topic Snort error... in Operating System - HP-UX

Snort error...

Hazem Mahmoud_3 — Fri, 30 Sep 2005 10:31:26 GMT

I installed Snort on my HP-UX ll.11 system, and when I try to run it (with any option) I get the error message:

# snort -?
/usr/lib/dld.sl: Can't open shared library: /usr/local/lib/libpcre.sl
/usr/lib/dld.sl: No such file or directory
Abort(coredump)

It seems I'm missing that library, but cannot find where to get it from. I downloaded Snort from the HP-UX Porting and Archiving Centre. Any ideas? Thanks!

-Hazem Mahmoud

Re: Snort error...

A. Clay Stephenson — Fri, 30 Sep 2005 10:48:50 GMT

Snort requires libpcap. Did you download and install it as well?

Re: Snort error...

Hazem Mahmoud_3 — Fri, 30 Sep 2005 10:51:06 GMT

Yes, however it did not specify which version. Here is what I have:

# swlist | grep libpcap
libpcap 0.7.2 libpcap

-Hazem

Re: Snort error...

A. Clay Stephenson — Fri, 30 Sep 2005 11:30:54 GMT

I have libpcap version 0.9.3 loaded but you also need Perl Compatible Regular Expressions (pcre).

http://gatekeep.cs.utah.edu/hppd/hpux/Languages/pcre-6.2/

Note that pcre also requires libiconv and gettext -- which you can download from the Porting Centre as well.

Install these and snort will work. You should perhaps send a note to the maintainers about the additional dependencies.

Re: Snort error...

Hazem Mahmoud_3 — Fri, 30 Sep 2005 18:09:49 GMT

Clay, you the man! It seems that did it! Thanks for your help! Your knowledge in this field always amazes me! Thank you.

-Hazem Mahmoud

Re: Snort error...

Arunvijai_4 — Sat, 01 Oct 2005 00:25:45 GMT

You can download HP Internet Express Snort from
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111
It's compiled with Static version of Libpcap and doesn't require any pre-requisites.

-Arun