<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    Thank you, I will try testing with a different version.<br>
    <br>
    In the meantime, attached is the config.log with more details on
    it.  This looks to be a key point:<br>
    <br>
    configure:14441: result: yes<br>
    configure:14622: checking for pcap_datalink in -lpcap<br>
    configure:14647: gcc -o conftest -g -O2  -I/usr/local/lib/
    -I/usr/local/include -I/usr/local/include  -L/usr/local/lib
    -L/usr/local/lib -L/usr/local/lib conftest.c -lpcap  -lnsl -lm -lm 
    >&5<br>
    /usr/local/lib/libpcap.a(pcap.o): In function `pcap_breakloop':<br>
    (.text+0x744): undefined reference to `pfring_breakloop'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_read_packet':<br>
    (.text+0x2ac): undefined reference to `pfring_recv'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_stats_linux':<br>
    (.text+0xcc3): undefined reference to `pfring_stats'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_cleanup_linux':<br>
    (.text+0x11d0): undefined reference to `pfring_close'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_setfilter_linux_common':<br>
    (.text+0x1c67): undefined reference to
    `pfring_get_bound_device_ifindex'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x2c6b): undefined reference to `pfring_enable_ring'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x2c77): undefined reference to `pfring_get_selectable_fd'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x2d60): undefined reference to `pfring_open'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x2d92): undefined reference to `pfring_set_socket_mode'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x2e39): undefined reference to `pfring_set_poll_watermark'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x3505): undefined reference to `pfring_enable_rss_rehash'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x3975): undefined reference to `pfring_set_application_name'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x39ae): undefined reference to `pfring_set_cluster'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x417b): undefined reference to `pfring_set_cluster'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x433b): undefined reference to `pfring_set_cluster'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x44fe): undefined reference to `pfring_set_cluster'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_activate_linux':<br>
    (.text+0x4536): undefined reference to `pfring_set_cluster'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o):(.text+0x4553): more
    undefined references to `pfring_set_cluster' follow<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_get_pfring_id':<br>
    (.text+0x5203): undefined reference to `pfring_get_ring_id'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_set_watermark':<br>
    (.text+0x526b): undefined reference to `pfring_set_poll_watermark'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_setdirection_linux':<br>
    (.text+0x1ea9): undefined reference to `pfring_set_direction'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_setdirection_linux':<br>
    (.text+0x1eb8): undefined reference to `pfring_set_direction'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_inject_linux':<br>
    (.text+0x1f9b): undefined reference to `pfring_send'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_set_appl_name_linux':<br>
    (.text+0x513d): undefined reference to `pfring_set_application_name'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_set_cluster':<br>
