[Snort-users] SNORT and LIBPCAP

Schmehl, Paul L pauls at ...6838...
Thu Nov 20 08:53:03 EST 2003


	From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Lambeth,
	Sent: Thursday, November 20, 2003 7:09 AM
	To: 'snort-users at lists.sourceforge.net'
	Subject: [Snort-users] SNORT and LIBPCAP
	>    ERROR!  Libpcap library/headers not found, go get it from
	>    http://www.tcpdump.org
	>    or use the --with-libpcap-* options, if you have it
	>    in unusual place
	I have been hunting for a fix for this to no avail. Can somebody
please tell why this is happening? Libpcap and Flex are both installed
and functioning properly. It sounds like SNORT is a poorly constructed
	Bad assumption.
	What do you mean when you say "hunting for a fix"?  You haven't
told us what OS you're using.  You haven't posted your configure
options.  That makes it really tough to provide an answer for you.
	Most *nix platforms will allow you to search for things using
either find(1L), locate(1) or slocate(1).  Your compiler is probably
looking for pcap.h, I would imagine.  Where is it located?
	What happens when you run ./configure --help?  Is there an
option that looks like this: "--with-libpcap=" ?  If there is, use
--with-pcap=/usr/include, if that's where pcap.h is.  (Hint: the error
message is telling you to use that option.)
	Finally, if you don't fully understand how to compile from
source, you might want to consider using the packaging system that your
OS offers (rpm, pkg, etc.) to install rather than trying to do it the
hard way.  Most packaging systems have already resolved all those issues
for you.
	Paul Schmehl (pauls at ...6838...)
	Adjunct Information Security Officer
	The University of Texas at Dallas
	AVIEN Founding Member
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20031120/4d11e0ac/attachment.html>

More information about the Snort-users mailing list