Open rapkin61 opened 3 days ago
When running ptcpdump, this messages appear:
2024-10-10 13:48:33 WARN load BTF specs from /var/lib/ptcpdump/btf/vmlinux failed: open /var/lib/ptcpdump/btf/vmlinux: no such file or directory 2024-10-10 13:48:33 WARN load BTF specs from /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712 failed: open /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712: no such file or directory 2024-10-10 13:48:33 WARN could not load BTF specs from local: open /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712: no such file or directory, try to load from remote 2024-10-10 13:48:34 ERROR btf/btf.go:85] load BTF specs from OpenAnolis failed: download BTF specs from https://mirrors.openanolis.cn/coolbpf/btf/aarch64/vmlinux-6.6.51+rpt-rpi-2712: status code is not 200: 404 2024-10-10 13:48:35 ERROR btf/btf.go:94] load BTF specs from BTFHub failed: download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404 2024-10-10 13:48:35 WARN load BTF specs from remote failed: download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404 2024-10-10 13:48:35 FATAL cmd/log.go:22] download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404
just try to run ptcpdump
Environment
./ptcpdump --version ptcpdump version 0.24.0 libpcap version 1.10.5 (with TPACKET_V3)
OS:
cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/"
Kernel:
uname -a Linux ns2 6.6.51+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.6.51-1+rpt1 (2024-09-26) aarch64 GNU/Linux
Additional context
@rapkin61 Thanks for reporting. To run ptcpdump on Raspberry Pi you need rebuild the kernel with /sys/kernel/btf/vmlinux enabled:
When running ptcpdump, this messages appear:
2024-10-10 13:48:33 WARN load BTF specs from /var/lib/ptcpdump/btf/vmlinux failed: open /var/lib/ptcpdump/btf/vmlinux: no such file or directory 2024-10-10 13:48:33 WARN load BTF specs from /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712 failed: open /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712: no such file or directory 2024-10-10 13:48:33 WARN could not load BTF specs from local: open /var/lib/ptcpdump/btf/vmlinux-6.6.51+rpt-rpi-2712: no such file or directory, try to load from remote 2024-10-10 13:48:34 ERROR btf/btf.go:85] load BTF specs from OpenAnolis failed: download BTF specs from https://mirrors.openanolis.cn/coolbpf/btf/aarch64/vmlinux-6.6.51+rpt-rpi-2712: status code is not 200: 404 2024-10-10 13:48:35 ERROR btf/btf.go:94] load BTF specs from BTFHub failed: download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404 2024-10-10 13:48:35 WARN load BTF specs from remote failed: download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404 2024-10-10 13:48:35 FATAL cmd/log.go:22] download BTF specs from https://github.com/aquasecurity/btfhub-archive/raw/main/debian/"12"/arm64/6.6.51+rpt-rpi-2712.btf.tar.xz: status code is not 200: 404
just try to run ptcpdump
just try to run ptcpdump
Environment
./ptcpdump --version ptcpdump version 0.24.0 libpcap version 1.10.5 (with TPACKET_V3)
OS:
cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/"
Kernel:
uname -a Linux ns2 6.6.51+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.6.51-1+rpt1 (2024-09-26) aarch64 GNU/Linux
Additional context