Home page logo

snort logo Snort mailing list archives

Snort & OpenBSD 4.8 build problems
From: Ross Lawrie <ross () riverstyx net>
Date: Thu, 04 Nov 2010 14:38:47 -0700


I was hoping someone might be able to offer some advice.  I'm
encountered problems installing Snort on OpenBSD 4.8.  I have
installed an updated libpcap (1.1.1), libdnet (1.12) and DAQ (0.3)
without any obvious problems.  DAQ seems to install its libraries

ls -al /usr/local/lib/libdaq*
-rw-r--r--  1 root  wheel  40382 Nov  4 14:26 libdaq.a
-rwxr-xr-x  1 root  wheel    926 Nov  4 14:26 libdaq.la
-rwxr-xr-x  1 root  wheel  37400 Nov  4 14:26 libdaq.so.0.1
-rw-r--r--  1 root  wheel  41460 Nov  4 14:26 libdaq_static.a
-rwxr-xr-x  1 root  wheel    907 Nov  4 14:26 libdaq_static.la
-rw-r--r--  1 root  wheel  61164 Nov  4 14:27 libdaq_static_modules.a
-rwxr-xr-x  1 root  wheel    931 Nov  4 14:27 libdaq_static_modules.la

I'm able to run daq-modules-config and confirm that it is in my path:

daq-modules-config --static --libs
-L/usr/local/lib -ldaq_static_modules

ldconfig sees the libdaq library:

ldconfig -Rv /usr/local/lib 2>&1 | grep daq
Adding /usr/local/lib/libdaq.so.0.1

However when I try to configure Snort I receive this error:

checking for pcap_datalink in -lpcap... yes
checking for pcap_lex_destroy... no
checking for pcap_lib_version... yes
checking pcre.h usability... yes
checking pcre.h presence... yes
checking for pcre.h... yes
checking for pcre_compile in -lpcre... yes
checking for libpcre version 6.0 or greater... yes
checking dnet.h usability... yes
checking dnet.h presence... yes
checking for dnet.h... yes
checking for eth_set in -ldnet... yes
checking for dlsym in -ldl... no
checking for dlsym in -lc... yes
checking for daq_load_modules in -ldaq_static... no

   ERROR!  daq_static library not found, go get it from

The configure string I'm using for Snort is:

./configure \
--sysconfdir=/etc/snort \
--with-daq-includes=/usr/local/include \
--with-daq-libraries=/usr/local/lib \
--with-libpcap-includes=/usr/local/include \
--with-libpcap-libraries=/usr/local/lib \
--with-dnet-includes=/usr/local/include \

I've seen some suggestion that building DAQ without the ipfw module
could help, but I still encounter the same issue.

Appreciate any suggestions,


The Next 800 Companies to Lead America's Growth: New Video Whitepaper
David G. Thomson, author of the best-selling book "Blueprint to a 
Billion" shares his insights and actions to help propel your 
business during the next growth cycle. Listen Now!
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]