    (.text+0x515f): undefined reference to `pfring_set_cluster'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_set_master_id':<br>
    (.text+0x5218): undefined reference to `pfring_set_master_id'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_set_master':<br>
    (.text+0x522f): undefined reference to `pfring_set_master'<br>
    /usr/local/lib/libpcap.a(pcap-linux.o): In function
    `pcap_set_application_name':<br>
    (.text+0x5248): undefined reference to `pfring_set_application_name'<br>
    collect2: error: ld returned 1 exit status<br>
    configure:14647: $? = 1<br>
    configure: failed program was:<br>
    | /* confdefs.h */<br>
    | #define PACKAGE_NAME ""<br>
    | #define PACKAGE_TARNAME ""<br>
    | #define PACKAGE_VERSION ""<br>
    | #define PACKAGE_STRING ""<br>
    | #define PACKAGE_BUGREPORT ""<br>
    | #define PACKAGE_URL ""<br>
    | #define PACKAGE "snort"<br>
    | #define VERSION "2.9.8.2"<br>
    | #define STDC_HEADERS 1<br>
    | #define HAVE_SYS_TYPES_H 1<br>
    | #define HAVE_SYS_STAT_H 1<br>
    | #define HAVE_STDLIB_H 1<br>
    | #define HAVE_STRING_H 1<br>
    | #define HAVE_MEMORY_H 1<br>
    | #define HAVE_STRINGS_H 1<br>
    | #define HAVE_INTTYPES_H 1<br>
    | #define HAVE_STDINT_H 1<br>
    | #define HAVE_UNISTD_H 1<br>
    | #define HAVE_DLFCN_H 1<br>
    | #define LT_OBJDIR ".libs/"<br>
    | #define LINUX 1<br>
    | #define HAVE__BOOL 1<br>
    | #define HAVE_STDBOOL_H 1<br>
    | #define HAVE_INTTYPES_H 1<br>
    | #define HAVE_MATH_H 1<br>
    | #define HAVE_PATHS_H 1<br>
    | #define HAVE_STDLIB_H 1<br>
    | #define HAVE_STRING_H 1<br>
    | #define HAVE_STRINGS_H 1<br>
    | #define HAVE_UNISTD_H 1<br>
    | #define HAVE_WCHAR_H 1<br>
    | #define HAVE_LIBM 1<br>
    | #define HAVE_LIBM 1<br>
    | #define HAVE_LIBNSL 1<br>
    | #define HAVE_SIGACTION 1<br>
    | #define HAVE_STRERROR 1<br>
    | #define HAVE_VSWPRINTF 1<br>
    | #define HAVE_WPRINTF 1<br>
    | #define HAVE_MEMRCHR 1<br>
    | #define HAVE_INET_NTOP 1<br>
    | #define HAVE_SNPRINTF /**/<br>
    | #define HAVE_MALLOC_TRIM 1<br>
    | #define HAVE_MALLINFO 1<br>
    | #define SIZEOF_CHAR 1<br>
    | #define SIZEOF_SHORT 2<br>
    | #define SIZEOF_INT 4<br>
    | #define SIZEOF_LONG_INT 8<br>
    | #define SIZEOF_LONG_LONG_INT 8<br>
    | #define SIZEOF_UNSIGNED_INT 4<br>
    | #define SIZEOF_UNSIGNED_LONG_INT 8<br>
    | #define SIZEOF_UNSIGNED_LONG_LONG_INT 8<br>
    | #define HAVE_U_INT8_T 1<br>
    | #define HAVE_U_INT16_T 1<br>
    | #define HAVE_U_INT32_T 1<br>
    | #define HAVE_U_INT64_T 1<br>
    | #define HAVE_UINT8_T 1<br>
    | #define HAVE_UINT16_T 1<br>
    | #define HAVE_UINT32_T 1<br>
    | #define HAVE_UINT64_T 1<br>
    | #define HAVE_INT8_T 1<br>
    | #define HAVE_INT16_T 1<br>
    | #define HAVE_INT32_T 1<br>
    | #define HAVE_INT64_T 1<br>
    | #define ERRLIST_PREDEFINED 1<br>
    | #define HAVE___FUNCTION__ 1<br>
    | /* end confdefs.h.  */<br>
    | <br>
    | /* Override any GCC internal prototype to avoid an error.<br>
    |    Use char because int might match the return type of a GCC<br>
    |    builtin and then its argument prototype would still apply.  */<br>
    | #ifdef __cplusplus<br>
    | extern "C"<br>
    | #endif<br>
    | char pcap_datalink ();<br>
    | int<br>
    | main ()<br>
    | {<br>
    | return pcap_datalink ();<br>
    |   ;<br>
    |   return 0;<br>
    | }<br>
    <br>
    <br>
    <br>
    <pre class="moz-signature" cols="72">
Regards,

Chris Chiaverini</pre>
    <div class="moz-cite-prefix">On 04/12/2016 09:54 AM, Balasubramaniam
      Natarajan wrote:<br>
    </div>
    <blockquote
cite="mid:CAFHFDA=Lr6Ya8To-JS36E6rgtddr54RsLvdNh0Hv0c2Kp5L13Q@...11828..."
