# Snort Installation

## crizoc

Anyone know a how-to site for Snort installation on Gentoo system? Let me know thanx!

 :Very Happy: 

----------

## ARC2300

Actually, it's not that hard.

Just emerge it, then go to "/etc/snort" and there will be an example config file there IIRC.  It has comments and the such on what most people need/don't need.

http://www.snort.org does have documentation and some how-to's, though.

----------

## crizoc

Thank You!

----------

## crizoc

Thank You!

----------

## crizoc

Thank You!

----------

## bjornrun

# emerge snort

...

 *Quote:*   

> 
> 
> checking for libnet version 1.0.2a... no
> 
>    ERROR!  Snort with --enable-flexresp will *only* work with
> ...

 

I got net-libs/libnet, both 1.0.2a-r3 and 1.1.0-r3.

How to fix this and this type of problems?

----------

## silverter

If you go to /usr/include... do you have the libnet.h or a directory libnet? If so, search /usr/include fro libnet.h and if you find it, create a symlink into /usr/inlcude...

Hope this helps, 

regards,

----------

## bjornrun

 :Embarassed: 

libnet.h and libnet/ are present in /usr/include

The problem was a buggy configuration of OpenMosix (mfs with unsynced passwd and perhaps problem with mix of PIII/P4). Whatever the problem, turning of OpenMosix daemons (/etc/init.d/openmosix stop && /etc/init.d/openmosixcollector stop) and redo the emerge snort worked perfect! I must had luck getting everything else installed and only having problem with this because of openmosix (strange?). Random segmentation faults when emerging are now gone also... 

Back to drawing board regarding how to get a stable OpenMosix to work or just use distcc....

 *silverter wrote:*   

> If you go to /usr/include... do you have the libnet.h or a directory libnet? If so, search /usr/include fro libnet.h and if you find it, create a symlink into /usr/inlcude...
> 
> Hope this helps, 
> 
> regards,

 

----------

## Kabuto

ACCEPT_KEYWORDS="~x86" emerge snort worked for me.

----------

## liviux

I had to desactivate flexresp to compile snort:

in /usr/portage/net-analyzer/snort/snort-2.0.0.ebuild, I deleted line 65

--enable-flexresp \

flexresp is used to send tcp-resets. ..

----------

## fastonion

Yeah this work for me too

I had to desactivate flexresp to compile snort:

in /usr/portage/net-analyzer/snort/snort-2.0.0.ebuild, I deleted line 65

--enable-flexresp \

----------

## Landonis

No need to disable flexresp - unmerge libnet and reinstall snort - it will reinstall libnet as a dependency and fix the problem

```

emerge -Cp libnet

emerge -C libnet

emerge -p snort

emerge snort

```

----------

## Raffi

 *Landonis wrote:*   

> No need to disable flexresp - unmerge libnet and reinstall snort - it will reinstall libnet as a dependency and fix the problem
> 
> 

 

That did not do the trick here. The problem seems to be libnet's includes being installed as libnet-1.0... instead of just libnet...

----------

## roboshim

 *Raffi wrote:*   

>  *Landonis wrote:*   No need to disable flexresp - unmerge libnet and reinstall snort - it will reinstall libnet as a dependency and fix the problem
> 
>  
> 
> That did not do the trick here. The problem seems to be libnet's includes being installed as libnet-1.0... instead of just libnet...

 

I agree with Raffi. The core of the problem is that snort and aide want to use libnet-1.0.2a. But latest in portage there is libnet-1.1.0. I can install both of these libs, because libnet 1.1 is in SLOT 1.1 and libnet 1.0.2 is in SLOT 1.0, but libnet-1.0.2a installs its header as /usr/include/libnet-1.0.h and libnet-1.0-config. And the problem is that snort's and aide's configure scripts look for libnet.h and version 1.0.2a in it and probably try to run libnet-config. I think the correct solution is to update/change/patch configure scripts to search libnet with some suffix 1.0. Any idea?

----------

## Raffi

 *roboshim wrote:*   

> 
> 
> I agree with Raffi. The core of the problem is that snort and aide want to use libnet-1.0.2a. But latest in portage there is libnet-1.1.0. I can install both of these libs, because libnet 1.1 is in SLOT 1.1 and libnet 1.0.2 is in SLOT 1.0, but libnet-1.0.2a installs its header as /usr/include/libnet-1.0.h and libnet-1.0-config. And the problem is that snort's and aide's configure scripts look for libnet.h and version 1.0.2a in it and probably try to run libnet-config. I think the correct solution is to update/change/patch configure scripts to search libnet with some suffix 1.0. Any idea?

 

I finally got around to checking bugzilla to see if there was anyone working on this. There are no relevant snort bugs (maybe one of us should post one) but there does seem to be a libnet bug report (27022, currently marked as resolved duplicate with no pointer to what it duplicates) that sheds a little light on what's going on.

If libnet provided better information on where to find its libs and includes, snort might have a better chance and compiling. Snort would still need to use the appropriate libnet-config to find what it needs.

----------

## vidigiani

Are there any temporary workarounds to this other than removing --enable-flexresp? If not, what is the impact of removing this option?

----------

## Raffi

 *vidigiani wrote:*   

> Are there any temporary workarounds to this other than removing --enable-flexresp? If not, what is the impact of removing this option?

 

Removing --enable-flexresp is the easiest work around. Anything else requires a bit of digging. Removing that removes snort's ability to try to stop an attack that it detected.

----------

## Landonis

Sorry, I should not have posted from work without confirming my details  :Embarassed: 

Just to let you know I mangled what I did slightly and after checking /var/log/emerge.log I will just confirm what worked for me:

```

emerge -C libnet

```

This removed both libnet-1.0.2a-r2 and libnet-1.1.0-r3

```

emerge libnet

```

Now this puts on libnet-1.1.0-r3 which is the ebuild that is slightly wonky.

```

emerge snort

```

This will now install libnet-1.0.2a-r3 and snort-2.0.1-r1. I am assuming that this install of libnet covers up the mistakes made by the latest one.

Also, there is already a post about this with another way of doing it which seems easier:

https://forums.gentoo.org/viewtopic.php?t=13637

Hope this works for you!

----------

## vidigiani

Your procedure got me passed the libnet check during .configure. Thanks for the help!

----------

