[Snort-users] Libnet v1.1 vs libnet v1.0.2a

TPanaitescu at ...2032... TPanaitescu at ...2032...
Tue Nov 22 13:59:09 EST 2005

Thanks. I actually thought of it, you can also pass the info to the
configure, --with-libnet... but I hoped that I can minimize the clutter on
the server(s) by using just one of them ;-).

Are there any plans to support the newer libnet versions ? It seems that on
the packetfactory site 1.0.2 is deprecated/not supported anymore.


             Dirk Geschke                                                  
             <dirk at ...13642...                                             
             ine.de>                                                    To 
                                       TPanaitescu at ...2032...            
             11/22/05 04:40 PM                                          cc 
                                       snort-users at lists.sourceforge.net   
                                       Re: [Snort-users] Libnet v1.1 vs    
                                       libnet v1.0.2a                      

Hi Tudor,

> Is it any way around the limitation for libnet v1.0.2a in building snort
> 2.4.3 with flexresp ? The reason I am asking is that I am running in a
> strange situation when I need syslog-ng with spoof capabilities which
> requires libnet >= v1.1 but, on the same machine, snort requires libnet
> v1.0.2a.

the problem is that the API of libnet changed completely between 1.0.2
ans 1.1 (and even with the 1.1-series are some incompatibilities).

But you can use both libraries separately, simple let the CPPFLAGS
point to the old 1.0.2a headers like

CPPFLAGS=-I/usr/local/libnet-1.0.2a/include ./configure ...

This should work well until the "make call" tries to link snort.
Simply copy this line and replace -lnet with the complete path
to libnet.a and link it statically. (You can also use dynamic
linking but then you have to compile int the library search path
to avoid linking against the newer library. This is a little bit
more complicated and will not have any advantages at all...)

Best regards


More information about the Snort-users mailing list