Eve.json windows timestamp field has "Eastern Daylight Time" appended to timestamp

Help
1

I am running Suricata-5.0.2-1-64bit.exe suricata install on windows. When I try to import the json data into mysql using this tool, https://github.com/beave/meer, it fails on windows because the timestamp looks like this “2020-05-04T01:08:06.39502Eastern Daylight Time” In linux it looks like this. "2020-05-04T01:08:06.3950273-0400.

Note I am typing these out because the systems are not on this machine and I can’t copy paste between them easily. So ignore minor time error details in case I misstyped

btw, Zeek is working on a tool called zeekagent and eventually plans to support windows. Since suricata already has windows support, I am working on a suricataAgent that will provide similar functionality. Instead of seeing x gigs of traffic left your network last night, you will be able to see the exact process that did it. Zeekagent will do this using osquery, in my example, it will simply use netstat -anoob. Netstat -anoob runs very fast and provides key pid info needed to connect traffic with a specific program. Adding this information to clarify, “don’t use windows” is not going to work for this use case.

Is this something I can adjust in a config file? Maybe it’s a windows setting that can be changed?
This commit looks like the one that adds the timezone.

thanks!

2

Bash temporary solution.
unbuffer sed -e “s/Eastern\ Daylight\ Time//g” <(tail -f eve.log) > fixed.log

3

This is odd. My (linux) manpage says:

       %z     The +hhmm or -hhmm numeric timezone (that is, the hour and minute offset from UTC). (SU)

Maybe the Windows (or MinGW?) implementation isn’t following this.

The manpage also says:

ENVIRONMENT
       The environment variables TZ and LC_TIME are used.

I’m not able to test this myself right now, but maybe these env vars can be used to somehow adjust the behavior. Don’t know from the top of my head what settings to try though.

4

Nevermind my earlier response. I’ve update the ticket:
https://redmine.openinfosecfoundation.org/issues/3690#note-2

The short of it is that this an OS difference and we’ll need to add a workaround for Windows.

1 Like
5

Are you able to give our git master a test? I’ve pushed a fix.

6

I already downloaded this
https://www.openinfosecfoundation.org/download/windows/Suricata-5.0.3-1-64bit.msi
but it wasn’t fixed in that version.

Getting the mingw stuff setup will have to be a weekend thing if an msi isn’t available to test

7

Victor,
what is the most up to date guide for compiling for windows? I found some old links and some long troubleshooting threads from last year in the other forum. The guides I have found so far are very old.

8

Hi,
Can you please try the following:

First install msys2 - 64bit
https://www.msys2.org/

Update and install the deps:

After install use the Mingw64 (click on Msys it will ask which one of the three environments to start) on start up to build Suricata. Choose Mingw64 then inside run the below pkg install commands.

pacman -Syuu

Follow the instructions for the command above after it finishes - it usually asks you to close the window and start Msys it again, in those cases , just close the window, don’t do Ctrl+C etc. Do the same for the below 2 commands as well.

pacman -S --needed base-devel mingw-w64-x86_64-toolchain git subversion

pacman -S  mingw64/mingw-w64-x86_64-libtool mingw64/mingw-w64-x86_64-pcre \
mingw64/mingw-w64-x86_64-lua mingw64/mingw-w64-x86_64-geoip \
mingw64/mingw-w64-x86_64-luajit-git wget jansson  jansson-devel libpcre pcre pcre-devel gcc  gcc-libs  make autoconf \
autogen automake git libyaml libyaml-devel zlib zlib-devel pkg-config \
mingw64/mingw-w64-x86_64-nspr mingw64/mingw-w64-x86_64-nss mingw64/mingw-w64-x86_64-rust  mingw64/mingw-w64-x86_64-python3-yaml \
mingw64/mingw-w64-x86_64-jansson msys/jansson-devel msys/jansson

Download and unzip npcap-sdk (https://nmap.org/npcap/) in the proper folder so after words you could use something similar "–with-libpcap-includes=/npcap-sdk/Include --with-libpcap-libraries=/npcap-sdk/Lib/x64 "

