[Pandora] 100% success: tcpscan [ $reject = false ] and --disable-custom-libpcap

[uaca]

Hi


I have just compiled pandora-current successfully with libpcap-0.7.1

I made the following to get it working

 1074  cd pandora-current
 1075  mv libpcap/ libpcap.orig
 1076  tar zxvf ~/new_packages/libpcap-0.7.1.tar.gz  -C .
 1078  ln -s libpcap-0.7.1 libpcap
 1079  cd libpcap
 1080  ./configure
 1081  cd ..
 1083  ./configure  --disable-custom-libpcap
 1088  make


Please note that you have to "./configure" the libpcap by hand


also using new tcpscan option works 

my stack to test it was

%prova {
         @pcap [ $device = "eth0", $filter = "tcp and port 13" ];
#        @pcap [ $file = "/home/ulisses/prova11.dump" ];
         @count;
         @tcpscan [ $reject = false ];
         @count;
         @discard;
}

And the test was a single

telnet connection to a daytime server (port 13)

Here are the results

address@hidden src]# ./pandora -f stacks.prova prova
pandora: prova[1]: started (fd=4)
pandora: prova[1]: signaled
pandora: prova[1]: signaled
pandora: prova[1]: finished
pandora: prova[1]: stopped
pandora: prova[1]: flushed
pandora: component address@hidden: 8
pandora: component address@hidden: 8 <<<<< Wow!!! :-)
pandora: prova[1]: cleaned up


Thanks Simon!


        Ulisses

                Debian GNU/Linux: a dream come true
-----------------------------------------------------------------------------
"Computers are useless. They can only give answers."            Pablo Picasso

--->    Visita http://www.valux.org/ para saber acerca de la    <---
--->    Asociación Valenciana de Usuarios de Linux              <---