Compile packetbeat on Centos6.8

Elastic Stack Beats
1

I have installed libpcap in Centos6.8, but when i compile packetbeat, it occurs a error, as flows:

go build -i -ldflags "-X github.com/elastic/beats/libbeat/version.buildTime=2019-07-16T03:40:29Z -X github.com/elastic/beats/libbeat/version.commit=72291e21ce9b6b6fb4fc8320d2d4be24e22bf20b"
# github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap
../vendor/github.com/tsg/gopacket/pcap/pcap_poll_linux.go:22:34: could not determine kind of name for C.TPACKET_V3
make: *** [packetbeat] Error 2
2

do you have libpcap present ?

3

I have installed libpcap1.5.3 in Centos6.8! But i am very confused about this error!

[root@9861b46f9fee /]# find / -name "libpcap.*"
/usr/local/lib/libpcap.so.1.5.3
/usr/local/lib/libpcap.so.1
/usr/local/lib/libpcap.a
/usr/local/lib/libpcap.so
/root/libpcap-1.5.3/libpcap.so.1.5.3
/root/libpcap-1.5.3/Win32/Prj/libpcap.dsw
/root/libpcap-1.5.3/Win32/Prj/libpcap.dsp
/root/libpcap-1.5.3/libpcap.a
4

it is indeed weird. have you by any chance modified sources?
the error suggests that it does not know TPACKET_V3 struct which is part of pcap. so there's either a code error, or maybe a version mismatch.

try installing libpcap 0.8

5

But it doesn't work! I have installed libpcap 0.8.1:

Errors:

go build -i -ldflags "-X github.com/elastic/beats/libbeat/version.buildTime=2019-07-16T10:05:02Z -X github.com/elastic/beats/libbeat/version.commit=07ed6f1cd32d774b4470d55512fe06c57ec589cd"
# github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap
../vendor/github.com/tsg/gopacket/pcap/pcap.go:609:29: could not determine kind of name for C.PCAP_D_IN
../vendor/github.com/tsg/gopacket/pcap/pcap.go:611:29: could not determine kind of name for C.PCAP_D_INOUT
../vendor/github.com/tsg/gopacket/pcap/pcap.go:610:29: could not determine kind of name for C.PCAP_D_OUT
../vendor/github.com/tsg/gopacket/pcap/pcap.go:296:19: could not determine kind of name for C.PCAP_ERROR_ACTIVATED
../vendor/github.com/tsg/gopacket/pcap/pcap.go:300:19: could not determine kind of name for C.PCAP_ERROR_IFACE_NOT_UP
../vendor/github.com/tsg/gopacket/pcap/pcap.go:298:19: could not determine kind of name for C.PCAP_ERROR_NO_SUCH_DEVICE
../vendor/github.com/tsg/gopacket/pcap/pcap.go:299:19: could not determine kind of name for C.PCAP_ERROR_PERM_DENIED
../vendor/github.com/tsg/gopacket/pcap/pcap.go:297:19: could not determine kind of name for C.PCAP_WARNING_PROMISC_NOTSUP
../vendor/github.com/tsg/gopacket/pcap/pcap.go:659:23: could not determine kind of name for C.pcap_activate
../vendor/github.com/tsg/gopacket/pcap/pcap.go:760:19: could not determine kind of name for C.pcap_can_set_rfmon
../vendor/github.com/tsg/gopacket/pcap/pcap.go:687:10: could not determine kind of name for C.pcap_create
../vendor/github.com/tsg/gopacket/pcap/pcap.go:619:44: could not determine kind of name for C.pcap_direction_t
../vendor/github.com/tsg/gopacket/pcap/pcap.go:405:8: could not determine kind of name for C.pcap_free_datalinks
../vendor/github.com/tsg/gopacket/pcap/pcap.go:501:9: could not determine kind of name for C.pcap_offline_filter
../vendor/github.com/tsg/gopacket/pcap/pcap.go:599:11: could not determine kind of name for C.pcap_sendpacket
../vendor/github.com/tsg/gopacket/pcap/pcap.go:776:15: could not determine kind of name for C.pcap_set_buffer_size
../vendor/github.com/tsg/gopacket/pcap/pcap.go:709:15: could not determine kind of name for C.pcap_set_promisc
../vendor/github.com/tsg/gopacket/pcap/pcap.go:768:15: could not determine kind of name for C.pcap_set_rfmon
../vendor/github.com/tsg/gopacket/pcap/pcap.go:696:15: could not determine kind of name for C.pcap_set_snaplen
../vendor/github.com/tsg/gopacket/pcap/pcap.go:720:15: could not determine kind of name for C.pcap_set_timeout
../vendor/github.com/tsg/gopacket/pcap/pcap.go:619:15: could not determine kind of name for C.pcap_setdirection
../vendor/github.com/tsg/gopacket/pcap/pcap.go:644:31: could not determine kind of name for C.pcap_statustostr

