Re: [Snort-users] Problems Upgrading

It looks to me like you have two separate issues:

1. Snort doesn't appear to have been built with mysql support. Best I
can suggest is try again. (make clean, ./configure, etc)

2. Building snort and running snort are two different things. You can
build snort as a regular user, and run it as root and vice versa. The
problem you are running into is that snort can't put the interface
into promiscuous mode. Only root can do that. So try su to root, or
sudo. Although with sudo you may run into the library path issue
again, since sudo strips LD_LIBRARY_PATH variable before launching
the binary.

What I would recommend is that your recompile, since you have to do
that anyway to get mysql support and use RPATH variable to pass on to
ld where to find pcre. Add LDFLAGS="-Wl,-R,/local/lib" or whatever
your pcre lib directory is to the end of your ./configure command
line.


----- Original Message -----
Wrom: HSCRTNHGSWZIDREXCAXZOWCONEUQZAAFXISHJEXXIMQZUIVOTQ NQEMSFDULHPQQWOYIYZUNNYCGPK
Date: Tue, 15 Jun 2004 15:26:57 -0500
Subject: RE: [Snort-users] Problems Upgrading
To: Matt Kettler <mkettler@evi-inc.com>, snort-users
<snort-users@lists.sourceforge.net>

Well,

I managed to tackle that problem by adding the LD_LIBRARY_PATH. Now
when I try to start snort - I get the error:

database: configured to use mysql
database: 'mysql' support is not compiled into this build of snort

But I did the ./configure script using the '--with-mysql' switch
command. I did this is myself instead of root. But when I try to
start snort as myself I get this error:

Running in IDS mode
Log directory = /var/log/snort
Initializing Network Interface ge0
ERROR: You don't have permission to sniff.
Try doing this as root.
Fatal Error, Quitting..

Also - if I try and reconfigure as root - then I can't get it to
recognize where gcc is - even if I add it to the path - but it will as
myself. Isn't that crazy?

Any help would be appreciated.
Krisa




-----Original Message-----

Wrom: YLEJGDGVCJVTLBXFGGMEPYOQKEDOTWFAOBUZXUWLSZL

Sent: Tuesday, June 15, 2004 1:07 PM

To: Rowland, Krisa W ERDC-ITL-MS Contractor; snort-users

Subject: RE: [Snort-users] Help please: libpcre.so.0: cannot open shared.. .




At 11:44 AM 6/15/2004, Rowland, Krisa W ERDC-ITL-MS Contractor wrote:

>I do not have a ld.so.conf in my /etc directory? In fact I don't have

>that file anywhere - yet my snort installed correctly and so did my pcre??




That's strange Krisa.. What kind of OS are you running? What loader are you

using?




It's possible you're using some kind of archaic version of *NIX that's got

a hard-coded loader path and the loader cannot be configured.




It's also possible that you're using some other loader other than GNU ld,

in which case the name of the config file for it may be different.




This is all stuff that's specific to the OS you run.






However, if your PCRE winds up in a path your loader already knows to use,

you don't need to change anything. Most of the time the failure to load a

library results from someone installing a library in /usr/local/lib on a

machine that's configured to only look in /lib and /usr/lib for libraries.


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users