CODEWITHSUNDEEP
clinkerpcap
Pete
Pete

Reputation: 1561

Issues Linking pcap.p when libpcap is installed on my Ubuntu

I found a handy packet capture program in C and went to compile it on my home Ubuntu box. The original code had this at the top:

#include <pcap/pcap.h>

But when I compiled, I saw this:

root@ubuntu:/home/me# gcc -Wall packetCap.c
/tmp/cc2kDt1M.o: In function `main':
packetCap.c:(.text+0x33): undefined reference to `pcap_lookupdev'
packetCap.c:(.text+0xa0): undefined reference to `pcap_open_live'
packetCap.c:(.text+0xef): undefined reference to `pcap_next'
collect2: error: ld returned 1 exit status
root@ubuntu:/home/me#

Doesn’t look like the code can see pcap.h. I did a search, found what appears to be a fully-working version of pcap.h in /usr/include/pcap/, and then changed my code to this:

//#include <pcap/pcap.h>                // if this gives you an error try pcap/pcap.h
#include "/usr/include/pcap/pcap.h"

But I still got the exact same compilation errors.

Anyone see what I'm doing wrong? I looked at earlier StackOverflow posts, and here's some basic tricks I did to rule out earlier SO guidance:

First, specifying the directory when compiling had no effect:

root@ubuntu:/home/me# gcc -I/usr/include/pcap -Wall packetCap.c
/tmp/cc2kDt1M.o: In function `main':
packetCap.c:(.text+0x33): undefined reference to `pcap_lookupdev'
packetCap.c:(.text+0xa0): undefined reference to `pcap_open_live'
packetCap.c:(.text+0xef): undefined reference to `pcap_next'
collect2: error: ld returned 1 exit status
root@ubuntu:/home/me#

I grepped /usr/include/pcap/pcap.h, and it looks like the functions I need are described within:

root@ubuntu:/home/me# more /usr/include/pcap/pcap.h | grep pcap_lookupdev
PCAP_API char   *pcap_lookupdev(char *);
root@ubuntu:/home/me# more /usr/include/pcap/pcap.h | grep pcap_open_live
        char *name;             /* name to hand to "pcap_open_live()" */
PCAP_API pcap_t *pcap_open_live(const char *, int, int, int, char *);
root@ubuntu:/home/me# more /usr/include/pcap/pcap.h | grep pcap_next
PCAP_API const u_char *pcap_next(pcap_t *, struct pcap_pkthdr *);
PCAP_API int    pcap_next_ex(pcap_t *, struct pcap_pkthdr **, const u_char **);
root@ubuntu:/home/me#

And I definitely have libpcap installed:

root@ubuntu:/home/me# apt-get install libpcap-dev
Reading package lists... Done
Building dependency tree
Reading state information... Done
libpcap-dev is already the newest version (1.7.4-2ubuntu0.1).
The following packages were automatically installed and are no longer required:
  libjline-java libnetty-3.9-java libpython-all-dev libpython3-dev libpython3.5-dev libzookeeper-java python-all python-all-dev python-pip-whl python-wheel python3-dev python3-wheel python3.5-dev zookeeper
Use 'apt autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 442 not upgraded.
root@ubuntu:/home/me#

Do I have to do a #define PCAP_API at the stop of my code or something? Can anyone spot what I’m doing wrong? Thanks.

Upvotes: 1

Views: 1071

Answers (1)

P.P
P.P

Reputation: 121347

You're missing the pcap library in the link command. The best way to know pcap include paths and libs to link is to use pcap-config tool.

$ pcap-config --cflags
-I/usr/include
$ pcap-config --libs
-lpcap

In the compile command, you could use:

gcc -Wall -Wextra $(pcap-config --cflags) packetCap.c $(pcap-config --libs)

Upvotes: 3

Related Questions