Re: Re: snort 1.9.1 with redhat 8.0 and libnet 1.0.2.a

[Jeff Nathan <jeff () snort org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Jason,

Due to a large contingent of users attempting to compile Snort with 
flexresp with an incorrect version of libnet (HINT: the documentation 
specifies that ONLY libnet-1.0.2a is compatible with Snort) configure.in 
was changed to be very picky when a user supplies the --enable-flexresp 
configure option.  It's not broken, it's actually very resilient.  The 
reason Snort accepts --with-libpcap-libraries=/usr is that your linux 
system has a cache of shared objects.  When Snort is compiled it resolves 
symbols within shared objects using the cache and actually disregards the 
- --with-libpcap-libraries configure option.  To properly specify where your 
libpcap library is you would instead use --with-libpcap-libraries=/usr/lib.

As I've mentioned in the archives of this list very recently, many 
operating systems ship a broken version of libnet-config.  To compensate 
for this, Snort will automatically attempt to find libnet.  However, if you 
still wish to tell Snort where to find libnet libraries and includes, the 
proper way to do so is to specify the include and lib directory and not 
just /usr: --with-libnet-includes=/usr/include and 
- --with-libnet-libraries=/usr/lib.

- -Jeff

- --On Saturday, March 08, 2003 18:52:22 -0500 Jason Romo 
<jromo () networkguardian net> wrote:

> Okay I figured this out.
>
> if you compile with these options if will fail:
>
> ./configure --with-mysql=/usr --with-openssl=/usr --enable-flexresp
> --with-libpcap-libraries=/usr --with-libpcap-includes=/usr
>
> If I dropped some options off it worked:
>
> ./configure --enable-flexresp --with-mysql=/usr && make && make install
>
> I didn't change anything used the same Libnet 1.0.2a that was installed.
> NOTE:  I was upgrading from Snort 1.9.0 on Red Hat 8 to snort 1.9.1.  I
> haven't had time to look at the configure script to see where it is
> broken.
>
> Jason
>
> On Wed, 2003-03-05 at 03:34, Jason Romo wrote:
>
> Snorters,
>  I have been running snort 1.9.0 fine.  I tried to upgrade a redhat 8.0
> system to snort 1.9.1 and I get the error:
> configure: warning: libnet-config --cflags is broken on your system.  If
> you  configure: warning: are using a *BSD port please notify the port
> maintainer.  configure: warning: libnet-config --libs is broken on your
> system.  If you  configure: warning: are using a *BSD port please notify
> the port maintainer.  checking for libnet.h... no
>
>    ERROR!  Libnet header not found, go get it from
>     http://www.packetfactory.net/projects/libnet/
>     or use the --with-libnet-* options, if you have it installed
>     in unusual place
>
> Here are the options I am using to compile:
>
> ./configure --with-mysql=/usr --with-openssl=/usr --enable-flexresp
> --with-libpcap-libraries=/usr --with-libpcap-includes=/usr
> I have reloaded the libnet 1.0.2a in an attempt to ensure the libnet
> 1.0.2a is working.  I have tried to add the --with-libnet-* options.  I
> have tested libnet and it works fine with other tools.  Is this a redhat
> issue?
>
> Anyone else try snort 1.9.1 on redhat 8.0 with libnet 1.0.2a and flexresp
> option on?
> Thanks in advance,
>
> Jason
>
>
>
> --
> Jason Romo, Sr Security Consultant
> Network Guardian Corporation
> 1-866-NGC-2SEC (649-2732) Office
> 214-764-3864 Direct (Dallas)
> 678-935-9694 Direct (Atlanta)
> 214-929-7858 Mobile
> jromo () networkguardian net
> http://www.networkguardian.net


- --
http://www.snort.org/~jeff       (pgp key available)
"Perhaps the greatest responsibility in promoting peace is that of
protecting it."
- - Me
    
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE+bj65Eqr8+Gkj0/0RAuBXAKCxacb5DoVJh0DGfbZcoOr8ooi5xwCguokB
kvN0qRtwxUiJ6H82ArnSMP8=
=jAdg
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users