This post discusses fixing configuring Suricata 7.x with pfring, where an error persisted despite a correct library version.
When attempting to configure Suricata 7.x with pfring with following commands:
LIBS="-lrt" ./configure --prefix=/home/probe/Workspaces/suricata-7.0.0 \
--sysconfdir=/home/probe/Workspaces/suricata-7.0.0/etc \
--localstatedir=/home/probe/Workspaces/suricata-7.0.0/var \
--with-libpfring-includes=/usr/local/include \
--with-libpfring-libraries=/usr/local/lib \
--enable-pfring
an error was occurred:
ERROR! --enable-pfring was passed but the library version is < 6, go get it
However, the pfring library version under the path is actually greater than 8:
➜ lib ll /usr/local/lib
total 7.3M
drwxrwxr-x 2 root root 4.0K Aug 16 11:39 daq
-rw-rw-r-- 1 root root 2.6M Aug 14 22:33 libpcap.a
-rw-rw-r-- 1 root root 483 Aug 14 22:33 libpcap.pc
-rw-rw-r-- 1 root root 484 Aug 14 22:33 libpcap.pc.in
lrwxrwxrwx 1 root root 17 Aug 14 22:33 libpcap.so -> libpcap.so.1.10.1
lrwxrwxrwx 1 root root 17 Aug 16 11:39 libpcap.so.1 -> libpcap.so.1.10.1
-rwxrwxr-x 1 root root 2.0M Aug 14 22:33 libpcap.so.1.10.1
-rw-r--r-- 1 root root 1.2M Aug 15 11:03 libpfring.a
lrwxrwxrwx 1 root root 18 Aug 15 11:03 libpfring_min.so -> libpfring_min.so.8
lrwxrwxrwx 1 root root 22 Aug 15 11:03 libpfring_min.so.8 -> libpfring_min.so.8.4.0
-rwxr-xr-x 1 root root 744K Aug 15 11:03 libpfring_min.so.8.4.0
lrwxrwxrwx 1 root root 14 Aug 15 11:03 libpfring.so -> libpfring.so.8
lrwxrwxrwx 1 root root 18 Aug 15 11:03 libpfring.so.8 -> libpfring.so.8.4.0
-rwxr-xr-x 1 root root 838K Aug 15 11:03 libpfring.so.8.4.0
It seems there appears to be an issue with Suricata’s recognition of the pfring version. According with1, it actually needs to install the pfring package:
➜ suricata-7.0.0 sudo apt-get install pfring
Once successfully installed, configure again with the same command, and this time configured without any error.