      type="cite">
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
      <div dir="ltr">You could be having a problem with libdumbnet or
        the former libdnet.</div>
      <div class="gmail_extra"><br>
        <div class="gmail_quote">On Tue, Apr 12, 2016 at 2:26 AM, Chris
          Chiaverini <span dir="ltr"><<a moz-do-not-send="true"
              href="mailto:cchiaverini@...2968..." target="_blank">cchiaverini@...2968...</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000"> Hello,<br>
              <br>
              Has anyone compiled Snort w/ pfring on RHEL 7.x?  I am
              attempting on 7.2 and hitting an issue with libpcap
              linking.<br>
              <br>
              I used the NTOP PF_RING RPM with snort source and it
              appears to be a basic linking problem but I have specified
              them within the configure options:<br>
              <br>
              [root@...17491... snort-2.9.8.2]# rpm -ql
              pfring                                                                                                                                                                                               

              <br>
              /etc/init.d/cluster<br>
              /etc/init.d/pf_ring<br>
              /etc/init/pf_ring.conf<br>
              /etc/ld.so.conf.d/pf_ring.conf<br>
              /lib64/libanic.so<br>
              /lib64/libntapi.so<br>
              /lib64/libntos.so<br>
              /lib64/libsnf.so<br>
              /usr/local/bin/pfcount<br>
              /usr/local/bin/pfdnabounce<br>
              /usr/local/bin/pfdnacluster_master<br>
              /usr/local/bin/pfsend<br>
              /usr/local/bin/zbalance_ipc<br>
              /usr/local/bin/zcount<br>
              /usr/local/bin/zcount_ipc<br>
              /usr/local/bin/zsend<br>
              /usr/local/include/linux/pf_ring.h<br>
              /usr/local/include/pfring.h<br>
              /usr/local/include/pfring_zc.h<br>
              /usr/local/lib/daq/<a moz-do-not-send="true"
                href="http://daq_pfring.la" target="_blank">daq_pfring.la</a><br>
              /usr/local/lib/daq/daq_pfring.so<br>
              /usr/local/lib/daq/<a moz-do-not-send="true"
                href="http://daq_pfring_zc.la" target="_blank">daq_pfring_zc.la</a><br>
              /usr/local/lib/daq/daq_pfring_zc.so<br>
              <b>/usr/local/lib/libpcap.a</b><b><br>
              </b><b>/usr/local/lib/libpcap.so.1.6.2</b><br>
              /usr/local/lib/libpfring.a<br>
              /usr/local/lib/libpfring.so<br>
              /usr/local/lib/libsfbpf.so.0<br>
              /usr/local/lib/libsfbpf.so.0.0.1<br>
              /usr/local/pfring/README-DAQ.1st<br>
              /usr/local/pfring/README.FIRST<br>
              [root@...17491... snort-2.9.8.2]# ll /usr/local/lib/libpcap.*<br>
              <b>-rw-r--r--. 1 root root  479112 Apr  9 09:26
                /usr/local/lib/libpcap.a</b><b><br>
              </b><b>lrwxrwxrwx. 1 root root      16 Apr  4 14:25
                /usr/local/lib/libpcap.so.1 -> libpcap.so.1.6.2</b><b><br>
              </b><b>-rwxr-xr-x. 1 root root 1377998 Apr  9 09:26
                /usr/local/lib/libpcap.so.1.6.2</b><br>
              [root@...17491... snort-2.9.8.2]#<br>
              <br>
              <br>
              [root@...17491... snort-2.9.8.2]# cat ../configure_snort.sh <br>
              #!/bin/sh<br>
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/dell/srvadmin/bin:/opt/dell/srvadmin/sbin:/root/bin:/opt/daq/bin<br>
              LD_LIBRARY_PATH=/opt/daq/lib:<b>/usr/local/lib</b>:/lib64:/lib:/usr/lib64:/usr/lib:/usr/local/lib/daq<br>
              export PATH LD_LIBRARY_PATH<br>
              <br>
              ./configure --prefix=/opt/snort-2.9.8.2
              --with-dnet-includes=/usr/local/include
              --with-dnet-libraries=/usr/local/lib <b>--with-libpcap-includes=/usr/local/lib/

              </b><b>--with-libpcap-libraries=/usr/local/lib </b>--with-libpfring-includes=/usr/local/include/daq

              --with-libpfring-libraries=/usr/local/lib/daq
              --with-daq-libraries=/usr/local/lib
              --with-daq-includes=/usr/local/include \<br>
              --enable-sourcefire \<br>
              --enable-zlib \<br>
              --enable-perfprofiling \<br>
              --enable-gre \<br>
              --enable-mpls \<br>
              --enable-targetbased \<br>
              --enable-ppm \<br>
              --enable-perfprofiling \<br>
              --enable-active-response \<br>
              --enable-normalizer \<br>
              --enable-reload \<br>
              --enable-react \<br>
