[Snort-users] Issues compiling chroot snort with daq

Moses Hernandez moses at ...14297...
Mon Jun 27 13:13:11 EDT 2011


Just ran through my tests again and here is the relevant sections of the
config.log file:

 $ ./configure --prefix=/opt/snort
--with-libpcap-includes=/opt/snort/include -
-with-libpcap-libraries=/opt/snort/lib --disable-ipfw --disable-ipq
--disable-nf
q

Finds pcap.h no problems:

configure:11641: checking pcap.h usability
configure:11641: gcc -c -g -O2 -fvisibility=hidden -Wall -Wwrite-strings
-Wsign-
compare -Wcast-align -Wextra -Wformat -Wformat-security
-Wno-unused-parameter -f
no-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
-D_GNU_SOURCE  -
I/opt/snort/include conftest.c >&5
configure:11641: $? = 0
configure:11641: result: yes
configure:11641: checking pcap.h presence
configure:11641: gcc -E  -I/opt/snort/include conftest.c
configure:11641: $? = 0
configure:11641: result: yes
configure:11641: checking for pcap.h
configure:11641: result: yes

-----

configure:11777: checking for pcap.h
configure:11777: result: yes
configure:11787: checking for pcap_lib_version
configure:11789: checking for pcap_lib_version in -lpcap
configure:11814: gcc -o conftest -g -O2 -fvisibility=hidden -Wall
-Wwrite-string
s -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security
-Wno-unused-par
ameter -fno-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
-D_GNU_
SOURCE  -I/opt/snort/include  -L/opt/snort/lib conftest.c -lpcap   >&5
configure:11814: $? = 0
configure:11823: result: yes
configure:11838: checking for libpcap version >= "1.0.0"
configure:11864: gcc -o conftest -g -O2 -fvisibility=hidden -Wall
-Wwrite-string
s -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security
-Wno-unused-par
ameter -fno-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
-D_GNU_
SOURCE  -I/opt/snort/include  -L/opt/snort/lib conftest.c -lpcap  >&5
configure:11864: $? = 0
configure:11864: ./conftest
./conftest: error while loading shared libraries: libpcap.so.1: cannot open
shar
ed object file: No such file or directory
configure:11864: $? = 127
configure: program exited with status 127
configure: failed program was:

Now i do an ls -la /opt/snort/lib and this is my output:

-rw-r--r-- 1 root root 389K 2011-06-27 15:38 libpcap.a
lrwxrwxrwx 1 root root   12 2011-06-27 15:38 libpcap.so -> libpcap.so.1
lrwxrwxrwx 1 root root   16 2011-06-27 15:38 libpcap.so.1 ->
libpcap.so.1.1.1
-rwxr-xr-x 1 root root 250K 2011-06-27 15:38 libpcap.so.1.1.1

I am not sure exactly what the issue is on this install. I have recompiled
it without the prefixes on all the binaries and if it lands in its default
locations it works...??
On Fri, Jun 24, 2011 at 11:49 PM, Martin Holste <mcholste at ...11827...> wrote:

> You need to look in config.log to see what the last error was.  That
> will tell you why it thinks >= 1.0.0 is not found.
>
> On Fri, Jun 24, 2011 at 2:41 PM, Moses Hernandez
> <moses at ...14297...> wrote:
> > I am working on building a few installation scripts to install snort in a
> > chrooted environment. For whatever reason on an Ubuntu 10.04.2 server I
> am
> > not able to get daq-0.5 to locate libpcap correctly. Here is a set of
> what
> > i've done, just if anyone has any ideas to what is going on.
> > to install libpcap 1.1.1
> > ./configure --prefix=/opt/snort
> > I have located that in /opt/snort/lib libpcap.* exists.
> > For daq0-5:
> > ./configure --prefix=/opt/snort
> --with-libpcap-includes=/opt/snort/include
> > --with-libpcap-libraries=/opt/snort/lib
> > It gives the dreaded:
> > ERROR!  Libpcap library version >= 1.0.0  not found.
> > Now I've looked around and found examples where people put:
> > LD_LIBRARY_PATH=/opt/snort ./configure --prefix=/opt/snort
> > --with-libpcap-includes=/opt/snort/include
> > --with-libpcap-libraries=/opt/snort/lib
> > I also noticed that at some point libpcap0.8 was installed. I did an
> apt-get
> > remove of it. I am wondering if the configure script uses locate because
> the
> > locate database still reflects the file exists (libpcap0.8 files) but
> they
> > are not installed anymore. I have also run ldconfig several times, and
> run
> > the configure scripts as root with no luck.
> > Anyone experience the same thing?
> >
> ------------------------------------------------------------------------------
> > All the data continuously generated in your IT infrastructure contains a
> > definitive record of customers, application performance, security
> > threats, fraudulent activity and more. Splunk takes this data and makes
> > sense of it. Business sense. IT sense. Common sense..
> > http://p.sf.net/sfu/splunk-d2d-c1
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> > Please see http://www.snort.org/docs for documentation
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110627/1f837c7d/attachment.html>


More information about the Snort-users mailing list