Re: Issues compiling chroot snort with daq

[Martin Holste <mcholste () gmail com>]

Your problem is: ./conftest: error while loading shared libraries:
libpcap.so.1: cannot open shared object file: No such file or
directory

You need to make sure that libpcap.so.1 is under /opt/snort/lib.  This
can happen if you didn't do a "make shared install" when you built
libpcap.

On Mon, Jun 27, 2011 at 12:13 PM, Moses Hernandez
<moses () networksamurai org> wrote:
> Just ran through my tests again and here is the relevant sections of the
> config.log file:
>
>  $ ./configure --prefix=/opt/snort
> --with-libpcap-includes=/opt/snort/include -
> -with-libpcap-libraries=/opt/snort/lib --disable-ipfw --disable-ipq
> --disable-nf
> q
>
> Finds pcap.h no problems:
>
> configure:11641: checking pcap.h usability
> configure:11641: gcc -c -g -O2 -fvisibility=hidden -Wall -Wwrite-strings
> -Wsign-
> compare -Wcast-align -Wextra -Wformat -Wformat-security
> -Wno-unused-parameter -f
> no-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
> -D_GNU_SOURCE  -
> I/opt/snort/include conftest.c >&5
> configure:11641: $? = 0
> configure:11641: result: yes
> configure:11641: checking pcap.h presence
> configure:11641: gcc -E  -I/opt/snort/include conftest.c
> configure:11641: $? = 0
> configure:11641: result: yes
> configure:11641: checking for pcap.h
> configure:11641: result: yes
>
> -----
>
> configure:11777: checking for pcap.h
> configure:11777: result: yes
> configure:11787: checking for pcap_lib_version
> configure:11789: checking for pcap_lib_version in -lpcap
> configure:11814: gcc -o conftest -g -O2 -fvisibility=hidden -Wall
> -Wwrite-string
> s -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security
> -Wno-unused-par
> ameter -fno-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
> -D_GNU_
> SOURCE  -I/opt/snort/include  -L/opt/snort/lib conftest.c -lpcap   >&5
> configure:11814: $? = 0
> configure:11823: result: yes
> configure:11838: checking for libpcap version >= "1.0.0"
> configure:11864: gcc -o conftest -g -O2 -fvisibility=hidden -Wall
> -Wwrite-string
> s -Wsign-compare -Wcast-align -Wextra -Wformat -Wformat-security
> -Wno-unused-par
> ameter -fno-strict-aliasing -fdiagnostics-show-option -pedantic -std=c99
> -D_GNU_
> SOURCE  -I/opt/snort/include  -L/opt/snort/lib conftest.c -lpcap  >&5
> configure:11864: $? = 0
> configure:11864: ./conftest
> ./conftest: error while loading shared libraries: libpcap.so.1: cannot open
> shar
> ed object file: No such file or directory
> configure:11864: $? = 127
> configure: program exited with status 127
> configure: failed program was:
>
> Now i do an ls -la /opt/snort/lib and this is my output:
>
> -rw-r--r-- 1 root root 389K 2011-06-27 15:38 libpcap.a
> lrwxrwxrwx 1 root root   12 2011-06-27 15:38 libpcap.so -> libpcap.so.1
> lrwxrwxrwx 1 root root   16 2011-06-27 15:38 libpcap.so.1 ->
> libpcap.so.1.1.1
> -rwxr-xr-x 1 root root 250K 2011-06-27 15:38 libpcap.so.1.1.1
>
> I am not sure exactly what the issue is on this install. I have recompiled
> it without the prefixes on all the binaries and if it lands in its default
> locations it works...??
> On Fri, Jun 24, 2011 at 11:49 PM, Martin Holste <mcholste () gmail com> wrote:
> > You need to look in config.log to see what the last error was.  That
> > will tell you why it thinks >= 1.0.0 is not found.
> >
> > On Fri, Jun 24, 2011 at 2:41 PM, Moses Hernandez
> > <moses () networksamurai org> wrote:
> > > I am working on building a few installation scripts to install snort in
> > > a
> > > chrooted environment. For whatever reason on an Ubuntu 10.04.2 server I
> > > am
> > > not able to get daq-0.5 to locate libpcap correctly. Here is a set of
> > > what
> > > i've done, just if anyone has any ideas to what is going on.
> > > to install libpcap 1.1.1
> > > ./configure --prefix=/opt/snort
> > > I have located that in /opt/snort/lib libpcap.* exists.
> > > For daq0-5:
> > > ./configure --prefix=/opt/snort
> > > --with-libpcap-includes=/opt/snort/include
> > > --with-libpcap-libraries=/opt/snort/lib
> > > It gives the dreaded:
> > > ERROR!  Libpcap library version >= 1.0.0  not found.
> > > Now I've looked around and found examples where people put:
> > > LD_LIBRARY_PATH=/opt/snort ./configure --prefix=/opt/snort
> > > --with-libpcap-includes=/opt/snort/include
> > > --with-libpcap-libraries=/opt/snort/lib
> > > I also noticed that at some point libpcap0.8 was installed. I did an
> > > apt-get
> > > remove of it. I am wondering if the configure script uses locate because
> > > the
> > > locate database still reflects the file exists (libpcap0.8 files) but
> > > they
> > > are not installed anymore. I have also run ldconfig several times, and
> > > run
> > > the configure scripts as root with no luck.
> > > Anyone experience the same thing?
> > >
> > > ------------------------------------------------------------------------------
> > > All the data continuously generated in your IT infrastructure contains a
> > > definitive record of customers, application performance, security
> > > threats, fraudulent activity and more. Splunk takes this data and makes
> > > sense of it. Business sense. IT sense. Common sense..
> > > http://p.sf.net/sfu/splunk-d2d-c1
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >
> > > Please see http://www.snort.org/docs for documentation

------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please see http://www.snort.org/docs for documentation