# Error compiling packetbeat on OS X EI Capitan **URL:** https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148 **Category:** Beats **Tags:** packetbeat **Created:** [July 11, 2016, 4:03am UTC](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148 "2016-07-11T04:03:16Z") **Posts on this page:** 5 **Page:** 1
### Author: ![billzy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/billzy/32/9967_2.png) [@billzy](https://discuss.elastic.co/u/billzy) #### Post date: [July 11, 2016, 4:03am UTC](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148/1 "2016-07-11T04:03:16Z")
I'm running into a weird situation here, hope someone could help me out ! While I was compiling packetbeat source code, I got the following error, ``` go build # github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap could not determine kind of name for C.PCAP_ERROR_ACTIVATED could not determine kind of name for C.PCAP_ERROR_IFACE_NOT_UP could not determine kind of name for C.PCAP_ERROR_NO_SUCH_DEVICE could not determine kind of name for C.PCAP_ERROR_PERM_DENIED could not determine kind of name for C.PCAP_WARNING_PROMISC_NOTSUP could not determine kind of name for C.pcap_activate could not determine kind of name for C.pcap_can_set_rfmon could not determine kind of name for C.pcap_create could not determine kind of name for C.pcap_free_datalinks could not determine kind of name for C.pcap_offline_filter could not determine kind of name for C.pcap_set_buffer_size could not determine kind of name for C.pcap_set_promisc could not determine kind of name for C.pcap_set_rfmon could not determine kind of name for C.pcap_set_snaplen could not determine kind of name for C.pcap_set_timeout could not determine kind of name for C.pcap_statustostr clang errors for preamble: ../vendor/github.com/tsg/gopacket/pcap/pcap.go:35:10: error: use of undeclared identifier 'PCAP_ERROR' return PCAP_ERROR; ^ ../vendor/github.com/tsg/gopacket/pcap/pcap.go:47:9: error: use of undeclared identifier 'PCAP_ERROR' return PCAP_ERROR; ^ 2 errors generated. make: *** [build] Error 2 ``` I checked the pcap.go file and found the two error lines were within the annotation, seems the compiler took the annotation as program statements incorrectly, how did that happen ? then I tried to build it on Linux, it worked. Below is my environment of GO: ``` GOARCH="amd64" GOBIN="" GOEXE="" GOHOSTARCH="amd64" GOHOSTOS="darwin" GOOS="darwin" GOPATH="/Users/yuzhiyu/Documents/programming/go" GORACE="" GOROOT="/usr/local/go" GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64" GO15VENDOREXPERIMENT="1" CC="clang" GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage- length=0 -fno-common" CXX="clang++" CGO_ENABLED="1" ``` Any idea is appreciated !! ---
### Author: ![billzy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/billzy/32/9967_2.png) [@billzy](https://discuss.elastic.co/u/billzy) #### Post date: [July 11, 2016, 7:00am UTC](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148/2 "2016-07-11T07:00:10Z")
it turned out that the annotation lines in GO code is cgo (C code in GO), then the problem becomes why cgo failed to include pcap.h header file which include PCAP\_ERROR and some additional variables. below is the code I found in beats/vendor/github.com/tsg/gopacket/pcap/pcap.go ``` package pcap 9 10 /* 11 #cgo linux LDFLAGS: -lpcap 12 #cgo freebsd LDFLAGS: -lpcap 13 #cgo openbsd LDFLAGS: -lpcap 14 #cgo darwin LDFLAGS: -lpcap 15 #cgo solaris LDFLAGS: -lpcap 16 #cgo windows CFLAGS: -I C:/WpdPack/Include 17 #cgo windows,386 LDFLAGS: -L C:/WpdPack/Lib -lwpcap 18 #cgo windows,amd64 LDFLAGS: -L C:/WpdPack/Lib/x64 -lwpcap 19 #include 20 #include 21 22 // Some old versions of pcap don't define this constant. 23 #ifndef PCAP_NETMASK_UNKNOWN 24 #define PCAP_NETMASK_UNKNOWN 0xffffffff 25 #endif ``` seems line#20 is not functioning, really need your advices. ---
### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor) #### Post date: [July 11, 2016, 8:58am UTC](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148/3 "2016-07-11T08:58:32Z")
That's strange, libpcap should be installed by default on OS X, and the flags should be fine to work with the default installation. Please check that the `/usr/include/pcap.h` exists on your system. ---
### Author: ![billzy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/billzy/32/9967_2.png) [@billzy](https://discuss.elastic.co/u/billzy) #### Post date: [July 11, 2016, 9:13am UTC](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148/4 "2016-07-11T09:13:57Z")
Thanks for the reply. I do have a pcap.h in /usr/include. The problem is solved as below. I searched google about clang, found the following command which can show some info about clang. clang -v -x c /dev/null the output for this command is : ``` #include <...> search starts here: /usr/local/include /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/cl ang/7.3.0/include /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include /usr/include ``` which means clang search for pcap.h according to this order above. then I checked first one /usr/local/include and found a pcap.h file but the version seemed to be incorrect 'cause it did not contain PCAP\_ERROR, I have not idea how this file appeared. The compiler possibly found this file and stop looking at the other lines, so missed the correct one under /usr/include. Solve: rename the pcap.h file to pcap\_not\_in\_use.h, it works now. ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [August 1, 2016, 4:03am UTC](https://discuss.elastic.co/t/error-compiling-packetbeat-on-os-x-ei-capitan/55148/5 "2016-08-01T04:03:35Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.