Adding a New Protocol under Windows

Elastic Stack Beats
1

I'm trying to add a new protocol to packetbeat under Windows. I noticed that the "Developer Guide: Adding a New Protocol" is not up to date.

I read that the git repository and the dependency management changed. I don't know if there are some other point to be aware of.

I installed:

  • go: 1.5.1 windows/amd64
  • Bazaar: 2.5.1-1
  • Cygwin: 2.3.0 x86_64 (with make)

I try to run some commands to build packetbeat and some errors have occurred.

Direcotry:
/cygdrive/c/dev/workspace/src/github.com/elastic/beats/packetbeat

During go get:

$ go get
# github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap
C:\Dev\workspace\src\github.com\elastic\beats\vendor\github.com\tsg\gopacket\pcap\pcap.go:18:18: fatal error: pcap.h: No such file or directory
 #include <pcap.h>
  ^
compilation terminated.

The same during make:

$ make
go build
# github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap
C:\Dev\workspace\src\github.com\elastic\beats\vendor\github.com\tsg\gopacket\pcap\pcap.go:18:18: fatal error: pcap.h: No such file or directory
 #include <pcap.h>
  ^
compilation terminated.
../libbeat/scripts/Makefile:

Did I do something wrong? Or should I install another tool?

2

It looks like you are missing the WinPcap developer pack. This thread has more details: [SOLVED] Build packetbeat on windows

3

Thanks @andrewkroh

I installed WinPcap and now it works fine.

I also tried the vagrant box, it's really simple, good job.
But I'm not able to run make. Is it not needed?

4

@knobli which protocol you want to work on? I think it's a good idea to comment in a github ticket or create a new one to see if there's some more interest or some people being interested to help with implementation or testing.

5

@knobli It would be nice if make worked inside the vagrant box, but since most of us do not use Windows as our primary development environment it hasn't been needed. On Windows I have just been issuing the build and test commands manually or through a batch script. See make.bat.

6

I did not use make on windows to build packetbeat, I just used go build from my packetbeat directory, also the command prompt needed to run as administrator.

7

@steffens I'm working on the smpp protocol (knobli/beats). Initially I only want to parse the payload in hex data and forward it. I can process it later in logstash with my smpp filter.

Thanks for the inputs. I will start a unix system for the other steps. Is there a preconfigured vagrant box or docker image for a unix developer environment?

Is there a way to create the packetbeat.test executable under windows to run the python system tests?

8

the packetbeat.test binary is build via go test -c -covermode=atomic -coverpkg ./...