[Snort-users] Cannot execute binary file

SnortFan SnortFan at ...131...
Wed Sep 4 15:36:28 EDT 2013


James,  
     That got me pointed in the right place. It turns out that the tar I was using was not the original one from source fire. The previous admin had re-tarred the files from a previous install on a 64bit server into a .tar.gz with the same name. So when it was uncompressed it already had a snort file that was compiled on a 64 bit server. I managed to find a unmodified .tar.gz on another sensor and I'm now able to create a 32 bit version. Argh!!!!!

Thanks so much for your help!

Sent from a mobile device. 
On Sep 4, 2013, at 3:14 PM, SnortFan <SnortFan at ...131...> wrote:

> Hi James,
> 
> I did the configure that Joe recommended and here's what I got:
> 
> snort: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, not stripped
> 
> 
> Thanks,
> Ed
> 
> Sent from a mobile device. 
> 
> On Sep 4, 2013, at 12:54 PM, James Lay <jlay at ...13475...> wrote:
> 
>> On 2013-09-04 10:48, Joel Esler wrote:
>>> On Sep 4, 2013, at 12:13 PM, SnortFan <SnortFan at ...131... [1]> wrote:
>>> 
>>>> I'm not passing any configure options. On the snort site it has the
>>>> latest version for download. Is there a repository of older
>>>> versions? I don't want to jump to the latest until I am ready to
>>>> move all my sensors to the latest at once.
>>>> 
>>>> Here's my install:
>>>> 
>>>> tar xzvf snort-2.9.4.5.tar.gz
>>>> cd snort-2.9.4.5
>>>> ./configure
>>> 
>>> Make this line “./configure —enable-sourcefire"
>>> 
>>>> make
>>>> make install
>>>> 
>>>> I'm also installing prior to the snort install:
>>>> yum install -y gcc gcc-c++ flex bison zlib zlib-devel libpcap
>>>> libpcap-devel pcre pcre-devel tcpdump ncsd libtool mysql mysql-devel
>>>> 
>>>> libdnet-1.11
>>>> daq-2.0.0
>>>> 
>>>> The script I'm using is a prior employee's script. I probably don't
>>>> need to the mysql and mysql-devel
>>> 
>>> You’ll need it if you want to log to a db.
>>> 
>>> --
>>> JOEL ESLER
>>> Senior Research Engineer, VRT
>>> OpenSource Community Manager
>>> Sourcefire
>> 
>> 
>> Sounds like you've got the tarball so that should work.  Do your config 
>> and make, and before you make install do a:
>> 
>> cd src
>> file snort
>> 
>> What's the output of that?
>> 
>> James
>> 
>> ------------------------------------------------------------------------------
>> Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
>> Discover the easy way to master current and previous Microsoft technologies
>> and advance your career. Get an incredible 1,500+ hours of step-by-step
>> tutorial videos with LearnDevNow. Subscribe today and save!
>> http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>> 
>> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> 
> ------------------------------------------------------------------------------
> Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more!
> Discover the easy way to master current and previous Microsoft technologies
> and advance your career. Get an incredible 1,500+ hours of step-by-step
> tutorial videos with LearnDevNow. Subscribe today and save!
> http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!




More information about the Snort-users mailing list