[Snort-devel] Pfring-enabled pcap

Jason Wallace jason.wallace at ...2924...
Tue Feb 6 11:30:45 EST 2007


Recently I posted a problem on the snort-user list where configure was
failing for a pfring-enabled libpcap with...

checking for pcap_datalink in -lpcap... no

   ERROR!  Libpcap library/headers not found, go get it from
   http://www.tcpdump.org
   or use the --with-libpcap-* options, if you have it installed
   in unusual place

My libpcap was dynamically installed in /usr/local/lib but it was not being
detected even when using the --with-libpcap-libraries= option. It was
suggested that I might not have flex and bison installed. I did have those
installed so that wasn't the problem. After doing some digging, I found the
problem.

The problem exists if using a pfring-enabled libpcap that is installed
dynamically. If this is the case, the AC_CHECK_LIB(pcap, pcap_datalink,,
LPCAP="no") will fail its test with undefined references related to
functions from the libpfring library...


More information about the Snort-devel mailing list