Re: dropping packets - Missing libpcap.so.0.8.3.so

[hchlai () netscape net (Hugo)]

Thanks for everybody's help, but after I install Phil's libpcap with mmap functionality, I figure I do not have the 
libpcap.so.0.8.3.so file under /usr/local/lib. There are broken links of the following:
libpcap.so -> libpcap-0.8.3.so
libpcap.so.0 -> libpcap-0.8.3.so
libpcap.so.0.7 -> libpcap-0.8.3.so
libpcap.so.0.8 -> libpcap-0.8.3.so
I have included /usr/local/lib under my ld.so.config file, and then when I run ldconfig, missing links reduced to the 
following:
libpcap.so -> libpcap-0.8.3.so

what am I missing? Many thanks!

Hugo



Phil Wood <cpw () lanl gov> wrote:

> This is relevant to users running snort on linux:
>
> I've made a change to the max calculation.  Before, max was just the max
> based on a 2.4.<25 kernel for a payload snaplen of 1500 (standard ethernet).
> If you were running a tcpdump to just get the IP headers (-s68), then
> the max was still the same.  Now, the release labeled 20050129 will
> calculate how many frames of a given size will fit on the ring.  You 
> may need more RAM to use this feature.  Basically, the max requires
> that you have (over and above other requirements), 134217728 Mbytes
> (and then some of course) of available memory.  The ring itself uses
> 'size-131072' (see /proc/slabdata) for the ring of pointers.
>
> Please try the current libpcap release which can be found at:
>
>     http://public.lanl.gov/cpw
>    
> Read the items dated Jan 29 and Jan 19, 2005.
>
> On Fri, Jan 28, 2005 at 06:15:27PM +0000, Lawrence Reed wrote:
> > Hugo wrote:
> > > It seems like I'm on a high traffic volume network and will probably need 
> > > tp upgrade my libpcap to mmap, unfortunately, I haven't got much success. 
> > > I don't understand how to get Snort to use the new libpcap. Any pointers 
> > > would be appreciated.
> > > I wonder how the sourcefire products solve this problem?
> > >
> > > Hugo
> >
> > I assume you mean the libpcap from Phil Wood ( thanks Phil).
> > I build snort with the pcap libraries linked in statically as follows:
> >
> > LDFLAGS=-static ./configure 
> > --with-libpcap-libraries=/path/to/philwood/pcap 
> > --with-libpcap-includes=/path/to/philwood/pcap
> >
> > I also set the environment variable PCAP_FRAMES.
> > I use export PCAP_FRAMES=max in my snort startup script.
> >
> > Using unified logging, a full ruleset, the above referenced pcap on a 
> > dual 2.8Ghz Xeon I have < 0.005% drops with traffic in excess of 300Mbs.
> >
> > Larry
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> > Tool for open source databases. Create drag-&-drop reports. Save time
> > by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> > Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> -- 
> Phil Wood (cpw_at-sign_lanl.gov)

__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users