Also install npcap as well - https://nmap.org/npcap/dist/npcap-0.9993.exe

If you would like to try the latest Suricata code - (just adjust the npcap paths accordingly to where your install is - step 3 above):

git clone  https://github.com/OISF/suricata.git && cd suricata && git clone https://github.com/OISF/libhtp.git -b 0.5.x &&  ./autogen.sh &&  \
./configure   \
--with-libpcap-includes=c:/msys64/npcap-sdk/Include --with-libpcap-libraries=c:/msys64/npcap-sdk/Lib/x64  \
--with-libnss-libraries=/mingw64/lib/ --with-libnss-includes=/mingw64/include/nss3/ \
--with-libnspr-libraries=/mingw64/lib/ --with-libnspr-includes=/mingw64/include/nspr/ \
--enable-lua --enable-geoip --disable-gccmarch-native \
&& make clean && make -j 2

The resulting Suricata exe should be under “src/.libs/”

Thanks for testing !

9

No luck when running configure. Here is a microsoft onedrive link to my config.log. Errors start at line 5,176
https://1drv.ms/u/s!AseRhtq9Dm_nghRh9L1GRqghZAUh

Partial output below

configure:24043: gcc -c -g -O2 -DOS_WIN32 -std=c11 -I/npcap-sdk/Include conftest.c >&5
In file included from /usr/include/sys/socket.h:13,
from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/cygwin/socket.h:27:8: error: redefinition of ‘struct sockaddr’
27 | struct sockaddr {
| ^~~~~~~~
In file included from /usr/include/w32api/winsock2.h:57,
from conftest.c:150:
/usr/include/w32api/psdk_inc/_ip_types.h:70:8: note: originally defined here
70 | struct sockaddr {
| ^~~~~~~~
In file included from /usr/include/sys/socket.h:13,
from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/cygwin/socket.h:39:8: error: redefinition of ‘struct sockaddr_storage’
39 | struct sockaddr_storage {
| ^~~~~~~~~~~~~~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:269:10: note: originally defined here
269 | struct sockaddr_storage {
| ^~~~~~~~~~~~~~~~
In file included from /usr/include/sys/socket.h:13,
from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/cygwin/socket.h:52:8: error: redefinition of ‘struct linger’
52 | struct linger {
| ^~~~~~
In file included from /usr/include/w32api/winsock2.h:57,
from conftest.c:150:
/usr/include/w32api/psdk_inc/_ip_types.h:63:8: note: originally defined here
63 | struct linger {
| ^~~~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:21:7: error: conflicting types for ‘accept’
21 | int accept (int, struct sockaddr *__peer, socklen_t *);
| ^~~~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1003:37: note: previous declaration of ‘accept’ was here
1003 | WINSOCK_API_LINKAGE SOCKET WSAAPI accept(SOCKET s,struct sockaddr *addr,int *addrlen);
| ^~~~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:23:7: error: conflicting types for ‘bind’
23 | int bind (int, const struct sockaddr *__my_addr, socklen_t __addrlen);
| ^~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1004:34: note: previous declaration of ‘bind’ was here
1004 | WINSOCK_API_LINKAGE int WSAAPI bind(SOCKET s,const struct sockaddr *name,int namelen);
| ^~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:24:7: error: conflicting types for ‘connect’
24 | int connect (int, const struct sockaddr *, socklen_t);
| ^~~~~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1006:34: note: previous declaration of ‘connect’ was here
1006 | WINSOCK_API_LINKAGE int WSAAPI connect(SOCKET s,const struct sockaddr *name,int namelen);
| ^~~~~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:25:7: error: conflicting types for ‘getpeername’
25 | int getpeername (int, struct sockaddr *__peer, socklen_t *);
| ^~~~~~~~~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1008:34: note: previous declaration of ‘getpeername’ was here
1008 | WINSOCK_API_LINKAGE int WSAAPI getpeername(SOCKET s,struct sockaddr *name,int *namelen);
| ^~~~~~~~~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:26:7: error: conflicting types for ‘getsockname’
26 | int getsockname (int, struct sockaddr *__addr, socklen_t *);
| ^~~~~~~~~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1009:34: note: previous declaration of ‘getsockname’ was here
1009 | WINSOCK_API_LINKAGE int WSAAPI getsockname(SOCKET s,struct sockaddr *name,int *namelen);
| ^~~~~~~~~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:27:7: error: conflicting types for ‘listen’
27 | int listen (int, int __n);
| ^~~~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1017:34: note: previous declaration of ‘listen’ was here
1017 | WINSOCK_API_LINKAGE int WSAAPI listen(SOCKET s,int backlog);
| ^~~~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:28:11: error: conflicting types for ‘recv’
28 | ssize_t recv (int, void *__buff, size_t __len, int __flags);
| ^~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1022:34: note: previous declaration of ‘recv’ was here
1022 | WINSOCK_API_LINKAGE int WSAAPI recv(SOCKET s,char *buf,int len,int flags);
| ^~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:29:11: error: conflicting types for ‘recvfrom’
29 | ssize_t recvfrom (int, void *__buff, size_t __len, int __flags,
| ^~~~~~~~
In file included from conftest.c:150:
/usr/include/w32api/winsock2.h:1023:34: note: previous declaration of ‘recvfrom’ was here
1023 | WINSOCK_API_LINKAGE int WSAAPI recvfrom(SOCKET s,char *buf,int len,int flags,struct sockaddr *from,int *fromlen);
| ^~~~~~~~
In file included from /npcap-sdk/Include/pcap/socket.h:67,
from /npcap-sdk/Include/pcap/pcap.h:87,
from /npcap-sdk/Include/pcap.h:43,
from conftest.c:155:
/usr/include/sys/socket.h:32:11: error: conflicting types for ‘send’
32 | ssize_t send (int, const void *__buff, size_t __len, int __flags);

