[tcpdump-workers] Re: tcpdump and pcapng with comments
Hi Folks I added some code (modified) tcpdump to write the pcapng file. while configuring/compiling the source code I get this error This is a cross compilation for ARM platform configure: error: *flex is insufficient to compile libpcap.* libpcap requires Flex 2.5.31 or later, or a compatible version of lex. # flex -V flex 2.5.37 Same error is true for bison/m4. (I am not sure what is that tool for) Any help in this regard? On Sat, Apr 5, 2025 at 12:27 AM Guy Harris wrote: > On Apr 4, 2025, at 11:29 AM, Michael Richardson wrote: > > > I can't recall if we can read pcapng. > > libpcap - and thus programs, such as tcpdump, that use libpcap to read > capture files - can read some pcapng files, as long as the current libpcap > API can handle them. That's been the case since libpcap 1.1. > > However, "as long as the current libpcap API can handle them" means that: > > 1) all of the sections of the pcapng file must have the same byte > order, as the current API reports a single byte order for the entire file; > > 2) all interfaces in all sections of the pcapng file must have the > same link-layer header type and snapshot length, as the current API reports > a single link-layer header type and snapshot length for the entire file; > > 3) block types other than packet blocks can't be reported to the > caller; > > 4) options such as comments can't be reported to the caller. ___ tcpdump-workers mailing list -- tcpdump-workers@lists.tcpdump.org To unsubscribe send an email to tcpdump-workers-le...@lists.tcpdump.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
[tcpdump-workers] Re: tcpdump and pcapng with comments
Just to clarify, I am building libpcap (where I have added the code) tcpdump compilation is fine but obviously gives symbol error because libpcap is bot yet built. thanks On Sun, Apr 6, 2025 at 2:41 PM Mahesh V wrote: > Hi Folks > > I added some code (modified) tcpdump to write the pcapng file. > while configuring/compiling the source code I get this error > This is a cross compilation for ARM platform > > configure: error: *flex is insufficient to compile libpcap.* > libpcap requires Flex 2.5.31 or later, or a compatible version of lex. > > # flex -V > flex 2.5.37 > Same error is true for bison/m4. (I am not sure what is that tool for) > > Any help in this regard? > > > On Sat, Apr 5, 2025 at 12:27 AM Guy Harris wrote: > >> On Apr 4, 2025, at 11:29 AM, Michael Richardson wrote: >> >> > I can't recall if we can read pcapng. >> >> libpcap - and thus programs, such as tcpdump, that use libpcap to read >> capture files - can read some pcapng files, as long as the current libpcap >> API can handle them. That's been the case since libpcap 1.1. >> >> However, "as long as the current libpcap API can handle them" means that: >> >> 1) all of the sections of the pcapng file must have the same byte >> order, as the current API reports a single byte order for the entire file; >> >> 2) all interfaces in all sections of the pcapng file must have >> the same link-layer header type and snapshot length, as the current API >> reports a single link-layer header type and snapshot length for the entire >> file; >> >> 3) block types other than packet blocks can't be reported to the >> caller; >> >> 4) options such as comments can't be reported to the caller. > > ___ tcpdump-workers mailing list -- tcpdump-workers@lists.tcpdump.org To unsubscribe send an email to tcpdump-workers-le...@lists.tcpdump.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
[tcpdump-workers] Re: tcpdump and pcapng with comments
configure:7921: checking for flex configure:7937: found tools/arm-5.3-uclibc-1.0.12/usr/bin/flex configure:7948: result: flex configure:7986: flex conftest.l *flex: fatal internal error, exec of /var/tmp/tool-chains/buildroot-2016.02-5.3-arm/crosstools-arm-gcc-5.3-linux-4.1-uclibc-1.0.12-binutils-2.25-NPTL/usr/bin/m4 failed* which m4 *# which m4tools/arm-5.3-uclibc-1.0.12/usr/bin/m4* m4 exists and I have set M4PATH env variable as well; however, it seems to pick it up from where flex was built before. Mahesh On Mon, Apr 7, 2025 at 3:52 AM Guy Harris wrote: > On Apr 6, 2025, at 2:28 PM, Michael Richardson wrote: > > > Mahesh V wrote: > >> I added some code (modified) tcpdump to write the pcapng file. > >> while configuring/compiling the source code I get this error > >> This is a cross compilation for ARM platform > > > > Well, likely the resulting flex test can't be run, since it's > cross-compiled. > > The test just runs the (F)lex command that it found, with some options > that we require that Flex support, so there's no compiled code to run, > but... > > > Read the config.out to see why it really failed; my guess is above. > > Regardless, you will need to post more details about the failure. > > ...without the config.out file, we can't figure out what the problem is. ___ tcpdump-workers mailing list -- tcpdump-workers@lists.tcpdump.org To unsubscribe send an email to tcpdump-workers-le...@lists.tcpdump.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
[tcpdump-workers] Re: tcpdump and pcapng with comments
Mahesh V wrote: > I added some code (modified) tcpdump to write the pcapng file. > while configuring/compiling the source code I get this error > This is a cross compilation for ARM platform Well, likely the resulting flex test can't be run, since it's cross-compiled. I suggest *NOT* doing cross-compilation while you are working on new code. > configure: error: *flex is insufficient to compile libpcap.* > libpcap requires Flex 2.5.31 or later, or a compatible version of lex. > # flex -V > flex 2.5.37 > Same error is true for bison/m4. (I am not sure what is that tool for) Read the config.out to see why it really failed; my guess is above. Regardless, you will need to post more details about the failure. ___ tcpdump-workers mailing list -- tcpdump-workers@lists.tcpdump.org To unsubscribe send an email to tcpdump-workers-le...@lists.tcpdump.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
[tcpdump-workers] Re: tcpdump and pcapng with comments
On Apr 6, 2025, at 2:28 PM, Michael Richardson wrote: > Mahesh V wrote: >> I added some code (modified) tcpdump to write the pcapng file. >> while configuring/compiling the source code I get this error >> This is a cross compilation for ARM platform > > Well, likely the resulting flex test can't be run, since it's cross-compiled. The test just runs the (F)lex command that it found, with some options that we require that Flex support, so there's no compiled code to run, but... > Read the config.out to see why it really failed; my guess is above. > Regardless, you will need to post more details about the failure. ...without the config.out file, we can't figure out what the problem is. ___ tcpdump-workers mailing list -- tcpdump-workers@lists.tcpdump.org To unsubscribe send an email to tcpdump-workers-le...@lists.tcpdump.org %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
