[Snort-users] DAQ and libpcap 1.1.1 vs 1.0.0

vincent at ...15035... vincent at ...15035...
Sat Nov 6 05:30:59 EDT 2010

Hi Mike,

I've found that daq-0.2 or daq-0.3 compile fine with libpcap-1.1.1 on 
RHEL5.5. However, we are currently several users who have technical issues 
(segfaults) with snort 2.9.0x if you use libpcap-1.1.1. For that reason, I 
have decided to revert to 1.0.0 for my rpms. All of my rpms, including the 
source rpms are located at ttp://vscojot.free.fr/dist/snort/RHEL5.
Perhaps looking at the spec files would help you for building 
libpcap-1.1.1 with daq-0.3.



On Fri, 5 Nov 2010, Mike Lococo wrote:

> Hi Folks,
> It appears that DAQ is checking for libpcap exactly 1.0.0 instead of
> 1.0.0 or greater.
> After compiling libpcap-1.1.1 from source on 64-bit Centos 5.5,
> attempting to ./configure daq-0.3 fails with:
>        checking for libpcap version >= "1.0.0"... no
>        ERROR! Libpcap Library version >= 1.0.0 not found.
>        Get it from http://www.tcpdump.org
> There is an additional error in config.log (contrary to what this
> message indicates, there is a /usr/local/lib/libpcap.so.1 available):
>        ./conftest: error while loading shared libraries:
>        libpcap.so.1: cannot open shared object file: no such
>        file or directory
> If I make uninstall libpcap-1.1.1, then configure; make; make install
> libpcap-1.0.0, then daq-0.3 ./configure finds libpcap and all is well.
> Any advice as to what might be going on?
> Regards,
> Mike Lococo

More information about the Snort-users mailing list