pcap: failed to load libpcap shared library

[ziluobu]

I don't know what this is what's going on? It's time to install libpcap.

[root@localhost bin]# yum install libpcap 上次元数据过期检查：0:20:25 前，执行于 2020年02月29日 星期六 06时26分15秒。 软件包 libpcap-14:1.9.0-3.el8.x86_64 已安装。 依赖关系解决。 无需任何处理。 完毕！ [root@localhost bin]# [root@localhost bin]# masscan -p80 192.168.1.1/16 pcap: failed to load libpcap shared library HINT: you must install libpcap or WinPcap FAIL: libpcap not loaded adapter[eno4].init: failed [root@localhost bin]#

[shang159]

yum install libpcap*

[shang159]

貌似是因为libpcap-devel这个没有安装的原因，我有同样的报错，安装之后修复

[sjoegren]

I observed the same problem on CentOS 8.3, with masscan 1.0.5 and libpcap 1.9.1. masscan tries to dynamically open libpcap with dlopen(), but none of the files it tries are installed on the system. I tried to build latest master branch on the same host, and the problem is the same:

# bin/masscan -vv -p22 127.0.0.1 
[-] pcap: failed to load: libpcap.so                
[-] pcap: failed to load: libpcap.A.dylib           
[-] pcap: failed to load: libpcap.dylib
[-] pcap: failed to load: libpcap.so.0.9.5                    
[-] pcap: failed to load: libpcap.so.0.9.4                  
[-] pcap: failed to load: libpcap.so.0.8
[-] FAIL: failed to load libpcap shared library                                                                                
    [hint]: you must install libpcap or WinPcap                                                                                
pcap: pcap_close: failed                                                                                                       
pcap: pcap_datalink: failed               
pcap: pcap_dispatch: failed
pcap: pcap_findalldevs: failed
pcap: pcap_freealldevs: failed
pcap: pcap_lib_version: failed
pcap: pcap_lookupdev: failed
pcap: pcap_major_version: failed             
pcap: pcap_minor_version: failed
pcap: pcap_open_live: failed
pcap: pcap_open_offline: failed   
pcap: pcap_sendpacket: failed                                                                                                  
pcap: pcap_next: failed                  
pcap: pcap_setdirection: failed              
pcap: pcap_datalink_val_to_name: failed
pcap: pcap_perror: failed      
pcap: pcap_geterr: failed                      
pcap: pcap_create: failed
pcap: pcap_set_snaplen: failed      
pcap: pcap_set_promisc: failed                                                                                                 
pcap: pcap_set_timeout: failed
pcap: pcap_set_immediate_mode: failed                      
pcap: pcap_set_buffer_size: failed                                                                                             
pcap: pcap_set_rfmon: failed                                                                                                   
pcap: pcap_can_set_rfmon: failed                                                                                               
pcap: pcap_activate: failed                                                                                                    
pfring: error: dlopen('libpfring.so'): No such file or directory      
[+] interface = ens192
[+] if(ens192): pcap: stub/0.0
[+] if(ens192): opening...                                                                                                     
FAIL:ens192: can't open adapter: libpcap not loaded
[-] if:ens192:init: failed 

I applied this patch and re-built masscan:

diff --git a/src/stub-pcap.c b/src/stub-pcap.c
index 1e06565..aceca48 100644
--- a/src/stub-pcap.c
+++ b/src/stub-pcap.c
@@ -374,6 +374,7 @@ if (pl->datalink == NULL) pl->func_err=1, pl->datalink = null_##PCAP_DATALINK;
             "libpcap.so.0.9.5",
             "libpcap.so.0.9.4",
             "libpcap.so.0.8",
+            "libpcap.so.1",
             0
         };
         unsigned i;

Now it finds the library:

# bin/masscan -vv -p22 127.0.0.1                                                                       
[-] pcap: failed to load: libpcap.so                                                                                           
[-] pcap: failed to load: libpcap.A.dylib                                                                                      
[-] pcap: failed to load: libpcap.dylib   
[-] pcap: failed to load: libpcap.so.0.9.5
[-] pcap: failed to load: libpcap.so.0.9.4
[-] pcap: failed to load: libpcap.so.0.8
[+] pcap: found library: libpcap.so.1
pfring: error: dlopen('libpfring.so'): No such file or directory
[+] interface = ens192                       
[+] if(ens192): pcap: libpcap version 1.9.1 (with TPACKET_V3)
[+] if(ens192): opening...  
[+] if(ens192): successfully opened
[+] interface-type = 1                                                                                                         
if:ens192: not receiving transmits       
if:ens192: type=ethernet(1)                  
[+] source-mac = 00-50-56-9b-5a-20     
[+] source-ip = 172.16.41.149  
[+] if(ens192): looking for default gateway    
[+] router-ip = 172.16.40.1
[+] if(ens192):arp: resolving IPv4 address
[+] arp: 172.16.40.1 == 74-83-c2-10-26-e1                                                                                      
[+] router-mac-ipv4 = 74-83-c2-10-26-e1
[+] if(ens192): initialization done.                       
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2021-04-22 09:50:08 GMT                                                      
Initiating SYN Stealth Scan                                                                                                    
Scanning 1 hosts [1 port/host]                                                                                                 
[+] starting receive thread #0                                                                                                 
[+] THREAD: recv: starting main loop                                                                                           
[+] starting transmit thread #0
[+] starting throttler: rate = 100.00-pps
[+] transmit thread #0 complete                                                                                                
[+] waiting for threads to finish                  
172.16.40.1    :    0: -> ARP [0] iting 5-secs, found=0        
[+] exiting receive thread #0                    ound=0       
[+] exiting transmit thread #0                    
[+] all threads have exited

A workaround is to create the libpcap.so symlink, to make masscan from CentOS repos to work:

cd /usr/lib64 ; ln -s libpcap.so.1 libpcap.so

It doesn't seem right that one has to install libpcap-devel on the target system to run the program, so I suggest this is fixed in the software. It would probably work even better to require the -devel packages for building and link against libpcap and other libs in buildtime, then packaging tools like RPM would find the necessary dependencies by themselves (e.g. CentOS'es masscan-1.0.5-2.el8.x86_64 package doesn't know that it depends on libpcap, since rpm cannot see it with ldd on the built binary).