10

Did the installation of all prereq packages go ok? No errors there?

11

Everything is good until here. Not sure why some of these are failing.

user1@suricatatest MSYS ~/suricata
# ./configure   --with-libpcap-includes=c:/msys64/npcap-sdk/Include --with-libpcap-libraries=c:/msys64/npcap-sdk/Lib/x64  --with-libnss-libraries=/mingw64/lib/ --with-libnss-includes=/mingw64/include/nss3/ --with-libnspr-libraries=/mingw64/lib/ --with-libnspr-includes=/mingw64/include/nspr/ --enable-lua --enable-geoip --disable-gccmarch-native
configure: loading site script /etc/config.site
checking whether make supports nested variables... yes
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether UID '197108' is supported by ustar format... yes
checking whether GID '197121' is supported by ustar format... yes
checking how to create a ustar tar archive... gnutar
checking build system type... x86_64-pc-msys
checking host system type... x86_64-pc-msys
checking how to print strings... printf
checking whether make supports the include directive... yes (GNU style)
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.exe
checking for suffix of executables... .exe
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for a sed that does not truncate output... /usr/bin/sed
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for fgrep... /usr/bin/grep -F
checking for ld used by gcc... /usr/x86_64-pc-msys/bin/ld.exe
checking if the linker (/usr/x86_64-pc-msys/bin/ld.exe) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... no, using cp -pR
checking the maximum length of command line arguments... 8192
checking how to convert x86_64-pc-msys file names to x86_64-pc-msys format... func_convert_file_noop
checking how to convert x86_64-pc-msys file names to toolchain format... func_convert_file_noop
checking for /usr/x86_64-pc-msys/bin/ld.exe option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... file_magic ^x86 archive import|^x86 DLL
checking for dlltool... dlltool
checking how to associate runtime and link libraries... func_cygming_dll_for_implib
checking for ar... ar
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for a working dd... /usr/bin/dd
checking how to truncate binary pipes... /usr/bin/dd bs=4096 count=1
checking for mt... no
checking if : is a manifest tool... no
checking how to run the C preprocessor... gcc -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -DDLL_EXPORT -DPIC
checking if gcc PIC flag -DDLL_EXPORT -DPIC works... yes
checking if gcc static flag -static works... yes
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/x86_64-pc-msys/bin/ld.exe) supports shared libraries... yes
checking whether -lc should be explicitly linked in... yes
checking dynamic linker characteristics... Win32 ld.exe
checking how to hardcode library paths into programs... immediate
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
checking whether GCC or Clang is our compiler... gcc
checking for clang... no
checking gcc version... 9.3.0
checking for gawk... (cached) gawk
checking for gcc... (cached) gcc
checking whether we are using the GNU C compiler... (cached) yes
checking whether gcc accepts -g... (cached) yes
checking for gcc option to accept ISO C89... (cached) none needed
checking whether gcc understands -c and -o together... (cached) yes
checking dependency style of gcc... (cached) gcc3
checking how to run the C preprocessor... gcc -E
checking for ranlib... (cached) ranlib
checking whether ln -s works... no, using cp -pR
checking whether make sets $(MAKE)... (cached) yes
checking for grep that handles long lines and -e... (cached) /usr/bin/grep
checking for cygpath... /usr/bin/cygpath
checking for pkg-config... /usr/bin/pkg-config
checking for python3... /usr/bin/python3
checking for python-distutils... yes
checking for python-yaml... no
checking for wget... /usr/bin/wget
checking stddef.h usability... yes
checking stddef.h presence... yes
checking for stddef.h... yes
checking arpa/inet.h usability... yes
checking arpa/inet.h presence... yes
checking for arpa/inet.h... yes
checking assert.h usability... yes
checking assert.h presence... yes
checking for assert.h... yes
checking ctype.h usability... yes
checking ctype.h presence... yes
checking for ctype.h... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking for inttypes.h... (cached) yes
checking getopt.h usability... yes
checking getopt.h presence... yes
checking for getopt.h... yes
checking limits.h usability... yes
checking limits.h presence... yes
checking for limits.h... yes
