ERROR! Libpcap library/headers (libpcap.a (or .so)/pcap.h) not found

OtagoHarbour · 08-19-2012, 10:05 PM

I am running Ubuntu 11.10. I downloaded libpcap-1.3.0.tar.gz to /temp, unzipped and untarred it, went into /tmp/libpcap-1.3.0 and did the following

Code:

./configure
make
make install

Everything went w/o errors but when I subseqnetly download barnyard2-1.9.tar.gz to /tmp, unzip and untar it, go into /tmp/barnyard2-1.9 and run

Code:

./configure

I get

Code:

ERROR!  Libpcap library/headers (libpcap.a (or .so)/pcap.h)
   not found, go get it from http://www.tcpdump.org
   or use the --with-libpcap-* options, if you have it installed
   in unusual place.  Also check if your libpcap depends on another
   shared library that may be installed in an unusual place

When I do a search for libpcap.a, I find

Code:

/tmp/libpcap-1.3.0/libpcap.a
/usr/local/lib/libpcap.a

It would appear that I have not installed it in a way that it can be found by the system. It could be that I installed it as myself and not as root.

Any assistance with fixing this problem would be greatly appreciated.

Peter.

bigrigdriver · 08-19-2012, 11:49 PM

Quote:

It would appear that I have not installed it in a way that it can be found by the system. It could be that I installed it as myself and not as root.

You could not have written anything outside of your /home directory as user; only as root.

With regard to the failure of barnyard to ./configure, it may be that it is looking for a higher version of libpcap that the one you have installed, or it may be looking for libpcap in another location.

Things to try:
1) inspect the source code to see the location it expects to find libpcap, the either symlink or hard link your libpcap to that location.
2) rerun ./configure with the appropriate option to search for libpcap in it present location to see if that works.

Ygrex · 08-20-2012, 12:11 AM

make sure that headers can be found:

Code:

`gcc -print-prog-name=cc1` -v -o /dev/null </dev/null

and, unless you are going to compile against libpcap.a, that libpcap is in cache:

Code:

$ /sbin/ldconfig -p | grep libpcap

OtagoHarbour · 08-20-2012, 08:41 PM

Quote:

Originally Posted by bigrigdriver

You could not have written anything outside of your /home directory as user; only as root.

With regard to the failure of barnyard to ./configure, it may be that it is looking for a higher version of libpcap that the one you have installed, or it may be looking for libpcap in another location.

Things to try:
1) inspect the source code to see the location it expects to find libpcap, the either symlink or hard link your libpcap to that location.
2) rerun ./configure with the appropriate option to search for libpcap in it present location to see if that works.

Thank you for your reply

All of the missing files it mentions are in /tmp/libpcap-1.3.0. I ran the following

Code:

./configure --with-libpcap-libraries=/tmp/libpcap-1.3.0 --with-libpcap-includes=/tmp/libpcap-1.3.0

and still got

Code:

ERROR!  Libpcap library/headers (libpcap.a (or .so)/pcap.h)
   not found, go get it from http://www.tcpdump.org
   or use the --with-libpcap-* options, if you have it installed
   in unusual place.  Also check if your libpcap depends on another
   shared library that may be installed in an unusual place

Thanks,
Peter.

OtagoHarbour · 08-20-2012, 08:44 PM

Quote:

Originally Posted by Ygrex

make sure that headers can be found:

Code:

`gcc -print-prog-name=cc1` -v -o /dev/null </dev/null

Returned

Code:

ignoring nonexistent directory "/usr/lib/gcc/i686-linux-gnu/4.6.1/../../../../i686-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/lib/gcc/i686-linux-gnu/4.6.1/include
 /usr/local/include
 /usr/lib/gcc/i686-linux-gnu/4.6.1/include-fixed
 /usr/include
End of search list.

Analyzing compilation unit
Performing interprocedural optimizations
 <*free_lang_data> <visibility> <early_local_cleanups> <whole-program> <inline>Assembling functions:

Execution times (seconds)
 TOTAL                 :   0.00             0.00             0.00                626 kB

Quote:

and, unless you are going to compile against libpcap.a, that libpcap is in cache:

Code:

$ /sbin/ldconfig -p | grep libpcap

Returned

Code:

libpcap.so.0.8 (libc6) => /usr/lib/i386-linux-gnu/libpcap.so.0.8

Thanks,
Peter.

Ygrex · 08-24-2012, 06:20 PM

well, did you check if pcap.h can be found in one of the listed directories for includes?

OtagoHarbour · 08-26-2012, 04:22 PM

Quote:

Originally Posted by Ygrex

well, did you check if pcap.h can be found in one of the listed directories for includes?

Yes indeed!

Code:

peter@peter-Inspiron-620:~$ sudo find / -name pcap.h -print
/tmp/libpcap-1.3.0/pcap/pcap.h
/tmp/libpcap-1.3.0/pcap.h
/usr/local/include/pcap/pcap.h
/usr/local/include/pcap.h
peter@peter-Inspiron-620:~$

Thanks,
Peter.

chrism01 · 08-26-2012, 05:41 PM

Surely libpcap is in the repos?

Ygrex · 08-27-2012, 01:05 AM

there's should be config.log file with exact test code that failed

knudfl · 08-27-2012, 02:56 AM

The development files for libpcap, Ubuntu 11.10 :

sudo apt-get install libpcap-dev

http://packages.ubuntu.com/oneiric/libpcap-dev
http://packages.ubuntu.com/oneiric/libpcap0.8-dev

.

OtagoHarbour · 08-28-2012, 01:54 PM

Quote:

Originally Posted by knudfl

The development files for libpcap, Ubuntu 11.10 :

sudo apt-get install libpcap-dev

http://packages.ubuntu.com/oneiric/libpcap-dev
http://packages.ubuntu.com/oneiric/libpcap0.8-dev

.

That worked!!! Thanks very much! I did the same for snort as well.

OtagoHarbour · 08-28-2012, 01:58 PM

Quote:

Originally Posted by Ygrex

there's should be config.log file with exact test code that failed

There is config.log in /tmp/barnyard2-1.9 . It ends with a bunch of #defines now that ./configure has worked properly.

Thanks,
Peter.

OtagoHarbour · 08-28-2012, 01:59 PM

Quote:

Originally Posted by chrism01

Surely libpcap is in the repos?

Not sure I understand the question but it was only in the directories I mentioned.

Thanks,
Peter.