Snort error...

[Hazem Mahmoud_3]

I installed Snort on my HP-UX ll.11 system, and when I try to run it (with any option) I get the error message:

# snort -?
/usr/lib/dld.sl: Can't open shared library: /usr/local/lib/libpcre.sl
/usr/lib/dld.sl: No such file or directory
Abort(coredump)

It seems I'm missing that library, but cannot find where to get it from. I downloaded Snort from the HP-UX Porting and Archiving Centre. Any ideas? Thanks!

-Hazem Mahmoud

[A. Clay Stephenson]

Snort requires libpcap. Did you download and install it as well?

[Hazem Mahmoud_3]

Yes, however it did not specify which version. Here is what I have:

# swlist | grep libpcap
libpcap 0.7.2 libpcap


-Hazem

[A. Clay Stephenson · Accepted solution]

I have libpcap version 0.9.3 loaded but you also need Perl Compatible Regular Expressions (pcre).

http://gatekeep.cs.utah.edu/hppd/hpux/Languages/pcre-6.2/

Note that pcre also requires libiconv and gettext -- which you can download from the Porting Centre as well.

Install these and snort will work. You should perhaps send a note to the maintainers about the additional dependencies.

[Hazem Mahmoud_3]

Clay, you the man! It seems that did it! Thanks for your help! Your knowledge in this field always amazes me! Thank you.

-Hazem Mahmoud

[Arunvijai_4]

You can download HP Internet Express Snort from
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111
It's compiled with Static version of Libpcap and doesn't require any pre-requisites.

-Arun