Ubuntu 16.04安裝snort含問題解決

源碼方式安裝

wget https://www.snort.org/downloads/snort/daq-2.0.6.tar.gz tar xvzf daq-2.0.6.tar.gz cd daq-2.0.6 ./configure && make && sudo make install  wget https://www.snort.org/downloads/snort/snort-2.9.15.tar.gz tar xvzf snort-2.9.15.tar.gz cd snort-2.9.15 ./configure --enable-sourcefire && make && sudo make install

參考：https://www.snort.org/#get-started CentOS Fedora FreeBSD能夠參考上方官方文檔安裝

安裝過程當中常見問題

1.安裝daq時遇到

configure: error: Your operating system's lex is insufficient to compile libsfbpf. You should install both bison and flex. flex is a lex replacement that has many advantages, including being able to compile libsfbpf. For more information, see http://www.gnu.org/software/flex/flex.html

解決方式

CentOS
yum install flex bison -y
Ubuntu
apt-get install flex bison

2.安裝snort時時遇到

ERROR! Libpcre header not found. Get it from http://www.pcre.org

解決方式

Ubuntu：sudo apt-get install libpcre3-dev
CentOS：sudo yum install pcre-devel

3.安裝snort時遇到

ERROR! dnet header not found, go get it from http://code.google.com/p/libdnet/ or use the --with-dnet-* options, if you have it installed in an unusual place

解決方式

wget https://nchc.dl.sourceforge.net/project/libdnet/libdnet/libdnet-1.11/libdnet-1.11.tar.gz tar -zxf libdnet-1.11.tar.gz cd libdnet-1.11 ./configure && make && make install

4.安裝snort時遇到

ERROR! LuaJIT library not found. Go get it from http://www.luajit.org/ (or) Try compiling without openAppId using '--disable-open-appid'

解決方式：

sudo wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz sudo tar -zxvf LuaJIT-2.0.5.tar.gz cd LuaJIT-2.0.5/ sudo make && sudo make install

5.運行snort時遇到

snort: error while loading shared libraries: libdnet.1: cannot open shared object file: No such file or directory

解決方式：

方法一（未驗證）：

第一步：export LD_LIBRARY_PATH=/usr/local/lib;

第二步：運行/sbin/ldconfig命令更新/etc/ld.so.cache;

注意：能夠經過命令echo $LD_LIBRARY_PATH來查看設置內容

方法二：

建立一個符號連接：sudo ln -s /usr/local/lib/libdnet.1 /usr/lib/libdnet.1

緣由：

1.liddnet.1文件在/usr/local/lib目錄下，可是系統默認的裝載庫路徑卻沒有這個．

2.爲了加快程序執行時對共享庫的定位速度，避免使用搜索路徑，直接讀取庫列表文件/etc/ld.so.cache．