Re: problem with snort configure script and libpcap

[James Lay <digitalx00 () gmail com>]

On Oct 2, 2013, at 2:09 PM, "Youngquist, Jason R." <jryoungquist () ccis edu> wrote:

> Hey all,
>  
> I'm running on a band new RHEL 6.4 x64 system.  Trying to get snort 2.9.5.5 installed by following the instructions 
> found here:
> http://felipeferreira.net/?p=1033
>  
> I currently have “libpcap-1.0.0-6.20091201git117cb5.el6.x86_64” installed via yum.  Will this version work, or does 
> it have to be libpcap-1.1.1?  Tried making libpcap-1.1.1 and got the following error message, so I’m hoping 1.0.0 can 
> work.
>  
> [root@ccids01 libpcap-1.1.1]# make
> VER=`cat ./VERSION`; \
>         MAJOR_VER=`sed 's/\([0-9][0-9]*\)\..*/\1/' ./VERSION`; \
>         gcc -shared -Wl,-soname,libpcap.so.$MAJOR_VER  \
>             -o libpcap.so.$VER pcap-linux.o pcap-usb-linux.o pcap-can-linux.o fad-getad.o pcap.o inet.o gencode.o 
> optimize.o nametoaddr.o etherent.o savefile.o sf-pcap.o sf-pcap-ng.o pcap-common.o bpf_image.o bpf_dump.o  scanner.o 
> grammar.o bpf_filter.o version.o
> pcap-linux.o: could not read symbols: File in wrong format
> collect2: ld returned 1 exit status
> make: *** [libpcap.so] Error 1
>  
>  
> I get to the Snort "./configure line" mentioned in the article and get the following:
>  
> checking for pfring_open in -lpfring... no
> checking for pfring_open in -lpcap... no
>  
>    ERROR!  Libpcap library/headers (libpcap.a (or .so)/pcap.h)
>    not found, go get it from http://www.tcpdump.org
>    or use the --with-libpcap-* options, if you have it installed
>    in unusual place.  Also check if your libpcap depends on another
>    shared library that may be installed in an unusual place
> [root@ccids01 snort-2.9.5.5]#
>  
> Tried compling with the flags it mentioned in the ERROR message above and get the same error.
>  
> [root@ccids01 snort-2.9.5.5]# ./configure --with-musql-libraries=/usr/lib64/mysql -enable-dynamicplugin 
> --with-libpcap-libraries=/usr/lib --with-daq-libraries=/usr/local/daq -enable-zlib -enable-gre -enable-mpls 
> -enable-targetbased -enable-decorder-preprocessor-rules -enable-ppm -enable-perfprofiling 
> --with-libpcap-includes=/usr/lib --with-libpcap-libraries=/usr/lib
>  
> Tried using /usr/lib64 for libpcap includes and libraries and still get the same error.
>  
> Ran the command ldconfig and get the following:
> [root@ccids01 snort-2.9.5.5]# ldconfig -p|grep libpcap
>         libpcap.so.1.2 (libc6) => /usr/lib/libpcap.so.1.2
>         libpcap.so.1 (libc6,x86-64) => /usr/lib64/libpcap.so.1
> [root@ccids01 snort-2.9.5.5]#
>  
>  
> Did a grep for the word “libpcap” in the root directory of Snort’s source directory and get the following message:
>  
> config.log:/usr/bin/ld: skipping incompatible /usr/lib/gcc/x86_64-redhat-linux/4.4.7/../../../libpcap.a when 
> searching for -lpcap
> config.log:/usr/bin/ld: skipping incompatible /usr/local/lib/libpcap.a when searching for -lpcap
> config.log:/usr/bin/ld: skipping incompatible /usr/lib/libpcap.a when searching for -lpcap
> config.log:/usr/bin/ld: skipping incompatible /usr/lib/gcc/x86_64-redhat-linux/4.4.7/../../../libpcap.a when 
> searching for -lpcap
> config.log:/usr/bin/ld: skipping incompatible /usr/local/lib/libpcap.a when searching for -lpcap
> config.log:/usr/bin/ld: skipping incompatible /usr/lib/libpcap.a when searching for –lpcap
>  
>  
> So, I’m stuck and don’t know what to try next.  Google hasn’t been terribly helpful.
>  
> Appreciate any thoughts you may have.
> Jason Youngquist, CISSP, CISA
> Information Security Engineer
> Columbia College – Technology Services
> 1001 Rogers Street, Columbia, MO  65216
> (573) 875-7334
> jryoungquist () ccis edu
> http://www.ccis.edu

Install the dev package of libpcap as well.

James

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!