./configure would have generated in the build directory.

As described abovely, rpcap is now built and installed on the collector
machine (the probes won't be run from there, but for the purpose of the
build....). I haven't run the executable yet, as I don't have a client
to listen... config.log is attached.

> - Do you see any librpcap libraries in your install directory (the
> default is /usr/local/lib, unless you have changed it)?  

Yes. librcap-dev.so librpcap.a librpcap.la librpcap.so (libpcap.a is
also there).

> - Could you also see if you could mail a copy of the configure log file
> for rtdump too?

Certainly. Done ;-)
 
> Also, would it be possible for you to subscribe to the rpcap-users
> mailing list (you can find it on the sourceforge project page, at

Of course. I only failed to this time as it was empty. Now subscribed
;-)

> --- Mattt <ma...@ab...> wrote:
> > Greetings,
> > 
> > Finally arm-wrestled rpcap into building (although as yet untested) -
> > now can't get rtdump to compile. It fails with :
> > 
> > 
> >
> ======================================================================
> > gcc -O2 -DHAVE_CONFIG_H -I.  -I./missing -I/usr/include
> > -I/usr/include/openssl -L/usr/lib  -o
> > rtd                                               ump rtdump.o
> > print-arp.o print-atalk.o print-atm.o print-bootp.o print-decnet.o
> > print-domain.o pr                                              
> > int-dvmrp.o print-egp.o print-ether.o print-fddi.o print-gre.o
> > print-icmp.o print-igmp.o
> > print-ig                                               rp.o
> > print-ip.o
> > print-ipx.o print-isoclns.o print-krb.o print-llc.o print-nfs.o
> > print-ntp.o print                                              
> > -null.o
> > print-ospf.o print-pim.o print-ppp.o print-raw.o print-rip.o
> > print-sl.o
> > print-snmp.o prin                                              
> > t-stp.o
> > print-sunrpc.o print-tcp.o print-tftp.o print-udp.o print-wb.o
> > addrtoname.o gmt2local.o m                                           
> >   
> > achdep.o parsenfsfh.o util.o savestr.o setsignal.o print-esp.o
> > print-ah.o print-vjc.o
> > print-isakm                                               p.o
> > print-chdlc.o print-ipcomp.o print-mobile.o print-l2tp.o print-bgp.o
> > print-rx.o print-lane.o                                              
> > 
> > print-cip.o print-pppoe.o print-lcp.o print-smb.o smbutil.o
> > print-ascii.o print-telnet.o
> > print-cn                                               fp.o
> > print-vrrp.o
> > print-cdp.o print-token.o print-bxxp.o print-timed.o print-radius.o
> > print-sll.o                                               
> > str_utils.o
> > version.o  strlcat.o strlcpy.o bpf_dump.o -lcrypto -lrpcap -lnsl 
> > rtdump.o(.text+0x52c): In function `main':
> > : undefined reference to `pcap_open_offline'
> > rtdump.o(.text+0x94e): In function `main':
> > : undefined reference to `pcap_dump_open'
> > rtdump.o(.text+0x976): In function `main':
> > : undefined reference to `pcap_dump'
> > rtdump.o(.text+0xa65): In function `cleanup':
> > : undefined reference to `pcap_file'
> > rtdump.o(.text+0xbe1): In function `usage':
> > : undefined reference to `pcap_version'
> > addrtoname.o(.text+0x938): In function `init_eprotoarray':
> > : undefined reference to `eproto_db'
> > addrtoname.o(.text+0x93e): In function `init_eprotoarray':
> > : undefined reference to `eproto_db'
> > addrtoname.o(.text+0x99e): In function `init_eprotoarray':
> > : undefined reference to `eproto_db'
> > addrtoname.o(.text+0x9c8): In function `init_protoidarray':
> > : undefined reference to `eproto_db'
> > addrtoname.o(.text+0x9ce): In function `init_protoidarray':
> > : undefined reference to `eproto_db'
> > addrtoname.o(.text+0xa79): more undefined references to `eproto_db'
> > follow
> > util.o(.text+0x566): In function `read_infile':
> > : undefined reference to `pcap_strerror'
> > util.o(.text+0x59a): In function `read_infile':
> > : undefined reference to `pcap_strerror'
> > util.o(.text+0x5e1): In function `read_infile':
> > : undefined reference to `pcap_strerror'
> > bpf_dump.o(.text+0xaf): In function `bpf_dump':
> > : undefined reference to `bpf_image'
> > collect2: ld returned 1 exit status
> > make: *** [rtdump] Error 1
> > direwolf:/usr/local/src/rtdump# 
> >
> ========================================================================
> > 
> > Any ideas?

-- 
Cheers,
 Mattt.                               icq : 117539757 
 aboveNetworks                        tel : 0438 749 962
 ma...@ab... (mail/jabber)   www : www.above.nq4u.net
     
   There are only 10 kinds of people.
        Those who understand binary, and those who don't.

[Rpcap-users] Re: rtdump won't compile...

