net/bpf.h not installed

Xon · 11-28-2004, 04:30 PM

Hi there,
i tried to install p0f (passive operating fingerprinting tool) of lcamtuf, and looks like it didnt find net/bpf.h.

Code:

[root@localhost p0f]# ./Build
Your system type is: Linux

Please help with p0f 2:
  http://lcamtuf.coredump.cx/p0f-help/

GNU make found at /usr/bin/gmake, trying to use it...
gcc -O3 -Wall -fomit-frame-pointer -funroll-loops -o p0f p0f.c p0f-query.c -lpcap -I/usr/include/pcap -I/usr/local/include/pcap
p0f.c:39:21: net/bpf.h: No such file or directory
gmake: *** [p0f] Error 1

I ve installed libpcap-0.8.1 and i saw several "related" files like:

Code:

bpf_dump.c  bpf_dump.o  bpf_filter.c@  bpf_filter.o  bpf_image.c  bpf_image.o

Any suggestions?
Thanx

johnewing · 12-04-2004, 01:41 PM

Check that you have BPF support enabled in the kernel.

Cool_Yeti · 01-12-2005, 09:47 AM

Ok, this is a bit quick and dirty, but check if you have the file pcap-bpf.h (hopefully in /usr/include/) which comes with libpcap-devel (I think). If you have it, then you can simply do this:

cp /usr/include/pcap-bpf.h /usr/include/net/bpf.h
..... depending on the distribution ... maybe you need to change the directory names a bit. This trick worked for Mandrake very well.

Then you should be able to compile p0f.

Yes, it's a cheap trick.