Things I cant understand

[Joao Daniel Neves]

Folks,

I'm trying to install Snort. So, the first step is update libpcap. Look 
what I have done.
1)

yum erase libpcap (to unistall old libpcap)
tar -zxfv libpcap
cd libpcap
./configure --libdir=/lib/ --bindir=/bin/
make
make install

2)

yum install ./daq.rpm

At this point I got a messagen telling that libpcap is not installed!!!

What is happening ? Did I made a mistake? Better: Why yum cant realize 
that lipcap is already installed ?

[Marvin Kosmal]

On Mon, Oct 10, 2011 at 1:12 PM, Joao Daniel
wrote:
> Folks,
>
> I'm trying to install Snort. So, the first step is update libpcap. Look
> what I have done.
>
> yum erase libpcap (to unistall old libpcap)
> tar -zxfv libpcap
> cd libpcap
> ./configure --libdir=/lib/ --bindir=/bin/
> make
> make install
>
> yum install ./daq.rpm
>
> At this point I got a messagen telling that libpcap is not installed!!!
>
> What is happening ? Did I made a mistake? Better: Why yum cant realize
> that lipcap is already installed ?

Hi

Need more background information

What are you installing it on??

What version kernel are you using?

Best

Marvin

[Rick Stevens]

On 10/10/2011 01:12 PM, Joao Daniel wrote:
> Folks,
>
> I'm trying to install Snort. So, the first step is update libpcap. Look 
> what I have done.
>
> yum erase libpcap (to unistall old libpcap)
> tar -zxfv libpcap
> cd libpcap
> ./configure --libdir=/lib/ --bindir=/bin/
> make
> make install
>
> yum install ./daq.rpm
>
> At this point I got a messagen telling that libpcap is not installed!!!
>
> What is happening ? Did I made a mistake? Better: Why yum cant realize 
> that lipcap is already installed ?

We need to know what you're trying to install this on (F14, F15, 32-bit,
64-bit, etc.).  Snort wants libpcap in /usr/lib or /usr/lib64,
not /lib.

You should have just done a "yum install libpcap-devel" to get libpcap.
There's no need to install from a tarball--libpcap has been in Fedora's
repos for a LONG time.

Yeah, I know.  "NOW you tell me!"  :-)
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-   UNIX is actually quite user friendly.  The problem is that it's  -
-              just very picky of who its friends are!               -
----------------------------------------------------------------------

[Joe Zeff]

On 10/10/2011 01:41 PM, Rick Stevens wrote:
> You should have just done a "yum install libpcap-devel" to get libpcap.
> There's no need to install from a tarball--libpcap has been in Fedora's
> repos for a LONG time.

And, AIUI, yum only checks its own database to see what's installed, 
which is why it didn't know about it being there.

[Rick Stevens]

On 10/10/2011 02:21 PM, Joe Zeff wrote:
> On 10/10/2011 01:41 PM, Rick Stevens wrote:
> > You should have just done a "yum install libpcap-devel" to get libpcap.
> > There's no need to install from a tarball--libpcap has been in Fedora's
> > repos for a LONG time.
>
> And, AIUI, yum only checks its own database to see what's installed, 
> which is why it didn't know about it being there.

Yes it does, but that wasn't the issue.  There are other things that
most RPMs (devel RPMs that is) do, such as update pkg-info databases,
cause ldconfig updates and other goodies that a lot of "make install"s
from tarballs don't do.  The pkg-config bit is important...that database
is what many "./configure" scripts look at to see if the needed library
is there.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-               The Theory of Rapitivity: E=MC Hammer                -
-                                  -- Glenn Marcus (via TopFive.com) -
----------------------------------------------------------------------

[Joao Daniel Neves]

I'm trying to install in F14, 64bits. Snorts need libpcap 
version(libpcap.1.0) >= 1. As far as I know Yum repositories do not have 
it. Just libpcap version < 1. (libpcap.0.84)

I also have tried a simply ./configure* (without anything) then a make 
and make install but again no results.

