aol/moloch — pull request #136 by jpvlsmv (2013-09-18 13:38:24+00:00)
Title: Pfring autodetection

A much-simplified pcap+pfring detection patch.

Basically, in the "old days" (v0.9.0) if your libpcap.a isn't complete-- i.e. it requires libpfring.a to function, you either had to add the path to libpfring.a to capture/Makefile manually, or otherwise hack around it.

Andy introduced the --with-pfring option to configure, and this patch cleans it up a bit, and more or less makes the --with-pfring= option unneeded except in very strange circumstances(1)

configure will try to link a sample executable (calling `pcap_open_offline`) against the libpcap.a found by the --with-libpcap=/path/ option, and if it does not result in a successful link, try again with adding $withval/libpfring.a.

So if linking with any of these combinations of libraries works, moloch-capture will be built using that combination:
```
$with_libpcap/{,lib/}libpcap.a
$with_libpcap/{,lib/}libpcap.a + $with_libpcap/{,lib/}libpfring.a
$with_libpcap/{,lib/}libpcap.a + $with_pfring/{,lib/,userland/lib}/libpfring.a
```
Note that if --with-libpcap= is not given, the default search for libpcap will often result in a dynamically linked -lpcap. And in that case, the runtime linker should find and load the libpfring.so dependencies.

--Joe
(1) Strange circumstances = where the pfring userland libraries have been separated and libpfring.a is not in the same directory as the pfring-aware libpcap.a