gcc errors for preamble:
../vendor/github.com/tsg/gopacket/pcap/pcap.go: In function 'pcap_set_immediate_mode':
../vendor/github.com/tsg/gopacket/pcap/pcap.go:35: error: 'PCAP_ERROR' undeclared (first use in this function)
../vendor/github.com/tsg/gopacket/pcap/pcap.go:35: error: (Each undeclared identifier is reported only once
../vendor/github.com/tsg/gopacket/pcap/pcap.go:35: error: for each function it appears in.)
../vendor/github.com/tsg/gopacket/pcap/pcap.go: In function 'pcap_tstamp_type_name_to_val':
../vendor/github.com/tsg/gopacket/pcap/pcap.go:47: error: 'PCAP_ERROR' undeclared (first use in this function)

make: *** [packetbeat] Error 2

[root@052ead9c9486 usr]# find / -name "pcap*"
/usr/include/pcap.h
/usr/include/pcap-namedb.h
/usr/include/pcap-bpf.h
/usr/man/man3/pcap.3
/root/libpcap-0.8.1/pcap-linux.c
/root/libpcap-0.8.1/pcap.3
/root/libpcap-0.8.1/packaging/pcap.spec
/root/libpcap-0.8.1/packaging/pcap.spec.in
/root/libpcap-0.8.1/pcap-stdinc.h
/root/libpcap-0.8.1/pcap-win32.c
/root/libpcap-0.8.1/pcap.h
/root/libpcap-0.8.1/pcap-pf.c
/root/libpcap-0.8.1/pcap-bpf.c
/root/libpcap-0.8.1/pcap-dag.c
/root/libpcap-0.8.1/pcap-namedb.h
/root/libpcap-0.8.1/pcap-bpf.h
/root/libpcap-0.8.1/pcap-null.c
/root/libpcap-0.8.1/pcap-pf.h
/root/libpcap-0.8.1/pcap-snoop.c
/root/libpcap-0.8.1/pcap-linux.o
/root/libpcap-0.8.1/pcap-snit.c
/root/libpcap-0.8.1/pcap.c
/root/libpcap-0.8.1/pcap-int.h
/root/libpcap-0.8.1/pcap-enet.c
/root/libpcap-0.8.1/pcap-nit.h
/root/libpcap-0.8.1/pcap-dlpi.c
/root/libpcap-0.8.1/pcap.o
/root/libpcap-0.8.1/pcap-dag.h
/root/libpcap-0.8.1/pcap-nit.c
6

will try to setup the same env as you have, what version of beats are you trying to build. also do you use 32 or 64 bit version of centos.
which version of Go do you use?

7

ok I guess I know what the problem is. TPACKET_V3 was introduced in kernel 3.2 but centos 6.8 uses kernel version 2.6 so it will not get compiled.
have you tried using prebuilt binary distributed as tar ball, this worked fine for me?

8

Thanks for the solution

tellthebell

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.