[Snort-users] Installing Libpcap on RedHat 7.1

John Berkers berjo at ...827...
Sat Sep 1 06:10:09 EDT 2001


Becky, Peter,

The tar.gz file probably doesn't contain the .so* file because it is created
as a result of compiling it.  If you are interested in running the latest
version of libpcap, follow these steps:

extract the files to /usr/src/libpcap-0.6.2
in the resulting directory run ./configure
make
make install

configure will make sure the makefiles are right for your particular system,
make will compile the binaries and make install will put them in the right
place on your system.  I have done the same on redhat 7.0 and 7.1 as well as
Mandrake 7.2 without any problems.

regards,

John Berkers                                       ICQ: 112912
Network Services                            Hansen Corporation
john.berkers at ...3164...               berjo at ...827...




-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Beckster
Sent: Friday, 31 August 2001 4:37
To: Peter Bates
Cc: snort-users
Subject: Re: [Snort-users] Installing Libpcap on RedHat 7.1


Ah, for the record - I did try Peter's (and thanks to Paul also)
suggestion of using the rpm for Redhat (downloaded it from
rpmfind.net).  Current version is 0.4-39 and it works like a champ.

Sorry, but I'm not enough of a linux guru to figure out what was
missing/out-of-place in the others packages.

Thanks all,
Becky


Peter Bates wrote:
>
> Hello all...
>
> This might seem a silly question, but you have tried
> with the RH supplied rpm of libpcap, haven't you?
>
> I know Marty has reservations about how RH have spliced
> and diced with libpcap, but I've never had problems with the
> supplied one (my current snort box was dragged from RH 6.2
> to 7.1 without a hitch)... I've also built an rpm from the spec file
> that is supplied with the tcpdump.org version with no problems...
>
> In both cases (based on the spec-file) you end up with the actual
> library in /usr/lib and the includes in /usr/include/pcap... I've been
> using snort for some time now (recently moved from 1.7 to 1.8.1)
> and never encountered the problem of snort not finding these files
> other than it complaining about a 'non-standard libpcap installation'
> or something similar...
>
> --------------------------------------------------------------------------
------------------------------------------>
> Peter Bates, Systems Support Officer, Network Support Team.
> London School of Hygiene & Tropical Medicine.
> Telephone:0207-927 2124 / Fax: 0207-436 5389 / Pager: 07625 255362
>
> >>> Beckster <beckster at ...1127...> 30/08/01 17:10:57 >>>
> This sounds similar to my problem - see my email from yesterday,
> subject "[Snort-users] Libpcap library/headers not found..."
>
> Tried libpcap 0.6.2 from tcpdump.org site and also 0.4 from ee.lbl.gov
> site...
>
> -----Original Message-----
> From: snort-users-admin at lists.sourceforge.net
> [mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Beckster
> Sent: Wednesday, August 29, 2001 05:48 PM
> Cc: Snort Users
> Subject: [Snort-users] Libpcap library/headers not found...
>
> Howdy,
>
> Trying to install snort-1.8.1 on a linux 7.1 i386.  Have installed
> libpcap from tcpdump.org tarball and also tried libpcap from the
> ee.lbl.gov site.  Libpcap.a resides in /usr/local/lib/.  Tcpdump-3.6.2
> install also fails with this:
>
> tcpdump.o(.text_0x687): undefined reference to 'bpf_dump'
> /usr/local/lib/libpcap.a(pcap-linux.o): In function 'pcap_open_live':
> pcap-linux.o(.text_0x56f): undefined reference to 'atexit'
> collect2: ld returned 1 exit status
> make: *** [tcpdump] Error 1
>
> Error on snort ./configure is below.
>
> Any suggestions would be appreciated - I'm kinda stuck now.
>
> Regards,
> Becky
>
> ./configure:
> loading cache ./config.cache
> checking for a BSD compatible install... /usr/bin/install -c
> checking whether build environment is sane... yes
> checking whether make sets ${MAKE}... yes
> checking for working aclocal... missing
> checking for working autoconf... missing
> checking for working automake... missing
> checking for working autoheader... missing
> checking for working makeinfo... missing
> checking for gcc... gcc
> checking whether the C compiler (gcc  ) works... yes
> checking whether the C compiler (gcc  ) is a cross-compiler... no
> checking whether we are using GNU C... yes
> checking whether gcc accepts -g... no
> checking for gcc option to accept ANSI C... none needed
> checking for gcc... (cached) gcc
> checking whether the C compiler (gcc -O2 ) works... yes
> checking whether the C compiler (gcc -O2 ) is a cross-compiler... no
> checking whether we are using GNU C... (cached) yes
> checking whether gcc accepts -g... (cached) no
> checking host system type... i686-pc-linux-gnu
> checking whether byte ordering is bigendian... no
> checking how to run the C preprocessor... gcc -E
> checking for strings.h... yes
> checking for string.h... yes
> checking for stdlib.h... yes
> checking for unistd.h... yes
> checking for sys/sockio.h... no
> checking for paths.h... yes
> checking for inet_ntoa in -lnsl... yes
> checking for socket in -lsocket... no
> checking whether printf must be declared... no
> checking whether fprintf must be declared... no
> checking whether syslog must be declared... no
> checking whether puts must be declared... no
> checking whether fputs must be declared... no
> checking whether fputc must be declared... no
> checking whether fopen must be declared... no
> checking whether fclose must be declared... no
> checking whether fwrite must be declared... no
> checking whether fflush must be declared... no
> checking whether getopt must be declared... no
> checking whether bzero must be declared... no
> checking whether bcopy must be declared... no
> checking whether memset must be declared... no
> checking whether strtol must be declared... no
> checking whether strcasecmp must be declared... no
> checking whether strncasecmp must be declared... no
> checking whether strerror must be declared... no
> checking whether perror must be declared... no
> checking whether socket must be declared... no
> checking whether sendto must be declared... no
> checking whether vsnprintf must be declared... no
> checking whether snprintf must be declared... no
> checking whether strtoul must be declared... no
> checking for snprintf... yes
> checking for strlcpy... no
> checking for strlcat... no
> checking for strerror... yes
> checking for floor in -lm... yes
> checking for pcap_datalink in -lpcap... no
>
>    ERROR!  Libpcap library/headers not found, go get it from
>    ftp://ftp.ee.lbl.gov/libpcap.tar.Z
>    or use the --with-libpcap-* options, if you have it installed
>    in unusual place
>
> "T.Ferris" wrote:
> >
> > Ok,
> >
> > I was trying to install Snort 1.8.1 on my Redhat box, when doing so it
was
> > giving me the error message.
> >
> > ERROR!  Libpcap library/headers not found.  Now I have downloaded
Lippcap
> > from the .gov site.  I installed it from a src directory.  After that, I
go
> > back to the Snort install and I get the same error message?  What is the
> > correct way for install Libpcap?  Thank in advance.
> >
> > ======================
> > Original Guru
> > www.security-protocols.com
> > ======================
> >

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list