[tcpdump-workers] why tcpdump sometimes fails to link with libpcap

Denis Ovsienko denis at ovsienko.info
Tue Aug 1 05:32:15 EDT 2017

Hello list.

Excuse me for making the same observation once again but I was compiling tcpdump recently and ran into this boilerplate once again:

This is a bug, please follow the guidelines in CONTRIBUTING and include the
config.log file in your report.  If you have downloaded libpcap from
tcpdump.org, and built it yourself, please also include the config.log
file from the libpcap source directory, the Makefile from the libpcap
source directory, and the output of the make process for libpcap, as
this could be a problem with the libpcap that was built, and we will
not be able to determine why this is happening, and thus will not be
able to fix it, without that information, as we have not been able to
reproduce this problem ourselves.

This happens if tcpdump's ./configure has located libpcap headers and pcap-config but failed to link with libpcap from the location given by that pcap-config.

This particular time the reason for this was I built libpcap with some compiler flags and then tried to build tcpdump with some other compiler flags and the linking failed because of that (cannot tell the exact combination of flags right now but I run into this from time to time building the same git working copies on the same Linux host). Also the other case where it definitely happened was a Linux distribution with musl libc and custom stripped-down version of libnetlink, there you had to supply a number of flags to libpcap configure to make it work and it was probably the lack of counterpart flags to tcpdump configure that made it fail the linking. It was quite a long time ago so I do not remember the details except doing a clean build with the right flags first in libpcap and then in tcpdump directory solved the issue.

Another case of the same issue I vaguely remember was either on a Solaris host that tried to link into a libpcap repository on NFS (successfully compiled by a different Solaris host using a different compiler) or a FreeBSD host with CLang and GCC with libpcap working copy compiled with one compiler and tcpdump --- with the other.

This way or another, from my point of view this seems to be caused by a user error, so would it be more helpful to say in the message something like this?

"Using the libpcap prefix XXXXX and the flags suggested by "pcap-config --libs" (YYYYY) it was not possible to link tcpdump to the libpcap library, which usually means libpcap has been compiled but in a way not compatible with the way this tcpdump build is done, for whatever reason. If you are trying to compile tcpdump against a source tree of libpcap, it usually helps to rebuild libpcap from scratch (./configure && make clean all) first and then to rebuild tcpdump from scratch (./configure && make clean all). Any configure command-line options and environment variables used in the libpcap build may have to be reproduced in the tcpdump build too. Use a good judgement and check config.log for more information. If everything fails, please file a detailed bug report along the guidelines made in the CONTRIBUTING file in the tcpdump source tree."

    Denis Ovsienko

More information about the tcpdump-workers mailing list