[Snort-users] Snort & OpenBSD 4.8 build problems

Ross Lawrie ross at ...15039...
Thu Nov 4 17:38:47 EDT 2010


I was hoping someone might be able to offer some advice.  I'm
encountered problems installing Snort on OpenBSD 4.8.  I have
installed an updated libpcap (1.1.1), libdnet (1.12) and DAQ (0.3)
without any obvious problems.  DAQ seems to install its libraries

ls -al /usr/local/lib/libdaq*
-rw-r--r--  1 root  wheel  40382 Nov  4 14:26 libdaq.a
-rwxr-xr-x  1 root  wheel    926 Nov  4 14:26 libdaq.la
-rwxr-xr-x  1 root  wheel  37400 Nov  4 14:26 libdaq.so.0.1
-rw-r--r--  1 root  wheel  41460 Nov  4 14:26 libdaq_static.a
-rwxr-xr-x  1 root  wheel    907 Nov  4 14:26 libdaq_static.la
-rw-r--r--  1 root  wheel  61164 Nov  4 14:27 libdaq_static_modules.a
-rwxr-xr-x  1 root  wheel    931 Nov  4 14:27 libdaq_static_modules.la

I'm able to run daq-modules-config and confirm that it is in my path:

daq-modules-config --static --libs
-L/usr/local/lib -ldaq_static_modules

ldconfig sees the libdaq library:

ldconfig -Rv /usr/local/lib 2>&1 | grep daq
Adding /usr/local/lib/libdaq.so.0.1

However when I try to configure Snort I receive this error:

checking for pcap_datalink in -lpcap... yes
checking for pcap_lex_destroy... no
checking for pcap_lib_version... yes
checking pcre.h usability... yes
checking pcre.h presence... yes
checking for pcre.h... yes
checking for pcre_compile in -lpcre... yes
checking for libpcre version 6.0 or greater... yes
checking dnet.h usability... yes
checking dnet.h presence... yes
checking for dnet.h... yes
checking for eth_set in -ldnet... yes
checking for dlsym in -ldl... no
checking for dlsym in -lc... yes
checking for daq_load_modules in -ldaq_static... no

   ERROR!  daq_static library not found, go get it from

The configure string I'm using for Snort is:

./configure \
--sysconfdir=/etc/snort \
--with-daq-includes=/usr/local/include \
--with-daq-libraries=/usr/local/lib \
--with-libpcap-includes=/usr/local/include \
--with-libpcap-libraries=/usr/local/lib \
--with-dnet-includes=/usr/local/include \

I've seen some suggestion that building DAQ without the ipfw module
could help, but I still encounter the same issue.

Appreciate any suggestions,


More information about the Snort-users mailing list