problem with snort configure script and libpcap

["Youngquist, Jason R." <jryoungquist () ccis edu>]

Hey all,



I'm running on a band new RHEL 6.4 x64 system.  Trying to get snort 2.9.5.5 installed by following the instructions 
found here:

http://felipeferreira.net/?p=1033



I currently have "libpcap-1.0.0-6.20091201git117cb5.el6.x86_64" installed via yum.  Will this version work, or does it 
have to be libpcap-1.1.1?  Tried making libpcap-1.1.1 and got the following error message, so I'm hoping 1.0.0 can work.



[root@ccids01 libpcap-1.1.1]# make

VER=`cat ./VERSION`; \

        MAJOR_VER=`sed 's/\([0-9][0-9]*\)\..*/\1/' ./VERSION`; \

        gcc -shared -Wl,-soname,libpcap.so.$MAJOR_VER  \

            -o libpcap.so.$VER pcap-linux.o pcap-usb-linux.o pcap-can-linux.o fad-getad.o pcap.o inet.o gencode.o 
optimize.o nametoaddr.o etherent.o savefile.o sf-pcap.o sf-pcap-ng.o pcap-common.o bpf_image.o bpf_dump.o  scanner.o 
grammar.o bpf_filter.o version.o

pcap-linux.o: could not read symbols: File in wrong format

collect2: ld returned 1 exit status

make: *** [libpcap.so] Error 1





I get to the Snort "./configure line" mentioned in the article and get the following:



checking for pfring_open in -lpfring... no

checking for pfring_open in -lpcap... no



   ERROR!  Libpcap library/headers (libpcap.a (or .so)/pcap.h)

   not found, go get it from http://www.tcpdump.org

   or use the --with-libpcap-* options, if you have it installed

   in unusual place.  Also check if your libpcap depends on another

   shared library that may be installed in an unusual place

[root@ccids01 snort-2.9.5.5]#



Tried compling with the flags it mentioned in the ERROR message above and get the same error.



[root@ccids01 snort-2.9.5.5]# ./configure --with-musql-libraries=/usr/lib64/mysql -enable-dynamicplugin 
--with-libpcap-libraries=/usr/lib --with-daq-libraries=/usr/local/daq -enable-zlib -enable-gre -enable-mpls 
-enable-targetbased -enable-decorder-preprocessor-rules -enable-ppm -enable-perfprofiling 
--with-libpcap-includes=/usr/lib --with-libpcap-libraries=/usr/lib



Tried using /usr/lib64 for libpcap includes and libraries and still get the same error.



Ran the command ldconfig and get the following:

[root@ccids01 snort-2.9.5.5]# ldconfig -p|grep libpcap

        libpcap.so.1.2 (libc6) => /usr/lib/libpcap.so.1.2

        libpcap.so.1 (libc6,x86-64) => /usr/lib64/libpcap.so.1

[root@ccids01 snort-2.9.5.5]#





Did a grep for the word "libpcap" in the root directory of Snort's source directory and get the following message:



config.log:/usr/bin/ld: skipping incompatible /usr/lib/gcc/x86_64-redhat-linux/4.4.7/../../../libpcap.a when searching 
for -lpcap

config.log:/usr/bin/ld: skipping incompatible /usr/local/lib/libpcap.a when searching for -lpcap

config.log:/usr/bin/ld: skipping incompatible /usr/lib/libpcap.a when searching for -lpcap

config.log:/usr/bin/ld: skipping incompatible /usr/lib/gcc/x86_64-redhat-linux/4.4.7/../../../libpcap.a when searching 
for -lpcap

config.log:/usr/bin/ld: skipping incompatible /usr/local/lib/libpcap.a when searching for -lpcap

config.log:/usr/bin/ld: skipping incompatible /usr/lib/libpcap.a when searching for -lpcap





So, I'm stuck and don't know what to try next.  Google hasn't been terribly helpful.



Appreciate any thoughts you may have.

Jason Youngquist, CISSP, CISA

Information Security Engineer

Columbia College - Technology Services

1001 Rogers Street, Columbia, MO  65216

(573) 875-7334

jryoungquist () ccis edu

http://www.ccis.edu

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!