checking netdb.h usability... yes
checking netdb.h presence... yes
checking for netdb.h... yes
checking netinet/in.h usability... yes
checking netinet/in.h presence... yes
checking for netinet/in.h... yes
checking poll.h usability... yes
checking poll.h presence... yes
checking for poll.h... yes
checking sched.h usability... yes
checking sched.h presence... yes
checking for sched.h... yes
checking signal.h usability... yes
checking signal.h presence... yes
checking for signal.h... yes
checking stdarg.h usability... yes
checking stdarg.h presence... yes
checking for stdarg.h... yes
checking for stdint.h... (cached) yes
checking stdio.h usability... yes
checking stdio.h presence... yes
checking for stdio.h... yes
checking for stdlib.h... (cached) yes
checking stdbool.h usability... yes
checking stdbool.h presence... yes
checking for stdbool.h... yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking sys/ioctl.h usability... yes
checking sys/ioctl.h presence... yes
checking for sys/ioctl.h... yes
checking syslog.h usability... yes
checking syslog.h presence... yes
checking for syslog.h... yes
checking sys/prctl.h usability... no
checking sys/prctl.h presence... no
checking for sys/prctl.h... no
checking sys/socket.h usability... yes
checking sys/socket.h presence... yes
checking for sys/socket.h... yes
checking for sys/stat.h... (cached) yes
checking sys/syscall.h usability... no
checking sys/syscall.h presence... no
checking for sys/syscall.h... no
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking time.h usability... yes
checking time.h presence... yes
checking for time.h... yes
checking for unistd.h... (cached) yes
checking sys/param.h usability... yes
checking sys/param.h presence... yes
checking for sys/param.h... yes
checking for sys/ioctl.h... (cached) yes
checking linux/if_ether.h usability... no
checking linux/if_ether.h presence... no
checking for linux/if_ether.h... no
checking linux/if_packet.h usability... no
checking linux/if_packet.h presence... no
checking for linux/if_packet.h... no
checking linux/filter.h usability... no
checking linux/filter.h presence... no
checking for linux/filter.h... no
checking linux/ethtool.h usability... no
checking linux/ethtool.h presence... no
checking for linux/ethtool.h... no
checking linux/sockios.h usability... no
checking linux/sockios.h presence... no
checking for linux/sockios.h... no
checking glob.h usability... yes
checking glob.h presence... yes
checking for glob.h... yes
checking locale.h usability... yes
checking locale.h presence... yes
checking for locale.h... yes
checking grp.h usability... yes
checking grp.h presence... yes
checking for grp.h... yes
checking pwd.h usability... yes
checking pwd.h presence... yes
checking for pwd.h... yes
checking dirent.h usability... yes
checking dirent.h presence... yes
checking for dirent.h... yes
checking fnmatch.h usability... yes
checking fnmatch.h presence... yes
checking for fnmatch.h... yes
checking sys/resource.h usability... yes
checking sys/resource.h presence... yes
checking for sys/resource.h... yes
checking for sys/types.h... (cached) yes
checking sys/un.h usability... yes
checking sys/un.h presence... yes
checking for sys/un.h... yes
checking sys/random.h usability... yes
checking sys/random.h presence... yes
checking for sys/random.h... yes
checking utime.h usability... yes
checking utime.h presence... yes
checking for utime.h... yes
checking libgen.h usability... yes
checking libgen.h presence... yes
checking for libgen.h... yes
checking mach/mach.h usability... no
checking mach/mach.h presence... no
checking for mach/mach.h... no
checking stdatomic.h usability... yes
checking stdatomic.h presence... yes
checking for stdatomic.h... yes
checking for sys/socket.h... (cached) yes
checking for net/if.h... yes
checking for sys/mman.h... yes
checking for linux/if_arp.h... no
checking for windows.h... yes
checking for winsock2.h... yes
checking for ws2tcpip.h... yes
checking for w32api/wtypes.h... yes
checking for w32api/winbase.h... yes
checking for wincrypt.h... yes
checking for inline... inline
checking for C/C++ restrict keyword... __restrict
checking for pid_t... yes
checking for mode_t... yes
checking for size_t... yes
checking for ssize_t... yes
checking for int8_t... yes
checking for int16_t... yes
checking for int32_t... yes
checking for int64_t... yes
checking for uint8_t... yes
checking for uint16_t... yes
checking for uint32_t... yes
checking for uint64_t... yes
checking for u_int... yes
