[Snort-users] Snort failed to install using Phil Woods' shared memory ring buffer libpcap

Alex Butcher, ISC/ISYS Alex.Butcher at ...11254...
Fri Jan 28 03:30:04 EST 2005

--On 21 December 2004 11:56 +0800 Steve Smith <steves at ...9824...> wrote:

> I am installing Snort 2.20 using the MMaped libpcap from Phil Woods
> web-site: http://public.lanl.gov/cpw/.
> The latest version of the MMAPed libpcap is: libpcap-1.0.20041001
> The Snort installation went well without any problem under Fedora Core 1.
> However, the same installation under Fedora core 2, I got the following
> error messages:
>  /usr/local/lib/libpcap.a(pcap-ring.o)(.text+0x4d4): In function
> `pcap_ring_recv':
> /usr/local/src/libpcap/pcap-ring.c:392: undefined reference to `mb'
> collect2: ld returned 1 exit status
> The Fedora core 2 kernel version is: Linux 2.6.9-1.6
> Any ideas or suggestions?

mb() is defined as a macro in /usr/include/asm/system.h on kernel 2.4-based 
FC1. This seems not to be the case with the glibc-kernheaders package 
included in FC3 (probably FC2, too, as both are kernel 2.6-based).

I've no idea if this'll work, but I'd try adding the following lines from 
FC1's system.h

#define mb()    __asm__ __volatile__ ("lock; addl $0,0(%%esp)": : :"memory")

(all on one line).

> Thanks.
> SS

Please report back on your success or failure, as I'm going to need to do 
something similar soon. ;-)

Best Regards,
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9

More information about the Snort-users mailing list