[Snort-users] Issues compiling chroot snort with daq

Martin Holste mcholste at ...11827...
Mon Jun 27 13:58:17 EDT 2011


Your problem is: ./conftest: error while loading shared libraries:
libpcap.so.1: cannot open shared object file: No such file or
directory

You need to make sure that libpcap.so.1 is under /opt/snort/lib.  This
can happen if you didn't do a "make shared install" when you built
libpcap.

On Mon, Jun 27, 2011 at 12:13 PM, Moses Hernandez
<moses at ...14297...> wrote:
> Just ran through my tests again and here is the relevant sections of the
> config.log file:
>
>  $ ./configure --prefix=/opt/snort
> --with-libpcap-includes=/opt/snort/include -
> -with-libpcap-libraries=/opt/snort/lib --disable-ipfw --disable-ipq
> --disable-nf
> q
>
> Finds pcap.h no problems:
>
> configure:11641: checking pcap.h usability
> configure:11641: gcc -c -g -O2 -fvisibility=hidden -Wall -Wwrite-strings
> -Wsign-
> compare -Wcast-align -Wextra -Wformat -Wformat-security
> -Wno-unused-parameter -f
> no-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
> -D_GNU_SOURCE  -
> I/opt/snort/include conftest.c >&5
> configure:11641: $? = 0
> configure:11641: result: yes
> configure:11641: checking pcap.h presence
> configure:11641: gcc -E  -I/opt/snort/include conftest.c
> configure:11641: $? = 0
> configure:11641: result: yes
> configure:11641: checking for pcap.h
> configure:11641: result: yes
>
> -----
>
> configure:11777: checking for pcap.h
> configure:11777: result: yes
> configure:11787: checking for pcap_lib_version
> configure:11789: checking for pcap_lib_version in -lpcap
> configure:11814: gcc -o conftest -g -O2 -fvisibility=hidden -Wall
> -Wwrite-string
> s -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security
> -Wno-unused-par
> ameter -fno-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
> -D_GNU_
> SOURCE  -I/opt/snort/include  -L/opt/snort/lib conftest.c -lpcap   >&5
> configure:11814: $? = 0
> configure:11823: result: yes
> configure:11838: checking for libpcap version >= "1.0.0"
> configure:11864: gcc -o conftest -g -O2 -fvisibility=hidden -Wall
> -Wwrite-string
> s -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security
> -Wno-unused-par
> ameter -fno-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
> -D_GNU_
> SOURCE  -I/opt/snort/include  -L/opt/snort/lib conftest.c -lpcap  >&5
> configure:11864: $? = 0
> configure:11864: ./conftest
> ./conftest: error while loading shared libraries: libpcap.so.1: cannot open
> shar
> ed object file: No such file or directory
> configure:11864: $? = 127
> configure: program exited with status 127
> configure: failed program was:
>
> Now i do an ls -la /opt/snort/lib and this is my output:
>
> -rw-r--r-- 1 root root 389K 2011-06-27 15:38 libpcap.a
> lrwxrwxrwx 1 root root   12 2011-06-27 15:38 libpcap.so -> libpcap.so.1
> lrwxrwxrwx 1 root root   16 2011-06-27 15:38 libpcap.so.1 ->
> libpcap.so.1.1.1
> -rwxr-xr-x 1 root root 250K 2011-06-27 15:38 libpcap.so.1.1.1
>
> I am not sure exactly what the issue is on this install. I have recompiled
> it without the prefixes on all the binaries and if it lands in its default
> locations it works...??
> On Fri, Jun 24, 2011 at 11:49 PM, Martin Holste <mcholste at ...11827...> wrote:
>>
>> You need to look in config.log to see what the last error was.  That
>> will tell you why it thinks >= 1.0.0 is not found.
>>
>> On Fri, Jun 24, 2011 at 2:41 PM, Moses Hernandez
>> <moses at ...14297...> wrote:
>> > I am working on building a few installation scripts to install snort in
>> > a
>> > chrooted environment. For whatever reason on an Ubuntu 10.04.2 server I
>> > am
>> > not able to get daq-0.5 to locate libpcap correctly. Here is a set of
>> > what
>> > i've done, just if anyone has any ideas to what is going on.
>> > to install libpcap 1.1.1
>> > ./configure --prefix=/opt/snort
>> > I have located that in /opt/snort/lib libpcap.* exists.
>> > For daq0-5:
>> > ./configure --prefix=/opt/snort
>> > --with-libpcap-includes=/opt/snort/include
>> > --with-libpcap-libraries=/opt/snort/lib
>> > It gives the dreaded:
>> > ERROR!  Libpcap library version >= 1.0.0  not found.
>> > Now I've looked around and found examples where people put:
>> > LD_LIBRARY_PATH=/opt/snort ./configure --prefix=/opt/snort
>> > --with-libpcap-includes=/opt/snort/include
>> > --with-libpcap-libraries=/opt/snort/lib
>> > I also noticed that at some point libpcap0.8 was installed. I did an
>> > apt-get
>> > remove of it. I am wondering if the configure script uses locate because
>> > the
>> > locate database still reflects the file exists (libpcap0.8 files) but
>> > they
>> > are not installed anymore. I have also run ldconfig several times, and
>> > run
>> > the configure scripts as root with no luck.
>> > Anyone experience the same thing?
>> >
>> > ------------------------------------------------------------------------------
>> > All the data continuously generated in your IT infrastructure contains a
>> > definitive record of customers, application performance, security
>> > threats, fraudulent activity and more. Splunk takes this data and makes
>> > sense of it. Business sense. IT sense. Common sense..
>> > http://p.sf.net/sfu/splunk-d2d-c1
>> > _______________________________________________
>> > Snort-users mailing list
>> > Snort-users at lists.sourceforge.net
>> > Go to this URL to change user options or unsubscribe:
>> > https://lists.sourceforge.net/lists/listinfo/snort-users
>> > Snort-users list archive:
>> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>> >
>> > Please see http://www.snort.org/docs for documentation
>> >
>
>




More information about the Snort-users mailing list