checking for u_short... yes
checking for u_long... yes
checking for u_char... yes
checking whether struct tm is in sys/time.h or time.h... time.h
checking for struct tm.tm_zone... yes
checking for ptrdiff_t... yes
checking for stdbool.h that conforms to C99... (cached) yes
checking for _Bool... yes
checking for stdlib.h... (cached) yes
checking for GNU libc compatible malloc... yes
checking for stdlib.h... (cached) yes
checking for GNU libc compatible realloc... yes
checking vfork.h usability... no
checking vfork.h presence... no
checking for vfork.h... no
checking for fork... yes
checking for vfork... yes
checking for working fork... yes
checking for working vfork... (cached) yes
checking whether time.h and sys/time.h may both be included... yes
checking for sys/time.h... (cached) yes
checking for unistd.h... (cached) yes
checking for stdlib.h... (cached) yes
checking for sys/param.h... (cached) yes
checking for alarm... yes
checking for working mktime... yes
checking for getpagesize... yes
checking for working mmap... yes
checking for working strtod... yes
checking for memmem... yes
checking for memset... yes
checking for memchr... yes
checking for memrchr... yes
checking for memmove... yes
checking for strcasecmp... yes
checking for strchr... yes
checking for strrchr... yes
checking for strdup... yes
checking for strndup... yes
checking for strncasecmp... yes
checking for strtol... yes
checking for strtoul... yes
checking for strstr... yes
checking for strpbrk... yes
checking for strtoull... yes
checking for strtoumax... yes
checking for strerror... yes
checking for gethostname... yes
checking for inet_ntoa... yes
checking for uname... yes
checking for gettimeofday... yes
checking for clock_gettime... yes
checking for utime... yes
checking for strptime... yes
checking for tzset... yes
checking for localtime_r... yes
checking for socket... yes
checking for setenv... yes
checking for select... yes
checking for putenv... yes
checking for dup2... yes
checking for endgrent... yes
checking for endpwent... yes
checking for atexit... yes
checking for munmap... yes
checking whether getrandom is declared... yes
checking for strlcpy... yes
checking for strlcat... yes
checking for special C compiler options needed for large files... no
checking for _FILE_OFFSET_BITS value needed for large files... no
checking host os... installation for x86_64-pc-msys OS... ok
checking for c11 support... yes
checking for thread local storage gnu __thread support... yes
checking for g++... g++
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking dependency style of g++... gcc3
checking how to run the C++ preprocessor... g++ -E
checking for ld used by g++... /usr/x86_64-pc-msys/bin/ld.exe
checking if the linker (/usr/x86_64-pc-msys/bin/ld.exe) is GNU ld... yes
checking whether the g++ linker (/usr/x86_64-pc-msys/bin/ld.exe) supports shared libraries... yes
checking for g++ option to produce PIC... -DDLL_EXPORT -DPIC
checking if g++ PIC flag -DDLL_EXPORT -DPIC works... yes
checking if g++ static flag -static works... yes
checking if g++ supports -c -o file.o... yes
checking if g++ supports -c -o file.o... (cached) yes
checking whether the g++ linker (/usr/x86_64-pc-msys/bin/ld.exe) supports shared libraries... yes
checking dynamic linker characteristics... Win32 ld.exe
checking how to hardcode library paths into programs... immediate
checking for spatch... no
checking zlib.h usability... yes
checking zlib.h presence... yes
checking for zlib.h... yes
checking for inflate in -lz... yes
checking pcre.h usability... yes
checking pcre.h presence... yes
checking for pcre.h... yes
checking for pcre_get_substring in -lpcre... yes
checking for libpcre = 8.35... no
checking for pcre_dfa_exec in -lpcre... yes
checking for PCRE JIT support... yes
checking for PCRE JIT support usability... yes
checking for PCRE JIT EXEC support usability... no
checking for libhs... no
checking hs.h usability... no
checking hs.h presence... no
checking for hs.h... no
checking yaml.h usability... yes
checking yaml.h presence... yes
checking for yaml.h... yes
checking for yaml_parser_initialize in -lyaml... yes
checking for pthread_create in -lpthread... yes
checking for pthread_spin_unlock... yes
checking jansson.h usability... yes
checking jansson.h presence... yes
checking for jansson.h... yes
checking for json_dump_callback in -ljansson... yes
checking whether OS_WIN32 is declared... yes
checking for libnet.h version 1.1.x... no
checking for pcap.h... no
configure: error: pcap.h not found ...
12