*I guess it would put the files on /usr/lib

On 10/10/2011 05:41 PM, Rick Stevens wrote:
> On 10/10/2011 01:12 PM, Joao Daniel wrote:
> > Folks,
> >
> > I'm trying to install Snort. So, the first step is update libpcap. Look
> > what I have done.
> >
> > yum erase libpcap (to unistall old libpcap)
> > tar -zxfv libpcap
> > cd libpcap
> > ./configure --libdir=/lib/ --bindir=/bin/
> > make
> > make install
> >
> > yum install ./daq.rpm
> >
> > At this point I got a messagen telling that libpcap is not installed!!!
> >
> > What is happening ? Did I made a mistake? Better: Why yum cant realize
> > that lipcap is already installed ?
>
> We need to know what you're trying to install this on (F14, F15, 32-bit,
> 64-bit, etc.).  Snort wants libpcap in /usr/lib or /usr/lib64,
> not /lib.
>
> You should have just done a "yum install libpcap-devel" to get libpcap.
> There's no need to install from a tarball--libpcap has been in Fedora's
> repos for a LONG time.
> Yeah, I know.  "NOW you tell me!"  :-)
> Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
> AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
>                                                                -
> UNIX is actually quite user friendly.  The problem is that it's  -
>          just very picky of who its friends are!               -

[Kevin Martin]

On 10/11/2011 12:48 PM, Joao Daniel wrote:
> I'm trying to install in F14, 64bits. Snorts need libpcap 
>
> version(libpcap.1.0) >= 1. As far as I know Yum repositories do not have 
> it. Just libpcap version < 1. (libpcap.0.84)
>
> I also have tried a simply ./configure* (without anything) then a make 
> and make install but again no results.
>
> *I guess it would put the files on /usr/lib
>
> On 10/10/2011 05:41 PM, Rick Stevens wrote:
> > On 10/10/2011 01:12 PM, Joao Daniel wrote:
> > > Folks,
> > >
> > > I'm trying to install Snort. So, the first step is update libpcap. Look
> > > what I have done.
> > >
> > > yum erase libpcap (to unistall old libpcap)
> > > tar -zxfv libpcap
> > > cd libpcap
> > > ./configure --libdir=/lib/ --bindir=/bin/
> > > make
> > > make install
> > >
> > > yum install ./daq.rpm
> > >
> > > At this point I got a messagen telling that libpcap is not installed!!!
> > >
> > > What is happening ? Did I made a mistake? Better: Why yum cant realize
> > > that lipcap is already installed ?
> >
> > We need to know what you're trying to install this on (F14, F15, 32-bit,
> > 64-bit, etc.).  Snort wants libpcap in /usr/lib or /usr/lib64,
> > not /lib.
> >
> > You should have just done a "yum install libpcap-devel" to get libpcap.
> > There's no need to install from a tarball--libpcap has been in Fedora's
> > repos for a LONG time.
> > Yeah, I know.  "NOW you tell me!"  :-)
> > Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
> > AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
> >                                                                -
> > UNIX is actually quite user friendly.  The problem is that it's  -
> >          just very picky of who its friends are!               -

Are you getting the version of snort from the yum repo or from snort.org directly?  If it's from snort.org (which, based on the rpm
name, I'm guessing it is) there is a fairly concise howto as to how to install the latest version of snort for F14 ( 
http://www.snort.org/assets/154/Snort_2.9.0.1_FC14_Base.pdf ).  And, FWIW, the latest x64 version of libpcap for F14 appears to be
1.1.1 so it appears that if you do a yum install libpcap you should have a version of libpcap that is new enough to handle the
version of snort that is in the F14 repos (and the version that is on snort.org, which, from reading the install guide, you have to
compile and install, not install from rpm).

