Howdy All,

I don't suppose an installer package could be made available that will compile off local copies of things like libpcap? For organizations that use high speed capture cards like Endance and nPulse we can't make use of a product that requires a pre-built, and old version, of libpcap.

You have a very interesting product I would like to test, but until I can compile it against my own Dag enabled, and latest releases of libpcap, I won't be able to.

Thanks for your interest, I would be delighted if you could try this product on these cards.

For this most recent release libpcap (the latest version from source) was statically linked with trisul before packaging. This was done so that Trisul can install on barebones CentOS 5.6 without complaining about a libpcap dependency.

It seemed like a good idea at that time

Would it work if trisul picked up a modified libpcap.so that you created ? I can get a new build out tomorrow.

Cheers,

As long as I can link it against a local build in some way that should be all I need for it to work.

-Leif

Sorry taking a bit longer than expected. It turns out the DAG libpcap does not support pcap_get_selectable_fd() which Trisul relies on. See github.com/mcr/libpcap/blob/master/README.dag

Just done adding an option to run using non blocking pcap_dispatch() to allow capturing from multiple interfaces. Should be ready to test in a few hours. Thanks for your patience.

Hi,

I hope you are on Ubuntu because we could only make the DEB today. You can download it from www.unleashnetworks.com/lib/private/trisul_1.2.706_amd64.deb
We can get the 64-bit Centos RPM out tomorrow.


Notes :

1) This release will use whatever libpcap modified you have on the system. I removed the earlier static linking with libpcap 1.1.1

2) Run webtrisul - then go to Customize > Profiles and add in and enable your DAG interfaces (dag0,etc) .

3) It seems to be hard to do a "zero copy" with DAG enabled libpcap. There is no way to mark the tail end of the reading application so that the DAG driver will not overrun it. WIth the native DAG interface it will be possible. The point is that there may be a 20% or so speed penalty.

Hey,

When I try to install the Deb, I get the following:

dpkg -i trisul_1.2.706_amd64.deb
Selecting previously deselected package trisul.
(Reading database ... 79705 files and directories currently installed.)
Unpacking trisul (from trisul_1.2.706_amd64.deb) ...
dpkg: dependency problems prevent configuration of trisul:
trisul depends on libpcap0.8; however:
Package libpcap0.8 is not installed.
dpkg: error processing trisul (--install):
dependency problems - leaving unconfigured
Processing triggers for ureadahead ...
Errors were encountered while processing:
trisul

It still seems to think trisul require .8 and leaves the install unfinished.