[Snort-users] Building standard DAQ on Ubuntu 12 LTS

Olaf Schreck chakl at ...931...
Tue Jun 12 17:23:45 EDT 2012

> I've built a PF_RING-enabled libpcap, which is in /usr/local/lib.

BTW: which version and where from?

> checking for pcap_lib_version... checking for pcap_lib_version in
> - -lpcap... (cached) no
>     ERROR!  Libpcap library version >= 1.0.0 not found.
>     Get it from http://www.tcpdump.org

GNU autoconf.

Check your config.log around this string "checking for pcap_lib_version". 
You will see a small test program that links against your libpcap, calls 
a *version() API routine, and fails because your version (0.8?) < 1.0.0.
This will produce the above error message.

I had similar problems building on OpenBSD, which ships libpcap-0.9.x 
by default.

Easiest way out: install Ubuntu provided libpcap v1.1.1 and pass the 
version checking.  If you're on Linux and willing to run a stock libpcap..

Joel: it would be great if you could check with the devs why "configure" 
for DAQ (and snort I think) insists on libpcap >= 1.0.0  This complicates 
building on non-Linux or non-standard systems.  Thanks


More information about the Snort-users mailing list