Things I cant understand

[Rick Stevens]

On 10/11/2011 11:53 AM, Kevin Martin wrote:
> 
> 
> On 10/11/2011 12:48 PM, Joao Daniel wrote:
>>     I'm trying to install in F14, 64bits. Snorts need libpcap 
>> version(libpcap.1.0) >= 1. As far as I know Yum repositories do not have 
>> it. Just libpcap version < 1. (libpcap.0.84)
>>
>>   I also have tried a simply ./configure* (without anything) then a make 
>> and make install but again no results.
>>
>> *I guess it would put the files on /usr/lib
>>
>> On 10/10/2011 05:41 PM, Rick Stevens wrote:
>>> On 10/10/2011 01:12 PM, Joao Daniel wrote:
>>>> Folks,
>>>>
>>>> I'm trying to install Snort. So, the first step is update libpcap. Look
>>>> what I have done.
>>>> 1)
>>>>
>>>> yum erase libpcap (to unistall old libpcap)
>>>> tar -zxfv libpcap
>>>> cd libpcap
>>>> ./configure --libdir=/lib/ --bindir=/bin/
>>>> make
>>>> make install
>>>>
>>>> 2)
>>>>
>>>> yum install ./daq.rpm
>>>>
>>>> At this point I got a messagen telling that libpcap is not installed!!!
>>>>
>>>> What is happening ? Did I made a mistake? Better: Why yum cant realize
>>>> that lipcap is already installed ?
>>> We need to know what you're trying to install this on (F14, F15, 32-bit,
>>> 64-bit, etc.).  Snort wants libpcap in /usr/lib or /usr/lib64,
>>> not /lib.
>>>
>>> You should have just done a "yum install libpcap-devel" to get libpcap.
>>> There's no need to install from a tarball--libpcap has been in Fedora's
>>> repos for a LONG time.
>>>
>>> Yeah, I know.  "NOW you tell me!"  :-)
> Are you getting the version of snort from the yum repo or from snort.org directly?  If it's from snort.org (which, based on the rpm
> name, I'm guessing it is) there is a fairly concise howto as to how to install the latest version of snort for F14 ( 
> http://www.snort.org/assets/154/Snort_2.9.0.1_FC14_Base.pdf ).  And, FWIW, the latest x64 version of libpcap for F14 appears to be
> 1.1.1 so it appears that if you do a yum install libpcap you should have a version of libpcap that is new enough to handle the
> version of snort that is in the F14 repos (and the version that is on snort.org, which, from reading the install guide, you have to
> compile and install, not install from rpm).

Actually:

	[root at prophead ~]# rpm -qa | grep libpcap | grep 86_64
	libpcap-1.1.1-3.fc14.x86_64
	libpcap-devel-1.1.1-3.fc14.x86_64

----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          ricks at nerd.com -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
- If you're not part of the solution, you're part of the precipitate -
----------------------------------------------------------------------