Hi - I'm just wondering if it is possible to compile or run packetbeat with the system (or a specific) libpcap library? I have a specially-created libpcap library from a hardware vendor that allows me to see my physical capture card, but the cards are not visible with packetbeat. All other libpcap-based programs (tcpdump, tshark, etc) work fine and show these special interfaces when listing devices, but the interfaces do not show in packetbeat when listing devices. I suspect that is because the other programs are simply using the system libpcap.
What operating system are we talking about here? The packetbeat binary is statically linked on Linux. You could build your own binary that is dynamically linked.
Hi Andrew. Thanks for the response! I'm talking about an old build of FC Linux (10) x86_64 - kernel 2.6.27.12-170.2.5. Unfortunately, the box was purchased as an appliance and the OS cannot be upgraded past it's current point while still keeping the capture card drivers and other software working and I no longer have support for the card (the company was sold, etc). The specific build of libpcap with support for the card that is installed on the box is 1.0. Will Packetbeat even work with this version of libpcap?
As for building my own binary, I did try going that route earlier today. I followed a guide and checked out the project from git, but I immediately ran into issues when trying to compile Packetbeat (I'm guessing related to how old this OS is and the installed packages are, but I'm not sure). The latest binary release seems to work fine on the system when capturing on the standard interfaces, though. When trying to compile, I was getting errors like "previous declaration of 'uint64_t'", etc. when doing make. And I wasn't actually sure how to dynamically link libpcap.
Would it be smarter/easier to try to do the build on a newer RH-based system and then just copy over the binary? Could I still build the binary in a dynamically linked way on a different system? Would it have to be the exact same version of libpcap? I'm not all that familiar with compiling C programs (or how to specify libraries with C flags, etc. if that's needed), but I do have a tiny bit of experience. I've also never used Go either (but that part was pretty straight-foward).
If it's worth trying, any help you could provide into how to compile Packetbeat so that libpcap is dynamically linked would be greatly appreciated.
You could compile it on another system. Just make sure the libc version is the same as the target system. By default when running go build the compiler will produce a dynamically linked binary (it takes extra work to build a statically linked binary). Just make sure you have the libpcap headers installed. You can run ldd ./packetbeat to see how the resulting binary is linked.
I think it may require at least pcap 1.1 (see this comment in gopacket), but you can try.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.