Posts

Showing posts with the label snort3

How to install snort 3.1 in Ubuntu 20.10

Image
 In my last post I installed snort3 in Ubuntu 18.04. Now, I tried in Ubuntu 20.10 and I find more issues to fight. When I was compiling I got an Error 2. It is not very intuitive to know what the error is due to. I compiled it again and I catched. Is a libdaq error, associated to a lower version. Now, we proceed to install the last github version of libdaq: git clone https://github.com/snort3/libdaq.git ./bootstrap ./configure make sudo make install Now, we compile again snort, but... make[2]: *** No rule to make target '/usr/lib/x86_64-linux-gnu/libdaq.so', needed by 'src/snort'.  Stop. make[2]: Leaving directory '/tmp/snort3-3.1.0.0/build' make[1]: *** [CMakeFiles/Makefile2:2997: src/CMakeFiles/snort.dir/all] Error 2 make[1]: Leaving directory '/tmp/snort3-3.1.0.0/build' make: *** [Makefile:152: all] Error 2 As you see, snort is looking for libdaq.so in /usr/lib/x86_64-linux-gnu. Now, we look for libdaq.so path with locate libdaq.so /usr/local/lib/lib...

How to install snort3 from github

First, you must clone the repository: git clone https://github.com/snort3/snort3.git cd snort3 Now, install snort2 dependencies and some dependencies that snort2 does not use: sudo apt build-dep snort sudo apt install libhwloc-dev libluajit-5.1-dev libunwind-dev  Now, procced to compile the project: ./configure_cmake.sh cd build make Probably you will see the following issue: daq_dlt.h: No such file or directory This happend, because you need a newer labdaq version (the version installed as dependence from snort is older). git clone https://github.com/snort3/libdaq.git cd libdaq ./bootstrap ./configure make sudo make install Now, come back to snort3 folder and try to compile it again. Probably you will see this issue: undefined reference to daq_version_string' This appears because two versions of daq are installed (repository and github version).  To solve it, like is reported here  just remove the older version: apt remove libdaq-dev Now execute the following: /usr/local...