[S. K. <sri...@ya...>]

Hi,

It looks like rtdump is not able to link to librpcap.  I am at work
now, and will look into this tonight, since I am currently using a
Windows box for my work-related programming. :(

In the meantime, could you please let me have the following details:

- Which platform (H/W, OS) and OS version are you using?
- What problems did you encounter with building and installing rpcap,
since an improper rpcap install would cause the error messages that you
encountered?  It would be nice to have a copy of the configure logfile
that running ./configure would have generated in the build directory.
- Do you see any librpcap libraries in your install directory (the
default is /usr/local/lib, unless you have changed it)?  
- Could you also see if you could mail a copy of the configure log file
for rtdump too?

Also, would it be possible for you to subscribe to the rpcap-users
mailing list (you can find it on the sourceforge project page, at
http://lists.sourceforge.net/lists/listinfo/rpcap-users), and post your
queries there, since they could then become a reference for other users
too? 

Best regards,

Krishnan

--- Mattt <ma...@ab...> wrote:
> Greetings,
> 
> Finally arm-wrestled rpcap into building (although as yet untested) -
> now can't get rtdump to compile. It fails with :
> 
> 
>
======================================================================
> gcc -O2 -DHAVE_CONFIG_H -I.  -I./missing -I/usr/include
> -I/usr/include/openssl -L/usr/lib  -o
> rtd                                               ump rtdump.o
> print-arp.o print-atalk.o print-atm.o print-bootp.o print-decnet.o
> print-domain.o pr                                              
> int-dvmrp.o print-egp.o print-ether.o print-fddi.o print-gre.o
> print-icmp.o print-igmp.o
> print-ig                                               rp.o
> print-ip.o
> print-ipx.o print-isoclns.o print-krb.o print-llc.o print-nfs.o
> print-ntp.o print                                              
> -null.o
> print-ospf.o print-pim.o print-ppp.o print-raw.o print-rip.o
> print-sl.o
> print-snmp.o prin                                              
> t-stp.o
> print-sunrpc.o print-tcp.o print-tftp.o print-udp.o print-wb.o
> addrtoname.o gmt2local.o m                                           
>   
> achdep.o parsenfsfh.o util.o savestr.o setsignal.o print-esp.o
> print-ah.o print-vjc.o
> print-isakm                                               p.o
> print-chdlc.o print-ipcomp.o print-mobile.o print-l2tp.o print-bgp.o
> print-rx.o print-lane.o                                              
> 
> print-cip.o print-pppoe.o print-lcp.o print-smb.o smbutil.o
> print-ascii.o print-telnet.o
> print-cn                                               fp.o
> print-vrrp.o
> print-cdp.o print-token.o print-bxxp.o print-timed.o print-radius.o
> print-sll.o                                               
> str_utils.o
> version.o  strlcat.o strlcpy.o bpf_dump.o -lcrypto -lrpcap -lnsl 
> rtdump.o(.text+0x52c): In function `main':
> : undefined reference to `pcap_open_offline'
> rtdump.o(.text+0x94e): In function `main':
> : undefined reference to `pcap_dump_open'
> rtdump.o(.text+0x976): In function `main':
> : undefined reference to `pcap_dump'
> rtdump.o(.text+0xa65): In function `cleanup':
> : undefined reference to `pcap_file'
> rtdump.o(.text+0xbe1): In function `usage':
> : undefined reference to `pcap_version'
> addrtoname.o(.text+0x938): In function `init_eprotoarray':
> : undefined reference to `eproto_db'
> addrtoname.o(.text+0x93e): In function `init_eprotoarray':
> : undefined reference to `eproto_db'
> addrtoname.o(.text+0x99e): In function `init_eprotoarray':
> : undefined reference to `eproto_db'
> addrtoname.o(.text+0x9c8): In function `init_protoidarray':
> : undefined reference to `eproto_db'
> addrtoname.o(.text+0x9ce): In function `init_protoidarray':
> : undefined reference to `eproto_db'
> addrtoname.o(.text+0xa79): more undefined references to `eproto_db'
> follow
> util.o(.text+0x566): In function `read_infile':
> : undefined reference to `pcap_strerror'
> util.o(.text+0x59a): In function `read_infile':
> : undefined reference to `pcap_strerror'
> util.o(.text+0x5e1): In function `read_infile':
> : undefined reference to `pcap_strerror'
> bpf_dump.o(.text+0xaf): In function `bpf_dump':
> : undefined reference to `bpf_image'
> collect2: ld returned 1 exit status
> make: *** [rtdump] Error 1
> direwolf:/usr/local/src/rtdump# 
>
========================================================================
> 
> Any ideas?
> 
> -- 
> Cheers,
>  Mattt.                               icq : 117539757 
>  aboveNetworks                        tel : 0438 749 962
>  ma...@ab... (mail/jabber)   www : www.above.nq4u.net
>      
>    There are only 10 kinds of people.
>         Those who understand binary, and those who don't.
> 


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

[Rpcap-users] Fwd: test message

[S. K. <sri...@ma...>]

----------  Forwarded Message  ----------
Subject: test message
Date: Thu, 7 Feb 2002 07:29:17 +0530
From: S. Krishnan <sri...@ma...>
To: rpc...@li...


test

-------------------------------------------------------