Re: Snort failed to install using Phil Woods' shared memory ring buffer libpcap

["Steve Smith" <steves () is-focus net>]

Thanks for your information.

I do have the info and definition for mb in
/lib/modules/`uname -r`/source/include/asm/system.h

The installation of pcap is not the problem, I was able to install 
libpcap-1.0.20041001 successfully in both FC2 and FC3.
Once the MMaped libpcap was installed, the installation of Snort 2.20 was 
not successful and returned the following errors as I indicated in the 
previous email:
/usr/local/lib/libpcap.a(pcap-ring.o)(.text+0x4d4): In function 
`pcap_ring_recv':
/usr/local/src/libpcap/pcap-ring.c:392: undefined reference to `mb'

SS

----- Original Message ----- 
From: "Phil Wood" <cpw () lanl gov>
To: "Steve Smith" <steves () is-focus net>
Cc: <snort-users () lists sourceforge net>
Sent: Thursday, December 30, 2004 5:05 AM
Subject: Re: Snort failed to install using Phil Woods' shared memory ring 
buffer libpcap


> On Wed, Dec 29, 2004 at 02:22:29PM +0800, Steve Smith wrote:
> > I posted the following message to the Snort user list and got no 
> > response.  As such, I would appreciate if you could point me in the right 
> > direction so that I could continue.
> >
> >
> > I am installing Snort 2.20  using the MMaped libpcap from Phil Woods 
> > web-site: http://public.lanl.gov/cpw/.
> > The latest version of the MMAPed libpcap is: libpcap-1.0.20041001
> >
> > The Snort installation went well without any problem under Fedora Core 1.
> >
> > However, the same installation under Fedora core 2, I got the following 
> > error messages:
> >
> >  /usr/local/lib/libpcap.a(pcap-ring.o)(.text+0x4d4): In function 
> > `pcap_ring_recv':
> > /usr/local/src/libpcap/pcap-ring.c:392: undefined reference to `mb'
>
> This is usually a sign that your /usr/include hierarchy does not have
> the same common headers as used in the kernel you are running.
> I normally use Debian.  However, I have a redhat system:
>
>  $ uname -r
>  2.6.9-1.715_FC3smp
>  $
>
> Unfortunately, the trick I use on Debian systems does not work on RedHat
> systems.  (The trick is discussed under build issues on my web page).
> Redhat has inserted some code in its compiler to check that the user does
> not use any of the headers supplied under the /lib/modules hierarchy.
>
> Fortunately for me the redhat release indicated above, the gcc version:
>  gcc version 3.4.2 20041017 (Red Hat 3.4.2-6.fc3)
> and possibly the /usr/include hierarchy (although the definition for mb
> cannot be found in it [at least by me]), resolve the mb() macro call in
> the pcap-ring.c file.
>
> The definition is in the /lib/modules hierachy.  I guess if you just make
> sure you have:
>
>  /lib/modules/`uname -r`/source/include/asm/system.h
>
> the libpcap make should work out.
>
> > collect2: ld returned 1 exit status
> >
> > The Fedora core 2 kernel version is: Linux 2.6.9-1.6
> >
> > Any ideas or suggestions?
>
>  $ grep "define mb" /lib/modules/`uname -r`/source/include/asm/system.h
>
> Once that works and return this line:
>
>  #define mb() alternative("lock; addl $0,0(%%esp)", "mfence", 
> X86_FEATURE_XMM2)
>
> you should be good to go.
>
> > Thanks.
> >
> >
> > SS
> --
> Phil Wood (cpw_at-sign_lanl.gov)




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users