              --enable-flexresp3 \<br>
              --enable-linux-smp-stats \<br>
              --enable-large-pcap \<br>
              --enable-targetbased \<br>
              --enable-sourcefire<br>
              [root@...17491... snort-2.9.8.2]#<br>
              <br>
              <br>
              [root@...17491... snort-2.9.8.2]# sh ../configure_snort.sh <br>
              configure: WARNING: unrecognized options: --enable-zlib<br>
              checking for a BSD-compatible install... /usr/bin/install
              -c<br>
              checking whether build environment is sane... yes<br>
              checking for a thread-safe mkdir -p... /usr/bin/mkdir -p<br>
              checking for gawk... gawk<br>
              checking whether make sets $(MAKE)... yes<br>
              <br>
              <OMMITTED><br>
              <br>
              checking for INADDR_NONE... yes<br>
              checking for __FUNCTION__... yes<br>
              checking for pcap_datalink in -lpcap... no<br>
              checking pfring.h usability... yes<br>
              checking pfring.h presence... yes<br>
              checking for pfring.h... yes<br>
              checking for pfring_open in -lpfring... no<br>
              <b>checking for pfring_open in -lpcap... no</b><b><br>
              </b><b><br>
              </b><b>   ERROR!  Libpcap library/headers (libpcap.a (or
                .so)/pcap.h)</b><b><br>
              </b><b>   not found, go get it from <a
                  moz-do-not-send="true" href="http://www.tcpdump.org"
                  target="_blank"><a class="moz-txt-link-freetext" href="http://www.tcpdump.org">http://www.tcpdump.org</a></a></b><b><br>
              </b><b>   or use the --with-libpcap-* options, if you have
                it installed</b><b><br>
              </b><b>   in unusual place.  Also check if your libpcap
                depends on another</b><b><br>
              </b><b>   shared library that may be installed in an
                unusual place</b><br>
              [root@...17491... snort-2.9.8.2]# <br>
              <span class="HOEnZb"><font color="#888888"> <br>
                  <br>
                  <br>
                  <pre cols="72">-- 


Regards,

Chris Chiaverini</pre>
                </font></span></div>
            <br>
------------------------------------------------------------------------------<br>
            Find and fix application performance issues faster with
            Applications Manager<br>
            Applications Manager provides deep performance insights into
            multiple tiers of<br>
            your business applications. It resolves application problems
            quickly and<br>
            reduces your MTTR. Get your free trial!<br>
            <a moz-do-not-send="true"
              href="https://ad.doubleclick.net/ddm/clk/302982198;130105516;z"
              rel="noreferrer" target="_blank">https://ad.doubleclick.net/ddm/clk/302982198;130105516;z</a><br>
            _______________________________________________<br>
            Snort-users mailing list<br>
            <a moz-do-not-send="true"
              href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a><br>
            Go to this URL to change user options or unsubscribe:<br>
            <a moz-do-not-send="true"
              href="https://lists.sourceforge.net/lists/listinfo/snort-users"
              rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
            Snort-users list archive:<br>
            <a moz-do-not-send="true"
href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users"
              rel="noreferrer" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br>
            <br>
            Please visit <a moz-do-not-send="true"
              href="http://blog.snort.org" rel="noreferrer"
              target="_blank">http://blog.snort.org</a> to stay current
            on all the latest Snort news!<br>
          </blockquote>
        </div>
        <br>
        <br clear="all">
        <div><br>
        </div>
        -- <br>
        <div class="gmail_signature">
          <div dir="ltr">
            <div>
              <div dir="ltr">Regards,<br>
                Balasubramaniam Natarajan<br>
                <a moz-do-not-send="true"
                  href="http://blog.etutorshop.com" target="_blank">http://blog.etutorshop.com</a><br>
                <a moz-do-not-send="true"
                  href="https://www.youracclaim.com/user/balasubramaniam-natarajan"
                  target="_blank">https://www.youracclaim.com/user/balasubramaniam-natarajan</a><br>
              </div>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
  </body>
</html>