[Snort-users] DAQ and libpcap 1.1.1 vs 1.0.0

Mike Lococo mikelococo at ...11827...
Mon Nov 8 10:37:44 EST 2010


Vincent,

> I've found that daq-0.2 or daq-0.3 compile fine with libpcap-1.1.1 on
> RHEL5.5. However, we are currently several users who have technical
> issues (segfaults) with snort 2.9.0x if you use libpcap-1.1.1. For that
> reason, I have decided to revert to 1.0.0 for my rpms. All of my rpms,
> including the source rpms are located at
> ttp://vscojot.free.fr/dist/snort/RHEL5.
> Perhaps looking at the spec files would help you for building
> libpcap-1.1.1 with daq-0.3.

Thanks the the pointer, I had actually looked at your repo but in a fit
of absent-mindedness didn't think to check for srpms (I need to rebuild
libpcap with DAG-support enabled, so most binary RPMS don't help me).
I'll have a peak.

Some subsequent testing suggests maybe there's just some library
search-path issues going on, but I haven't figured out what
libpcap-1.0.0 vs 1.1.1 do differently in that regard.  Will report back
once I've got it sorted, I had just hoped someone else had done the work
for me.

Cheers,
Mike Lococo




More information about the Snort-users mailing list