(made edit for better formatting)

1 Like
13

Those folders exist and are populated?

–with-libpcap-includes=c:/msys64/npcap-sdk/Include --with-libpcap-libraries=c:/msys64/npcap-sdk/Lib/x64

14

Figured out my mistake.

15

Spoke to soon. Now configure is saying cbindgen too old or not found. I ran cargo install --force cbindgen multiple times but it doesn’t fix the error. It is installed.

16

The configure Gods are on my side now.

git clone --single-branch --branch master-5.0.x https://github.com/OISF/suricata.git && cd suricata && git clone https://github.com/OISF/libhtp.git -b 0.5.x && ./autogen.sh

./configure --with-libpcap-includes=/npcap-sdk/Include --with-libpcap-libraries=/npcap-sdk/Lib/x64 --with-libnss-libraries=/mingw64/lib/ --with-libnss-includes=/mingw64/include/nss3/ --with-libnspr-libraries=/mingw64/lib/ --with-libnspr-includes=/mingw64/include/nspr/ --enable-lua --disable-gccmarch-native

This works!

17

make error…
CC win32-service.o
CCLD suricata.exe
C:/msys64/mingw64/bin/…/lib/gcc/x86_64-w64-mingw32/10.1.0/…/…/…/…/x86_64-w64-mingw32/bin/ld.exe: …/libhtp/htp/.libs/libhtp.a(htp_multipart.o): in function strncat': C:/msys64/mingw64/x86_64-w64-mingw32/include/string.h:246: undefined reference to __strncat_chk’
collect2.exe: error: ld returned 1 exit status
make[2]: *** [Makefile:1634: suricata.exe] Error 1
make[2]: Leaving directory ‘/home/flash/suricata/src’
make[1]: *** [Makefile:498: all-recursive] Error 1
make[1]: Leaving directory ‘/home/flash/suricata’
make: *** [Makefile:424: all] Error 2

18

Can you try the same config/compile command but instead of

–disable-gccmarch-native

try without it?

19

Same issue. I thought I found the solution online by changing -D_FORTIFY_SOURCE=2 to 0, but no luck there either. Whatever the issue is, it seems to be a change made to mingw last year. Several projects have mentioned this on github. I will try again in a few weeks.

20

I gave you the wrong option - appologies.
what you should use is -
> --enable-gccprotect
Just add that to your config line - it should work that way. Can you try it out please?