Packetbeat Windows 64-bit Crash

[andrewkroh]

With the new 64-bit Windows packaging, Packetbeat crashes.

• Version: packetbeat-5.0.0-nightlycbc59ee-windows-64
• Operating System: Windows 2012 r2
• Steps to Reproduce: Download 64-bit nightly and run it with the default config.
• Log: http://pastebin.com/raw/ei61G17S

My guess is that something in the build/linking stage needs updated.

[tsg]

Hmm, damn. Just a guess: we might be linking against the wrong winpcap version.

[andrewkroh]

So it looks like a 64-bit libwpcap.a is not included in the distribution.

PS C:\WpdPack\Lib> dir


    Directory: C:\WpdPack\Lib


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----         6/25/2010  11:10 AM            x64
-a---         6/25/2010  11:01 AM      20814 libpacket.a
-a---         6/25/2010  11:02 AM      54276 libwpcap.a
-a---         6/25/2010  10:47 AM       8450 Packet.lib
-a---         6/25/2010  10:47 AM      19320 wpcap.lib

PS C:\WpdPack\Lib> cd .\x64
PS C:\WpdPack\Lib\x64> dir


    Directory: C:\WpdPack\Lib\x64


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---         6/25/2010  10:49 AM       8290 Packet.lib
-a---         6/25/2010  10:49 AM      18892 wpcap.lib

So if I run gendef on the DLL.

PS C:\WpdPack\Lib\x64> gendef C:\Windows\System32\wpcap.dll
 * [C:\Windows\System32\wpcap.dll] Found PE+ image

Then run dlltool on the def.

PS C:\WpdPack\Lib\x64> dlltool --as-flags=--64 -m i386:x86-64 -k --output-lib libwpcap.a --input-def wpcap.def
PS C:\WpdPack\Lib\x64> dir


    Directory: C:\WpdPack\Lib\x64


Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---         3/29/2016   4:05 PM      65296 libwpcap.a
-a---         6/25/2010  10:49 AM       8290 Packet.lib
-a---         3/29/2016   4:05 PM       1635 wpcap.def
-a---         6/25/2010  10:49 AM      18892 wpcap.lib

Then build Packetbeat:

PS C:\Gopath\src\github.com\elastic\beats\packetbeat> go build

And then running it works. 😄

Reference: https://sourceforge.net/p/mingw-w64/discussion/723797/thread/530727b3/

[tsg]

@andrewkroh Nice! The question now is what would be a good way of getting this 64 bit enabled version in our docker images.

[andrewkroh]

@tsg I translated the steps above into an addition to the Dockerfile. See #1276

I had to download and install WinPcap from their EXE installer to get a copy of the 4.1.2 wpcap.dll. I couldn't think of a way to get the DLL from within the Dockerfile so I had to add it to the repo.

[tsg]

@andrewkroh Fantastic! I merged the PR. I'd say the DLL is small enough not to worry about it.