Kevin

[Rick Stevens]

On 10/11/2011 11:53 AM, Kevin Martin wrote:
> On 10/11/2011 12:48 PM, Joao Daniel wrote:
> > I'm trying to install in F14, 64bits. Snorts need libpcap 
> >
> > version(libpcap.1.0) >= 1. As far as I know Yum repositories do not have 
> > it. Just libpcap version < 1. (libpcap.0.84)
> >
> > I also have tried a simply ./configure* (without anything) then a make 
> > and make install but again no results.
> >
> > *I guess it would put the files on /usr/lib
> >
> > On 10/10/2011 05:41 PM, Rick Stevens wrote:
> > > On 10/10/2011 01:12 PM, Joao Daniel wrote:
> > > > Folks,
> > > >
> > > > I'm trying to install Snort. So, the first step is update libpcap. Look
> > > > what I have done.
> > > >
> > > > yum erase libpcap (to unistall old libpcap)
> > > > tar -zxfv libpcap
> > > > cd libpcap
> > > > ./configure --libdir=/lib/ --bindir=/bin/
> > > > make
> > > > make install
> > > >
> > > > yum install ./daq.rpm
> > > >
> > > > At this point I got a messagen telling that libpcap is not installed!!!
> > > >
> > > > What is happening ? Did I made a mistake? Better: Why yum cant realize
> > > > that lipcap is already installed ?
> > >
> > > We need to know what you're trying to install this on (F14, F15, 32-bit,
> > > 64-bit, etc.).  Snort wants libpcap in /usr/lib or /usr/lib64,
> > > not /lib.
> > >
> > > You should have just done a "yum install libpcap-devel" to get libpcap.
> > > There's no need to install from a tarball--libpcap has been in Fedora's
> > > repos for a LONG time.
> > >
> > > Yeah, I know.  "NOW you tell me!"  :-)
>
> Are you getting the version of snort from the yum repo or from snort.org directly?  If it's from snort.org (which, based on the rpm
> name, I'm guessing it is) there is a fairly concise howto as to how to install the latest version of snort for F14 ( 
> http://www.snort.org/assets/154/Snort_2.9.0.1_FC14_Base.pdf ).  And, FWIW, the latest x64 version of libpcap for F14 appears to be
> 1.1.1 so it appears that if you do a yum install libpcap you should have a version of libpcap that is new enough to handle the
> version of snort that is in the F14 repos (and the version that is on snort.org, which, from reading the install guide, you have to
> compile and install, not install from rpm).

Actually:

[root@prophead ~]# rpm -qa | grep libpcap | grep 86_64
    libpcap-1.1.1-3.fc14.x86_64
    libpcap-devel-1.1.1-3.fc14.x86_64

----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
- If you're not part of the solution, you're part of the precipitate -
----------------------------------------------------------------------

[Kevin Martin]

<snip>
> > Are you getting the version of snort from the yum repo or from snort.org directly?  If it's from snort.org (which, based on the rpm
> > name, I'm guessing it is) there is a fairly concise howto as to how to install the latest version of snort for F14 ( 
> > http://www.snort.org/assets/154/Snort_2.9.0.1_FC14_Base.pdf ).  And, FWIW, the latest x64 version of libpcap for F14 appears to be
> > 1.1.1 so it appears that if you do a yum install libpcap you should have a version of libpcap that is new enough to handle the
> > version of snort that is in the F14 repos (and the version that is on snort.org, which, from reading the install guide, you have to
> > compile and install, not install from rpm).
>
> Actually:
>
> [root@prophead ~]# rpm -qa | grep libpcap | grep 86_64
>    libpcap-1.1.1-3.fc14.x86_64
>    libpcap-devel-1.1.1-3.fc14.x86_64
> Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
> AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
>                                                                -
> If you're not part of the solution, you're part of the precipitate -

Yea, I wasn't being quite that exact.  Figured proving that the libpcap in the repo was > 1 was probably enough.

Kevin