it's not the trailing slash ...<br>
<br>
<font face="Times New Roman" size="3"><span style="font-size: 12pt;">
dynamicpreprocessor directory</span></font><font size="2"><span style="font-size: 10pt;"> /opt/snort/2.6</span></font>/lib/snort_dynamicengine/<br>
                                                                                   
^^^^^^^^^^^^^^<br>

<br>

which should be changed to: <br>

<br>

dynamicpreprocessor directory<font size="2"><span style="font-size: 10pt;">
/opt/snort/2.6</span></font>/lib/snort<font size="2"><span style="font-size: 10pt;">_dynamicpreprocessor<br>
                                                                    
^^^^^^^^^^^^^^^^^^^^^^^^^^     <br>
</span></font><br>
<br><br><div><span class="gmail_quote">On 5/31/06, <b class="gmail_sendername">Jason Monroe</b> <<a href="mailto:monroe@...13796...">monroe@...13796...</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>









<div link="blue" vlink="blue" lang="EN-US">

<div>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Hi Justin,</span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">You just might be right, but I'm
curious to know presence or lack of a trailing slash in the snort.conf affects the
use "nm" when run against the shared library itself?</span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Thanks in advance,</span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">JC</span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>

<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>

<div style="border-style: none none none solid; border-color: -moz-use-text-color -moz-use-text-color -moz-use-text-color blue; border-width: medium medium medium 1.5pt; padding: 0in 0in 0in 4pt;">

<div>

<div style="text-align: center;" align="center"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">

<hr align="center" size="2" width="100%">

</span></font></div>

<p><b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma; font-weight: bold;">From:</span></font></b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;"> Justin Heath
[mailto:<a href="mailto:justin.heath@...11827..." target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">justin.heath@...11827...</a>] <br>
<b><span style="font-weight: bold;">Sent:</span></b> Wednesday, May 31, 2006 7:00
AM<br>
<b><span style="font-weight: bold;">To:</span></b> Jason Monroe<br>
<b><span style="font-weight: bold;">Cc:</span></b>
<a href="mailto:snort-users@lists.sourceforge.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">snort-users@lists.sourceforge.net</a><br>
<b><span style="font-weight: bold;">Subject:</span></b> Re: [Snort-users] (Compile)
undefined symbol: InitializePreprocessor</span></font></p>

</div>

<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>

<p style="margin-bottom: 12pt;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Looks like you have you
dynamic preprocessor directive set wrong in snort.conf<br>
<br>
im guessing you have something like:<br>
<br>
dynamicpreprocessor directory</span></font><font size="2"><span style="font-size: 10pt;"> /opt/snort/2.6</span></font>/lib/snort_dynamicengine/<br>
<br>
which should be changed to: <br>
<br>
dynamicpreprocessor directory<font size="2"><span style="font-size: 10pt;">
/opt/snort/2.6</span></font>/lib/snort<font size="2"><span style="font-size: 10pt;">_dynamicpreprocessor</span></font></p>

<div>

<p><span><font face="Times New Roman" size="3"><span style="font-size: 12pt;">On 5/30/06, <b><span style="font-weight: bold;">Jason
Monroe</span></b> <<a href="mailto:monroe@...13796..." target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> monroe@...13796...</a>>
wrote:</span></font></span></p>

<div>

<div>

<p style="margin-bottom: 12pt;"><font face="Times New Roman" size="2"><span style="font-size: 10pt;">Hi All,<br>
<br>
I've tried to compile snort 2.6RC2 on Fedora Core 5 as well as RHEL 4 AS which
are GCC 4.1.0 and 3.4.5-2 respectively. Both distros are producing the same
result.<br>
<br>
./configure --enable-dynamicplugin --prefix=/opt/snort/2.6  &&
make && make install<br>
Then with the paths modified in the snort.conf<br>
[root@...13833... snort-2.6.0RC2]# grep '/opt/snort' /etc/snort/snort.conf<br>
var RULE_PATH /opt/snort/rules<br>
dynamicpreprocessor directory /opt/snort/2.6/lib/snort_dynamicengine/<br>
dynamicengine /opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so<br>
<br>
<br>
running snort with -c option<br>
/opt/snort/2.6/bin/snort -c /etc/snort/snort.conf<br>
<br>
yeilds:<br>
+-----------------------[suppression]------------------------------------------<br>
| none<br>
-------------------------------------------------------------------------------<br>
Rule application order: ->activation->dynamic->pass->drop->alert->log<br>
Log directory = /var/log/snort<br>
Loading dynamic engine
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so... done<br>
Loading all dynamic preprocessor libs from
/opt/snort/2.6/lib/snort_dynamicengine/...<br>
  Loading dynamic preprocessor library
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so... ERROR: Failed to find
InitializePreprocessor() function in
/opt/snort/2.6/lib/snort_dynamicengine//libsf_engine.so:
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so: undefined symbol:
InitializePreprocessor <br>
Fatal Error, Quitting..<br>
<br>
<br>
Running nm<br>
nm /opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so | grep 'U '<br>
         U calloc@@GLIBC_2.0<br>
         U __ctype_b_loc@@GLIBC_2.3<br>
         U
__ctype_toupper_loc@@GLIBC_2.3<br>
         U fclose@@GLIBC_2.1<br>
         U fopen@@GLIBC_2.1<br>
         U fprintf@@GLIBC_2.0<br>
         U free@@GLIBC_2.0<br>
         U fwrite@@GLIBC_2.0<br>
         U malloc@@GLIBC_2.0<br>
         U memcmp@@GLIBC_2.0<br>
         U memcpy@@GLIBC_2.0<br>
         U pcre_compile<br>
         U pcre_exec<br>
         U pcre_study<br>
         U rand@@GLIBC_2.0<br>
         U snprintf@@GLIBC_2.0<br>
         U srand@@GLIBC_2.0<br>
         U strcmp@@GLIBC_2.0<br>
         U __strdup@@GLIBC_2.0<br>
         U strncpy@@GLIBC_2.0<br>
         U __strtol_internal@@GLIBC_2.0<br>
         U __strtoul_internal@@GLIBC_2.0<br>
         U time@@GLIBC_2.0<br>
<br>
I have RPMs pcre-4.5 and pcre-devel-4.5 installed on the system<br>
<br>
The only thing that I could find regarding symbol version was to make possibly
make use of --disable-symvers which would be given to the configure script,
however, I don't think that was the correct place.<br>
<br>
I have:<br>
/opt/snort/2.6/lib/snort_dynamicpreprocessor<br>
/opt/snort/2.6/lib/snort_dynamicengine<br>
both in /etc/ld.so.conf and re-ran /sbin/ldconfig<br>
<br>
Perhaps I'm missing something simple that one of you folks could be so kind as
to point out.<br>
<br>
Thanks in advance,<br>
<br>
JC</span></font></p>

</div>

</div>

</div>

<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>

</div>

</div>

</div>



</div></blockquote></div><br>