Thanks for your information.
I do have the info and definition for mb in
/lib/modules/`uname -r`/source/include/asm/system.h
The installation of pcap is not the problem, I was able to install
libpcap-1.0.20041001 successfully in both FC2 and FC3.
Once the MMaped libpcap was installed, the installation of Snort 2.20 was
not successful and returned the following errors as I indicated in the
previous email:
/usr/local/lib/libpcap.a(pcap-ring.o)(.text+0x4d4): In function
`pcap_ring_recv':
/usr/local/src/libpcap/pcap-ring.c:392: undefined reference to `mb'
SS
----- Original Message -----
From: "Phil Wood" <cpw@lanl.gov>
To: "Steve Smith" <steves@is-focus.net>
Cc: <snort-users@lists.sourceforge.net>
Sent: Thursday, December 30, 2004 5:05 AM
Subject: Re: Snort failed to install using Phil Woods' shared memory ring
buffer libpcap
On Wed, Dec 29, 2004 at 02:22:29PM +0800, Steve Smith wrote:
I posted the following message to the Snort user list and got no
response. As such, I would appreciate if you could point me in the right
direction so that I could continue.
I am installing Snort 2.20 using the MMaped libpcap from Phil Woods
web-site: http://public.lanl.gov/cpw/.
The latest version of the MMAPed libpcap is: libpcap-1.0.20041001
The Snort installation went well without any problem under Fedora Core 1.
However, the same installation under Fedora core 2, I got the following
error messages:
/usr/local/lib/libpcap.a(pcap-ring.o)(.text+0x4d4): In function
`pcap_ring_recv':
/usr/local/src/libpcap/pcap-ring.c:392: undefined reference to `mb'
This is usually a sign that your /usr/include hierarchy does not have
the same common headers as used in the kernel you are running.
I normally use Debian. However, I have a redhat system:
$ uname -r
2.6.9-1.715_FC3smp
$
Unfortunately, the trick I use on Debian systems does not work on RedHat
systems. (The trick is discussed under build issues on my web page).
Redhat has inserted some code in its compiler to check that the user does
not use any of the headers supplied under the /lib/modules hierarchy.
Fortunately for me the redhat release indicated above, the gcc version:
gcc version 3.4.2 20041017 (Red Hat 3.4.2-6.fc3)
and possibly the /usr/include hierarchy (although the definition for mb
cannot be found in it [at least by me]), resolve the mb() macro call in
the pcap-ring.c file.
The definition is in the /lib/modules hierachy. I guess if you just make
sure you have:
/lib/modules/`uname -r`/source/include/asm/system.h
the libpcap make should work out.
collect2: ld returned 1 exit status
The Fedora core 2 kernel version is: Linux 2.6.9-1.6
Any ideas or suggestions?
$ grep "define mb" /lib/modules/`uname -r`/source/include/asm/system.h
Once that works and return this line:
#define mb() alternative("lock; addl $0,0(%%esp)", "mfence",
X86_FEATURE_XMM2)
you should be good to go.
Thanks.
SS
--
Phil Wood (cpw_at-sign_lanl.gov)
-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
