Snort mailing list archives
RE: Installing Libpcap on RedHat 7.1
From: "John Berkers" <berjo () ozemail com au>
Date: Sat, 1 Sep 2001 23:13:13 +1000
Becky, Peter, The tar.gz file probably doesn't contain the .so* file because it is created as a result of compiling it. If you are interested in running the latest version of libpcap, follow these steps: extract the files to /usr/src/libpcap-0.6.2 in the resulting directory run ./configure make make install configure will make sure the makefiles are right for your particular system, make will compile the binaries and make install will put them in the right place on your system. I have done the same on redhat 7.0 and 7.1 as well as Mandrake 7.2 without any problems. regards, John Berkers ICQ: 112912 Network Services Hansen Corporation john.berkers () hancorp com au berjo () ozemail com au -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Beckster Sent: Friday, 31 August 2001 4:37 To: Peter Bates Cc: snort-users Subject: Re: [Snort-users] Installing Libpcap on RedHat 7.1 Ah, for the record - I did try Peter's (and thanks to Paul also) suggestion of using the rpm for Redhat (downloaded it from rpmfind.net). Current version is 0.4-39 and it works like a champ. Sorry, but I'm not enough of a linux guru to figure out what was missing/out-of-place in the others packages. Thanks all, Becky Peter Bates wrote:
Hello all... This might seem a silly question, but you have tried with the RH supplied rpm of libpcap, haven't you? I know Marty has reservations about how RH have spliced and diced with libpcap, but I've never had problems with the supplied one (my current snort box was dragged from RH 6.2 to 7.1 without a hitch)... I've also built an rpm from the spec file that is supplied with the tcpdump.org version with no problems... In both cases (based on the spec-file) you end up with the actual library in /usr/lib and the includes in /usr/include/pcap... I've been using snort for some time now (recently moved from 1.7 to 1.8.1) and never encountered the problem of snort not finding these files other than it complaining about a 'non-standard libpcap installation' or something similar... --------------------------------------------------------------------------
------------------------------------------>
Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-927 2124 / Fax: 0207-436 5389 / Pager: 07625 255362Beckster <beckster () gte net> 30/08/01 17:10:57 >>>This sounds similar to my problem - see my email from yesterday, subject "[Snort-users] Libpcap library/headers not found..." Tried libpcap 0.6.2 from tcpdump.org site and also 0.4 from ee.lbl.gov site... -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Beckster Sent: Wednesday, August 29, 2001 05:48 PM Cc: Snort Users Subject: [Snort-users] Libpcap library/headers not found... Howdy, Trying to install snort-1.8.1 on a linux 7.1 i386. Have installed libpcap from tcpdump.org tarball and also tried libpcap from the ee.lbl.gov site. Libpcap.a resides in /usr/local/lib/. Tcpdump-3.6.2 install also fails with this: tcpdump.o(.text_0x687): undefined reference to 'bpf_dump' /usr/local/lib/libpcap.a(pcap-linux.o): In function 'pcap_open_live': pcap-linux.o(.text_0x56f): undefined reference to 'atexit' collect2: ld returned 1 exit status make: *** [tcpdump] Error 1 Error on snort ./configure is below. Any suggestions would be appreciated - I'm kinda stuck now. Regards, Becky ./configure: loading cache ./config.cache checking for a BSD compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking for gcc... gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... no checking for gcc option to accept ANSI C... none needed checking for gcc... (cached) gcc checking whether the C compiler (gcc -O2 ) works... yes checking whether the C compiler (gcc -O2 ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) no checking host system type... i686-pc-linux-gnu checking whether byte ordering is bigendian... no checking how to run the C preprocessor... gcc -E checking for strings.h... yes checking for string.h... yes checking for stdlib.h... yes checking for unistd.h... yes checking for sys/sockio.h... no checking for paths.h... yes checking for inet_ntoa in -lnsl... yes checking for socket in -lsocket... no checking whether printf must be declared... no checking whether fprintf must be declared... no checking whether syslog must be declared... no checking whether puts must be declared... no checking whether fputs must be declared... no checking whether fputc must be declared... no checking whether fopen must be declared... no checking whether fclose must be declared... no checking whether fwrite must be declared... no checking whether fflush must be declared... no checking whether getopt must be declared... no checking whether bzero must be declared... no checking whether bcopy must be declared... no checking whether memset must be declared... no checking whether strtol must be declared... no checking whether strcasecmp must be declared... no checking whether strncasecmp must be declared... no checking whether strerror must be declared... no checking whether perror must be declared... no checking whether socket must be declared... no checking whether sendto must be declared... no checking whether vsnprintf must be declared... no checking whether snprintf must be declared... no checking whether strtoul must be declared... no checking for snprintf... yes checking for strlcpy... no checking for strlcat... no checking for strerror... yes checking for floor in -lm... yes checking for pcap_datalink in -lpcap... no ERROR! Libpcap library/headers not found, go get it from ftp://ftp.ee.lbl.gov/libpcap.tar.Z or use the --with-libpcap-* options, if you have it installed in unusual place "T.Ferris" wrote:Ok, I was trying to install Snort 1.8.1 on my Redhat box, when doing so it
was
giving me the error message. ERROR! Libpcap library/headers not found. Now I have downloaded
Lippcap
from the .gov site. I installed it from a src directory. After that, I
go
back to the Snort install and I get the same error message? What is the correct way for install Libpcap? Thank in advance. ====================== Original Guru www.security-protocols.com ======================
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Installing Libpcap on RedHat 7.1 T.Ferris (Aug 30)
- Re: Installing Libpcap on RedHat 7.1 Beckster (Aug 30)
- Re: Installing Libpcap on RedHat 7.1 Tim Bogart (Aug 30)
- Re: Installing Libpcap on RedHat 7.1 Erek Adams (Aug 30)
- <Possible follow-ups>
- Re: Installing Libpcap on RedHat 7.1 Peter Bates (Aug 30)
- Re: Installing Libpcap on RedHat 7.1 Beckster (Aug 30)
- RE: Installing Libpcap on RedHat 7.1 John Berkers (Sep 01)
- Re: Installing Libpcap on RedHat 7.1 Beckster (Aug 30)