mozillazg / ptcpdump

Process-aware, eBPF-based tcpdump
MIT License
501 stars 39 forks source link

warnings and error messages when running ptcpdump #161

Open rapkin61 opened 3 days ago

rapkin61 commented 3 days ago

When running ptcpdump, this messages appear:

2024-10-10 13:48:33 WARN load BTF specs from /var/lib/ptcpdump/btf/vmlinux failed: open /var/lib/ptcpdump/btf/vmlinux: no such file or directory 2024-10-10 13:48:33 WARN load BTF specs from /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712 failed: open /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712: no such file or directory 2024-10-10 13:48:33 WARN could not load BTF specs from local: open /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712: no such file or directory, try to load from remote 2024-10-10 13:48:34 ERROR btf/btf.go:85] load BTF specs from OpenAnolis failed: download BTF specs from https://mirrors.openanolis.cn/coolbpf/btf/aarch64/vmlinux-6.6.51+rpt-rpi-2712: status code is not 200: 404 2024-10-10 13:48:35 ERROR btf/btf.go:94] load BTF specs from BTFHub failed: download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404 2024-10-10 13:48:35 WARN load BTF specs from remote failed: download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404 2024-10-10 13:48:35 FATAL cmd/log.go:22] download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404

just try to run ptcpdump

just try to run ptcpdump

Environment

./ptcpdump --version ptcpdump version 0.24.0 libpcap version 1.10.5 (with TPACKET_V3)

Additional context

mozillazg commented 2 days ago

@rapkin61 Thanks for reporting. To run ptcpdump on Raspberry Pi you need rebuild the kernel with /sys/kernel/btf/vmlinux enabled: